Warning over 'unfit' disaster plans

Business continuity planning has become so driven by information systems that many organisations neglect to practise how employees themselves would seek refuge in the event of a disaster.

John Worthington, an Australian representative of the Business Continuity Institute (BCI) said companies, including banks, with business continuity and pandemic plans have under-utilised them.

"It tends to be systems-driven. They'll all have pandemic plans [but] the problem then is, do they ever get to exercise those pandemic plans? No.

"I'm sure that no one has got to the stage of exercising their pandemic plan. They'll all have them in place, but their main thrust is on alternate sites, [switching] from A to B at a second's notice, and they virtually have mirror sites," he said.

The BCI is a global professional society for the development of business continuity standards.

Worthington said sites like Hewlett-Packard's business continuity site in Rhodes, Sydney, showed how large the scale of moving staff to backup sites was.

Some backup sites in Australia have as many as 600 seats and could be dedicated to one organisation, he said.

"The only question I have with all that is, have they ever tried doing that? Course they haven't. They're not going to do it real-time because that would cause major problems for them.

"So how do they in fact know that they could get that volume of people from site A to site B?

"And I'm not sure whether that's being rehearsed well enough. In fact I suspect strongly it's not," Worthington said.

Many organisations conducted mock disaster scenarios during non-peak periods when movement to backup sites was largely unrestricted. "Particularly on weekends it's quite a comfortable arrangement because there's not much traffic around, people can get from A to B in Sydney quite comfortably. They bring their cars, and they all just arrive," he said.

Worthington's warning comes after the Australian Prudential Regulation Authority this week published pandemic planning guidelines for the finance sector. The guidelines cover a range of business continuity measures members should take, but are not mandatory requirements.

In another sign of the growing importance of business continuity planning, the Australian Bankers Association will hold its inaugural banking continuity forum in Sydney later this month.