Chase Senior Manager Joe Rocheleau has explored the “what-ifs” of business resiliency for more than 25 years. In that time, he’s seen his share of crises—from hurricanes and terrorist attacks to power outages and supply chain droughts—and had the opportunity to test a wide variety of strategies for how to adapt to them successfully. We sat down with Rocheleau to talk strategy, procedure, and what businesses should be doing, today, to prepare for a crisis that could happen tomorrow.
What is business resiliency?
Rocheleau: Business resiliency is simply preparing your business to continue its most critical functions in the event of a disruption. We develop a framework of documented strategies and processes that ensure the protection of your company’s assets, as well as a roadmap for how to respond and keep the most vital business functions running while minimizing client, financial or legal impact. Ultimately, a good business resiliency plan saves you time, money and extra work.
Where do I start?
Rocheleau: Typically the planning process starts with a Business Impact Analysis (BIA) or risk assessment. This is where you identify the critical and non-critical processes of your organization, figure out the recovery times required, and then quantify the impact to your business if there were an interruption. Another initial step is developing the scope of the planning effort, which should include technology as well.
What should I take into consideration?
Rocheleau: Aside from identifying critical functions, there are many things to consider. Remember that not everything needs to be covered right away. Important considerations are developing a communications plan for employees, customers and vendors, and identifying all dependencies your business has to continue its operation, such as computer applications, outside vendors and staff with key skill sets.
What are common mistakes in the planning process?
Rocheleau: Focusing too much on one aspect of resiliency planning is pretty common— for example, companies often solely tackle technology, but never consider critical business functions. Another mistake is failing to test the plan repeatedly. Testing allows you to make improvements and ensure that employees with resiliency responsibilities are trained properly and familiar enough with the plan to respond calmly and correctly in an actual emergency.
What makes a business resiliency program successful?
Rocheleau: Business resiliency plans are not static. A successful program needs to be built around an initiative that includes routine planning, testing and maintenance, so that the initial efforts are not lost. Remember that as your business grows and changes, so should your plan.