Business continuity planning

For the past 20+ years I’ve worked at a large public university in the American Midwest, and over the years I’ve picked up “other duties as assigned.” These are duties that don’t take up all of my time, but are good to work on when things are slow. One of these duties is business continuity planning.

The basic premise behind business continuity planning (BCP) is to plan for what happens after an emergency. Many people know about what they need to do in case of fire, that’s why we have fire drills, but business continuity takes this further by having organizations plan on how they will continue their operations after something happens. The state I’m in is part of Tornado Alley, so it makes sense to plan on what do if a tornado takes out your place of business. At the university there are people who have full time jobs in emergency planning, but each unit also has its own person to oversee the planning, though this is normally in addition to their normal duties. At some point, that was assigned to me.

Every year, the full time emergency planning people come up with a different scenario for the business continuity planners to consider. Sometimes the scenarios are realistic, such as a tornado – i.e. What would you do if a tornado hit your building? What would need to be done for your unit to continue its work? Sometime they are whimsical, such as a scenario involving a zombie apocalypse. In 2019 the scenario was for us to consider what we would do in a flu outbreak that forced half of our staff to stay home. This came in handy the following year when I saw news articles about COVID-19 and suggested that faculty review the previous year’s BCP in case we had an outbreak on campus.

A former supervisor was somewhat critical about business continuity planning because it’s impossible to plan for everything, and when actual emergencies do happen, the plan goes out the window. It’s a valid criticism since the BCP involving a hypothetical flu epidemic wasn’t very helpful in an actual pandemic. On the other hand, the plan isn’t the point. The point is the process of thinking about how to continue business operations if something bad happens. By thinking about how a business could continue if something happened, it’s more likely they’ll be able to survive an actual emergency relatively unscathed.

Most of the BCP scenarios I was involved with had to do with natural disasters such as tornadoes or earthquakes. Even a flu epidemic is a natural disaster of a sort. Once or twice they involved man-made emergencies, such as terrorism. Reading an article about the recent failure of Silicon Valley Bank, it’s probably past time for BCP scenarios to include financial emergencies. I don’t think many business continuity plans consider, “What would you do if your payment processor suddenly failed?” or “What would you do if your bank shuts down?” It’s probably not a wise idea to expect a government bailout, since it can be politically fraught.