BCP: Planning the Plan

By Michele Honomichl

Sara outlined the potential types of scenarios that would call for a Business Continuity Plan (BCP) to be enacted for payroll across her 20 countries. These included IT Infrastructure, Natural Disasters, Country Infrastructure Failures, Vendor Collapse, Banking Issues, Internal Staff Turnover, Heath Epidemic, Country Collapse and others.

Wow, she thought. Do I have all the data, contact information, and configuration to handle a disaster? What are the main points of handling the enactment of a BCP? How do I create test plans for each situation? Ok, One step at a time. What are the critical items I need to make sure I can enact a plan?

1. Communication Plan: What are the critical components of a communication plan?
a. Who is notified if an issue occurs?
b. How are they notified? Phone, text, email?
c. Who has the authority to declare a disaster and enact the plan?
d. Who is the backup to each of the key individuals to the BCP? Do they have the knowledge and authority to enact the BCP if needed?
e. How is the communication plan cascaded throughout the organization to the appropriate people?
f. If notification is required, is there a phone tree/alert process? Is this process automated or does it require human intervention? If human intervention is required, are there backups for each branch in the tree?

Sara started making a list of key individuals that needed to be notified for every location. Some reported up to regional centers, and that caused her to think about potential time zone issues and responsibility levels.

2. Document the Current Process and Contingent Process
a. Is the current process documented for each country?
b. Is the BCP process documented for each country?
c. Are people trained on both the current process and the BCP process?
d. Is the process documentation accessible in the case of an emergency? A BCP is no good to anyone if it is saved on the shared drive at work and the share drive is down as part of the disaster.

Sara was not sure her current process documentation was up to date. So she definitely needed to relook at the flow charts. Once the charts were updated, she could use those as a baseline to create the alternative flows for each BCP scenario. Another thought was where to keep the documentation. If the scenario was a down server or a power outage, the people enacting the BCP might not have access to the documentation if the documentation was housed on the server. She would have to give more thought to where the best place would be to keep these documents, perhaps a separate share drive that is not related to any of the scenarios.

3. Data: What data needs to be gathered for the BCP document?
a. Phone numbers, emails, secondary contact details are needed for all participants in the communications plan.
b. A hierarchy and decision tree needs to be established to ensure the notification is processed properly. To have the quickest turnaround or issue identification, determination of enactment of the BCP, and communication to all people affected as appropriate.
c. Backup bank details in case an international wire is needed.
The gathering of this data was a good start on ensuring the BCP was robust enough to handle most scenarios. Sara believed additional data may need to be gathered as each scenario was reviewed

4. Plans for Each Type of Situation:
a. IT Issue: This typically occurs when a system or technological infrastructure fails. Depending on the sophistication of the country, many companies will have a full failover site for large payroll programs. Smaller programs or countries without strong IT infrastructure may simply have a backup copy of the software and data. In this case, it may take several days to restore.

b. Banking Issue: If a bank is unable to transfer funds because of local country disruptions or system failure, a company should have a second bank ready to transfer the funds. Additionally if a local bank is compromised, then a company should be able to wire funds directly to employees to meet payroll. In that case, international wire instructions should already be available as a part of the BCP data.

c. Vendor Issue: If a vendor is unable to perform its duties, a company may have to use the prior month’s calculations, minus the one-time occurrences and run an estimated payroll. The documentation of current process is critical, so the company knows exactly the functions the vendor performs so that filings can be made and funding completed on time. The payroll will need to be reconciled the following month with the vendor if it recovers or with a new provider.

d. Natural Disaster/Country Collapse: In this case, the whole country may not be operational. These scenarios are often hard to predict but have a very high impact on payroll processing and delivery. In many cases, a BCP will require an alternate site for processing, or usage of prior period date, and international banks for delivery.

Sara had other scenarios to consider, but these were her first to document. Each one had its unique set of challenges and requirements. Although daunting at first, she now felt she had what she needed to build a robust BCP. Once completed, she hoped that she would only ever need to use the BCP once a year – for testing.

TOPIC:

Asset or Equity? That Is Question One
How Real Is Real-Time