In this week’s bulletin, Charlie discusses the value of going back to basics with a series of business continuity plan walkthroughs, highlighting how a structured review of plan content helped participants truly understand their roles and responsibilities during an incident.
This week, I have been doing a number of plan walkthroughs for a client. The need for this type of exercise arose from an operational exercise I ran a few months earlier. This client has eight BCPs and so as part of an ongoing service we conducted an operational desktop exercise with everyone responsible for implementing their respective BCPs gathered in the same room. About twenty people turned up to the exercise. Looking around the room, two people turned up with a copy of the crisis management plan, which was not relevant to them, and no one at all turned up with a copy of their business continuity plan. Perhaps I had been too ambitious in assuming that because we had written the plan and helped them update it, that the managers would circulate it around their staff.
This week’s exercise was back to basics and taking members of each BCP through their plan, not quite line by line, but not too far off it. As an icebreaker we used online survey tool Kahoot to poll people on their personal confidence, department confidence and how confident they were in the organisation’s ability to respond to and successfully manage an incident. What was interesting was that people were honest about their own abilities, whether excellent or poor, but all departments felt that their ability to manage an incident was significantly greater than the organisation’s.
As part of a plan walkthrough, I believe it is important to place the individual’s plan within the context of how the entire organisation will respond to an incident – I refer to this as essential knowledge. They need to understand the incident hierarchy within the organisation, the roles of each of the CMT and BCP teams, how the organisation interacts with the government response, who is on the crisis management team, and how their part of the organisation interfaces and collaborates with the crisis team. In the future, I will specify for each client what essential information anyone involved in the response needs to know and will always include it in training.
We then moved on to reviewing the plan. Our plans comprise five steps and are intended to be used chronologically. At the start of this section of the exercise, I presented them with a short scenario, and we worked through the plan in relation to that scenario. Step 1 always focuses on understanding the incident, so we provided them with a clip of someone calling to report an incident on site and asking what information they would like to gather. In our first step, there is a series of questions to consider if an incident is reported to you. We then proceed through the plan, discussing how they would respond and prepare themselves for the scenario. For many, it seemed to be the first time they truly understood the plan and its content. It was interesting to observe that each session had a distinct tone, with varying discussions and responses. Additionally, it provided us with a valuable opportunity to identify issues within their plan, as well as aspects that required further text in the crisis management plan.
The fourth part of the exercise involved a quiz using the Kahoot platform, where we presented them with ten questions based on our discussion. The scores were encouraging, reinforcing the value of the back-to-basics approach. The entire exercise lasted an hour and a half, making good use of their time.
In conclusion, if you believe people aren’t familiar with their plan, conduct a plan walkthrough. Focus should be on the content of the plan rather than responding to the scenario. Identify the essential knowledge that every person involved in the response should possess and ensure that this is included as part of your plan walkthrough. It may not be the most exciting exercise, but it could prove to be the most worthwhile.
