PLANNING ISSUES
The Death
of All
Hazards
Planning?
By CHRISTOPHER BURTON, AMBCI
The time has come for business continuity to evolve beyond the idea of “all hazards” planning and deal directly with the core
causes of business interruptions. This article details an approach that takes everything you loved about all hazards planning
and enhances it with detailed procedures
focused on the resources that your organization cares about most.
ings). Instead, a new approach emerged
that focused primarily on the worst case
scenario: all hazards planning.
Evolution of Business
Continuity
Before we analyze the value of all hazards planning, it’s important to step back
and look at how we got here. Business
continuity originated as disaster recovery as organizations became increasingly
dependent on computer systems. The
fear of computer unavailability not only
spurred the rise of hot sites but also IT
disaster recovery plans that focused on the
recovery of systems, networks, applications, and data.
Beginning in the 1990s, organizations
realized that recovering critical technology
was useless if they lacked the necessary
facilities and personnel needed to operate
the technology. This new thinking led to
recovery planning for facilities that detailed
response tactics for a wide variety of threats
such as tornados, fires, floods, etc.
The new millennium, encouraged by
the events of Sept. 11, 2001, introduced a
new chapter of business continuity planning. Organizations realized that they
couldn’t possibly plan for every potential
way in which their business could be interrupted (such as planes flying into build-
All Hazards Planning
By definition, “all hazards” planning
refers to a basic framework for responding to a wide variety of events. Based on
this “one size fits all” definition, you may
be thinking that it’s the perfect solution for
your business continuity needs. However,
before you begin drafting the plan, it’s
important to look at all hazards planning
objectively in order to determine the value
it provides organizations. (The table above
outlines some of the advantages and disadvantages of all hazards planning.)
There’s no denying that preparedness
efforts of any type (including all hazards
planning) add value to organizations. For
those with limited funding or resources,
all hazards planning provides a response
framework that can guide general communication and collaboration in the event of a
disruptive event. However, as many organizations attempt to implement all hazards
plans, they often create strategies and
documentation that are either too ambiguous or focused exclusively on facility loss
(the perceived worst-case event). As such,
all hazards planning often provides a false
sense of security due to the lack of sufficient details and strategies that would
normally allow an organization to respond
and recover from a range of interruption
scenarios.
Robust Business Continuity
Planning
Recent events such as the H1N1 pandemic (personnel loss) and the hacker
attack on T.J. Maxx (data breach) demonstrated the need for robust business
continuity planning. Why? Both not only
represent higher-likelihood events that
could have a significant impact on an organization’s operational, financial, and repu-tational well-being, but also would meet
the plan activation criteria defined by most
organizations. So, what’s the problem?
Organizations only utilizing an all-hazards
planning approach would lack the specific
details and strategies necessary to successfully recover from complex interruptions
like these, since both require very unique
response approaches.
But what about surprise events such as
the eruption of Eyjafjallajökull in Iceland?
This type of event is commonly referred
to as a “Black Swan Event” because it has
three specific attributes. First, the event is
a surprise. Second, the event has a major
impact. Third, after the fact, the event is
rationalized by hindsight, as if it had been
expected. The volcanic eruption unexpectedly produced an amount of ash so large
that it crippled European air transportation. A general all-hazards plan would
have enabled key organizational decision-makers to gather quickly. However, they
would soon find that they need deeper
analysis of potential solutions before
action could be taken. Alternatively, an
