Always be prepared Featured

8:00pm EDT May 26, 2008

Business continuity planning prepares a company and ensures that it continues operating and servicing its customers shortly after interruptions of any kind occur, including power failures, IT system crashes, natural disasters and supply chain problems.

“Most important, it ensures that a company protects people — employees and customers — and assets,” says Larry Kallembach, executive vice president and chief information officer for MB Financial Bank in Chicago. Kallembach heads the bank’s Risk Management Team.

Smart Business spoke with Kallembach on what business continuity planning encompasses and why it should be a top priority for companies, no matter their size or industry.

What is business continuity planning?

Basically, it’s how an organization recovers its ability to conduct business after an unforeseen event disrupts business.

Continuity planning has always been important, but as companies have grown more reliant on computers and just-in-time inventory, problems arise faster and have more immediate effects. What happened with Y2K and technology and the events surrounding Sept. 11 heightened the awareness of these risks and brought the need for planning to the forefront.

Who can benefit from continuity planning?

All businesses can benefit from continuity planning, but the type of business dictates how simple or complex the plan needs to be. How long can you afford to be without power or computers or inventory? Hurricane Katrina devastated people’s personal lives so much that they weren’t necessarily thinking about their businesses as much as how their families would survive. Companies need to consider not just the workplace but also how employees are personally affected.

Another potential emergency that’s now garnering some attention is a pandemic; for example the spread of the Asian flu. If this occurred, 40 percent of the work force might be disabled. History tells us that to control a pandemic, you have to control people’s movements. People can telecom-mute today, but would the telecommunication infrastructure hold up if everyone had to work from home?

What is the first step in the business continuity planning process?

The first step is conducting a business impact analysis, which identifies an organization’s processes or functions and associates them with how critical they are to business operations. If you’re a trucking firm, losing a computer system may not be as disruptive as a major snowstorm. On the other hand, if you’re a financial firm, a snowstorm might not be a big deal but a computer system going down would be devastating.

What are some of the different plans within a business continuity plan?

A business resumption plan determines how a business can quickly get back up and running after a disaster and continue servicing customers and, ultimately, turning a profit.

A disaster recovery plan works in tandem with a business resumption plan and focuses on restoring systems and infrastructure in order for normal business to resume. How do you start recovering your business and in what priority order? Who is going to do the recovery and where do you get the resources to initiate it?

A crisis management plan defines how a business communicates next steps among staff. Who will communicate the message, and will it be sent internally or externally or both? Where do people go for more information?

An emergency response plan identifies key employees to assess the situation, outlines the steps to stabilize the situation, and focuses on protecting your people and your assets.

What should a business look for in a business continuity planning provider?

It should look for a company that focuses on its marketplace or can identify what it needs. Does it need a company that runs an off-site location to house computer systems and data? Does it require a company that can provide power and a portable generator? Would it benefit by working with someone to help do an assessment and put together a communication plan?

Can a company customize a plan?

Once you’ve conducted a business impact analysis, then you can figure out how to mitigate the various threats to your business. Certain things may not be as important, so a company should pick the pieces that actually make the most sense for its own situation. One key for a successful plan is to educate employees about it and set up and test some sort of communication channel. Then, if something does occur, people will know whom to call or who will call them, where to go and what action steps to take.

LARRY KALLEMBACH is executive vice president and chief information officer for MB Financial Bank in Chicago. Reach him at (847) 653-2232 or lkallembach@mbfinancial.com.