Business Continuity Planning: The False Sense of Security Created by Generic Solutions

Many organizations still approach business continuity planning as a compliance exercise.

The document must be produced to satisfy an audit, respond to an insurer’s request or meet a corporate requirement. Once completed, it is filed away, presented when needed and treated as evidence that the company is prepared to deal with a disruption.

The problem becomes apparent when a real event occurs.

A component shortage, a cyberattack affecting a critical supplier, the closure of a strategic route or the failure of specialized equipment can quickly expose the gap between what was written and what can actually be carried out.

A plan may appear complete on paper while offering very little protection when reality sets in.

A Document Is Not Necessarily a Plan

A standard template or checklist can be useful as a starting point. It can help identify key personnel, major suppliers, important equipment and certain emergency measures.

It becomes imprudent, however, when it is treated as a substitute for a complete analysis.

Many plans still rely on broad intentions:

• identify an alternative supplier;
• maintain safety stock;
• establish a crisis management team;
• develop emergency procedures;
• temporarily transfer production to another site.

These measures seem reasonable. They may be. But have they been verified?

Do the alternative suppliers actually have the required capacity? Can they deliver the products within the necessary time frame? Does the alternative production site use the same processes, equipment and certifications? Is the available inventory sufficient to maintain the company’s most profitable or most critical activities?

Without answers to these questions, the plan describes what the company would like to do more than what it will actually be able to do.

Continuity Depends on What the Company Does Not Control

Recent supply chain disruptions have reinforced a reality that is often underestimated: operational continuity does not depend solely on the site where a product is manufactured or a service is delivered.

It also depends on suppliers, subcontractors, carriers, public infrastructure, information systems and, in some cases, the company’s own customers.

As Peter S. Goodman explains in How the World Ran Out of Everything: Inside the Global Supply Chain, today’s supply chains may even depend on political and economic decisions made over several decades.

The risk is not always found within the company’s own walls. A credible plan must account for all of these dependencies and, above all, determine which ones could actually interrupt operations.

Vulnerabilities Vary by Type of Operation

There is no universal business continuity plan because the consequences of a disruption vary considerably from one sector to another.

In a manufacturing environment, the main vulnerability may be a specialized piece of equipment, an obsolete component or a sole-source supplier. A single part can bring a production line to a halt for several weeks if no spare is available and the technical resources required to restore operations must come from abroad.

In the food industry, a few hours may be enough to cause significant losses. The cold chain, approved packaging and transportation speed can become just as critical as production capacity itself.

In the pharmaceutical industry, an alternative supplier cannot always be used simply because it has the required product. Qualification, validation, traceability and regulatory requirements can make replacement slow and complex.

For distribution and logistics operations, continuity depends on a large number of moving parts that may be impossible to control. Port congestion, a rail interruption, a carrier strike or a cyberattack against a logistics system can disrupt operations even when buildings and equipment remain fully functional.

These situations have little in common from a technical standpoint. They nevertheless demonstrate the same principle: the plan must be built around the company’s operational reality, not around a standard list of measures.

Time Is the Real Issue

Business continuity plans often focus on responsibilities and procedures.

Because some delays will be unavoidable, the most useful plans focus primarily on reducing those delays and using available resources in a way that limits their consequences.

How long can the company continue operating without a critical piece of equipment, supplier or system? At what point will inventory become insufficient? How long before an important customer looks for another source of supply? How much time will be required to restart operations?

Some companies can absorb several weeks of disruption. For others, a few hours may be enough to cause significant losses, jeopardize contractual commitments or permanently damage a commercial relationship.

This analysis is often represented through a timeline showing normal operations, the time of the incident and the gradual recovery of operations. It helps distinguish what is important from what is truly critical.

This is also where the maximum tolerable period of disruption, or MTPD, and the recovery time objective, or RTO, are typically established.

These concepts are useful only if they reflect the company’s actual circumstances. Setting a 24-hour recovery objective does not mean operations can truly resume within that period.

The analysis must also define recovery priorities. Not every product, service or customer can necessarily be served immediately. The company must therefore determine in advance which activities must resume first and what minimum resources will be required to make that possible.

These decisions are difficult to make during a crisis. They must be discussed and agreed upon before one occurs so that the recovery effort can be as rapid, effective and coordinated as possible.

An Alternative Solution Must Be Real

One of the most common blind spots in generic plans concerns alternative suppliers.

Listing the name of a second supplier in a document does not guarantee that it will be able to meet the company’s needs.

When a disruption affects an entire region, industry or supply chain, multiple organizations may seek support from the same suppliers, carriers and technical resources at the same time.

Those partners will still need to serve their existing customers. They will not necessarily be able to interrupt their own order books to respond immediately to a new request.

The same reservations apply to production agreements with another site or even with a competitor. These solutions may be valid, but they must be examined in detail: available capacity, equipment compatibility, access to raw materials, quality requirements, confidentiality, contractual responsibilities and implementation timelines.

An alternative solution is credible only when it has been discussed, validated and, where possible, tested.

An Untested Plan Still Relies on Assumptions

A simulation exercise cannot reproduce every condition of a real disruption. It can, however, quickly reveal weak assumptions.

Is the contact information current? Do the designated people understand their roles? Will the necessary data remain accessible if information systems become unavailable? Have suppliers confirmed their capacity? Do the teams know which products and customers must be prioritized?

These are only some of the questions a team responsible for business continuity should seek to validate during an exercise. Without that validation, the plan can create a false sense of security. The organization believes it is prepared because a document exists, even though the most difficult decisions have not yet been made.

Testing the plan is therefore not simply a matter of checking a procedure. It is about confronting the company’s intentions, and those of its personnel, with the constraints they will actually face.

Resilience Is Not Measured by Page Count

A document running dozens of pages can remain largely theoretical. Conversely, a simpler plan can be effective if it is based on a clear understanding of critical activities, dependencies, timelines and recovery capacity.

An organization’s resilience does not depend on the existence of a plan. It depends on its ability to distinguish between what it hopes it will be able to do and what it will actually be capable of doing.