Putting Your Plan Where It Counts

Recently when visiting a retail company, I noticed that the manager had posted copies of the emergency procedures above all the telephones on the sales floor.

That's a good idea, I thought. Why don't more companies do that?

There are four places where parts of your disaster recovery or business continuity plan should be kept.

At school there was one certainty: shortly after the beginning of every school year there would be fire instruction followed, a week or two later, by a fire drill. Being a boarding school, the fire drill would take place at night, somewhere between 10:30pm and midnight. Even if you didn't know the fire instructions, enough people knew what to do and where to go. The evacuation would take place in an orderly manner, a role call would be held, comments would be made about whether the evacuation time was good enough, and everybody would go back to bed. (Of course, the only fire that occurred while I was there happened in daytime, and people rushed into the building to see what was happening, but that is another story).

The above is an example of the first place copies of some parts of a plan should be kept: inside peoples' heads. When there is a fire there isn't enough time for people to consult a plan or procedure before evacuating a building. Such procedures need to be practiced regularly to ensure that they are fully understood and not forgotten.

The second place where copies of some procedures should be kept is where they will be used. If you look at a fire extinguisher, it has instructions on it about how to use it. (Only one company I've worked for included actual use of fire extinguishers in its safety training — and great fun it was too.) Whether it be shutting down a system or turning off broken plumbing, if it's not blindingly obvious, the procedure should be posted where it is needed. People don't think clearly in emergencies: written or visual instructions in the right place are invaluable.

The third place where copies of parts of a plan are needed is close to the people who might be called upon to put the plan into action. This is also the place is a procedure is needed for review and familiarity purposes.

Finally copies of plans should be available off-site for consultation after an emergency evacuation. Whether this is in employees' homes, at a hot site or alternative location, or somewhere on the web in a compute cloud will depend upon the nature of the company and the type of plan or procedure.

How do you decide which procedures go where?

The easiest method is to visualize the procedure's use and whether the proposed method of presentation is appropriate.

We have discussed fire procedures. Let's look at some others:

• Excuse me Mr. Armed Robber, I just have to consult these procedures before I can give you the money… Hang on while I activate the silent alarm… Obviously robbery procedures need to be inside people's heads. Similarly earthquake evacuation procedures and anything else that requires an immediate reaction.
• You say you have planted a bomb in our building? Sorry, I'm not normally on the switchboard. I'm sure there's something I should be asking you and some things I should note down for the police but it's some time since I did the training course. Can you hold while I find somebody who knows what I should do? … Bomb threat procedures need to be near telephones — the place they are most likely to be used.
• I think I know which valve to shut off to stop the water leak… No it's not that one, but I've got the full instructions in a file in my office… These are procedures that need to be posted where they might be used. (It might be that some pipe labeling is all that is needed in this case).
• The World Health Organization has just announced that it is raising the pandemic alert level to stage 5. What do we do now? … We're revising our new employee training. What needs to be included from the business continuity / disaster recovery perspective? … A bookshelf or company intranet seems appropriate for pandemic contingency plans and incidents with longer warning periods.
• So the building burned down last night and I need to go to the alternate site … Where's that? And what do I do when I get there? … Oh, I should know it because it is in the manual in my office in the building that burned down… Perhaps a split between widely disseminated knowledge (the location of the alternate site) and procedures kept at the alternate site is appropriate.

Are there any places I shouldn’t put procedures?

Returning to our original retail store, the plans were in a public area. Nobody paid me any attention when, as a casual visitor, I read them. I now know what the company will do in the event of a fire, an armed robbery, or a missing child. Perhaps as a casual visitor I shouldn't know these things. But there were no surprises: nothing that the criminal of average intelligence couldn’t easily find out or guess. This was staff information designed for wide distribution, and by putting it in lots of places made it easy for staff to find it when needed.

However, there are some things that shouldn't be too widely distributed:

• Plans for media management. (The media don't like to admit that they are being managed.)
• Plans for kidnap, ransom, and extortion.
• Plans for handling product defects, product tampering, and product recalls.

It's important that a company has these things in place, but widespread knowledge of their contents might either be misinterpreted (so the company thinks it might have to recall a product that has been tampered with) or be misused (it says here that they have kidnap and ransom insurance so they should be able to pay me $5 million).

I'm glad to report that this information wasn't in the booklet posted next to the retailer's telephones. Posting information where it is needed is a good practice. More organizations should do it.