How Much Should You Spend on Business Continuity Planning?

Business Continuity Plan (BCP) is a valuable tool for being prepared in the event of an unforeseen disaster which impacts your business.  Most organizations will readily agree with this fact that a BCP is needed.  However there is great disagreement within organizations when the question arises “how much planning is enough?”. 

A BCP is a great hedge against unforeseen business interruptions, but it does come at a cost.  Creating, revising and testing a BCP costs both time and money; time of employees spent writing and testing the plan, plus money spent on contracts with backup vendors and consultants.  This is when management begins to question the value of BCP and decisions need to be made to balance the scope of contingency planning against the cost.  At what point are you spending too much for the value you are receiving?
BCP development and implementation by an outsourced consulting company with can easily cost $100,000 or more depending on the scope of the plan and complexity of the organization. Developing your own BCP internally using a template or software incurs the cost of your resources (employee time X hourly rate or salary).  This may be more cost effective for smaller organizations with limited operations and locations.
Regardless of the approach taken, the true value is the remediation of potential losses vs. the cost of BCP.  The questions to ask are

• “How much does cost to be down for a day…for 5 days…for 10 days…?” and
• “What are the highest risk areas which will hit the bottom line the most and the fastest?”

These question are answered in the risk assessment and business impact analyses phase of the BCP creation.  If created appropriately, items identified to be of sufficient risk to the business will require contingency planning.  The scope and cost of contingency planning should be proportional to the risk.  For example, an informational website may not require the same level of redundancy and recovery time objectives as an order-tracking system.  This is evaluated by the business and supported by results of testing the BCP.  A consulting company or vendor may assist in developing the plan and providing the technical solutions, however active participation by resources within the business re required to effectively scope out the BCP, otherwise you could easily end up with costly contingencies which provide limited or no value.  The most fool-proof conservative BCP would always be to buy another entire full scale company complete with facilities and equipment and supplies…. So that if the primary site goes down, you just move everything over to the new site.  Sounds very safe but not at all realistic given the costs and effort required to pull this off.   The other extreme case is to do nothing and hope for the best.  The optimal approach is somewhere in the middle; remediate what really needs remediation and have back up plans for other areas which do not need immediate attention.  Only the business can determine this.