When was the last time you audited your IT providers and their supply chains? For most housing providers, they haven’t done so since the original tendering process or during the award of the contract. Increasingly, procurement processes cover whether the prospective supplier has a business continuity plan, and whether it has been used or at least tested. The business continuity scoring in the tender is often a significant indicator of the importance planning for the unexpected.
The problem is that circumstances change during the life of the contract. Your reliance on the supplier may have increased, plans need updating and the author of the plan may have moved on, they may have moved site or expanded, or even changed their own supply chain. If their business continuity plans are gathering dust on a shelf, they will not be worth the paper they are written on and may even cause a distraction from management’s decision-making as they are not aware of the actions expected of them and of others.
Furthermore, when asked about the recovery times specifically for services to the customer in question, over half said that they could return to normal service within four hours. To put this rather optimistic figure in perspective, that rivals some of the recovery times for top financial services companies investing millions in their business continuity strategies.
Does this look too good to be true? I’m afraid to say that a lot of the time it is. What qualifies as a business continuity plan can range from a template downloaded from the internet with spaces to fill in contact details for managers to a one-page list of incident management actions. The key lesson to learn is to request a copy of the plan (sanitised if necessary) to fully understand the extent of the planning. We like to see specific recovery times identified in the plans and if you are a key customer, you should have your own recovery points and times. There needs to be a reality check of the recovery times based on how the resources are going to be replaced, taking into account premises, staff, ICT, data and supplies.
Without carrying out a detailed business impact analysis, the plans written can be rudderless and may be trying to recover the wrong parts of the business. Without exercising the plan or reviewing past incidents, the management team appointed in the plan will not be trained in its use or understand their roles.
This all illustrates the need to look at your suppliers’ business continuity systems. And although some recent failures have been financially driven (e.g. Connaught & Rok), don’t forget the importance of monitoring the credit worthiness of your supply chain and making plans to replace key suppliers if needed.
Mick Bayne is a director of Biscon Planning.
