How do you learn from previous disasters to build a better business continuity plan?

When it comes to identifying risks it’s important to convene a team of people who have different backgrounds and perspectives. I see a lot of risk analysis go awry because of the limited perspectives in the early stages. Second, I think it is important to think broad and wide. This isn’t about probabilities but possibilities. Don’t jump ahead when you are trying to identify risks. Third, I would encourage you to think about your biases. Recency and salience biases can really hurt this stage of the planning process.

All previous disaster should be investigated to find out root cause and establishing a CAPA. CAPAs and Re-Assement of site/Operations to be documented after a certain defined time lines. All the learned lessons and CAPA to be taken in SOPs. Procedures /SOPs to be revised to include these lessons.

Analyzing gaps in a continuity plan involves identifying areas where the plan may be incomplete, ineffective, or outdated. Here are some key areas to consider: 1. Risk Assessment: Review the risk assessment process to ensure all potential risks and threats are adequately identified and assessed. Are there any emerging risks that have not been accounted for? Are there any gaps in the risk assessment methodology? 2. Critical Functions and Dependencies: Identify critical functions and their dependencies within the organization. Determine whether all critical functions have been identified and included in the plan. Assess the dependencies and interdependencies between functions and verify if they have been properly addressed.

I have managed numerous large scale disasters, and I can tell you learning lessons from personal experience is easy. Learning from others is harder. Engage with your local BC networks and be willing to ask questions. Most people in this industry are committed to helping others. Lean into this trait. Second, when you read about incidents in news articles, understand that it is based on an individual perception. Read competing news sources and social media channels to get a blended perspective. From here you can then deconstruct the events and make inferences about what might have happened. This then gives you a place to plan for your own organization.

This is a crucial step. BC Plans should be updated regularly, specially if your business (or organization) has gone through some changes since the last update. These changes include: 1. Personnel - update staff rosters and responsibilities. 2. Operations - types of operations, volume, or locations will have a different impact when disaster strikes. The BC Plan should account for those changes. 3. Infrastructure - changes in you cyber or physical infrastructure. 4. Policies and Procedures - these will affect how the BC plan is executed or how to certain recovery activities will be achieved.

Disasters often times start as a small poke at the system. Sometimes the damage can be controlled by seeing the small poke. The earlier the proper plan is started, the less real damage occurs. Remembering that disasters in your company or community can be seemingly low impact, but can be devastating to the few impacted. Being aware of those small pokes, seeing them early may be of great importance in the outcome of the disaster and how many lives it consumes.