Disaster Resource

Recovery Planning for Manufacturing Operations

By Melvyn Musson, CDRP, CISSP, FBCI

First there was Disaster Recovery for Data Centers, then Business Continuity for business operations, now more companies are developing recovery plans for manufacturing operations /sites.

Is this really a new phenomenon? No, not entirely. Manufacturing companies previously considered business interruption aspects but due to the availability of spare manufacturing capacity, or other capabilities, the disruption impact was not company threatening.

The downsizing, re-engineering and other actions that have revised manufacturing into lean and mean operations has removed that manufacturing capacity cushion, hence the move to consider recovery plans.

Another trait found in manufacturing companies is the attitude that "if something happens, we will put enough engineers in the room to solve it." An admirable trait in some ways and one that can help facilitate manufacturing recovery, but not one that should be relied on solely. Such an attitude can help solve problems that can occur during a disaster situation and which were not considered during the development of the recovery plan.

In addition, it must be remembered that manufacturing operations deal with emergencies in the normal course of business. For example, equipment breaks down, suppliers miss deliveries, and employees get sick. Management handles such emergencies in their stride. It is therefore important that recovery plans accommodate and build on such capabilities.

Many non-manufacturing recovery plans contain detailed procedures laid out in a specific sequence. That will not work with manufacturing operations. In the first place, it is contrary to normal ways of operating. Most manufacturing personnel are happier with flow charts and the like. Secondly, the recovery plan must be capable of accommodating changing circumstances based upon the actual business situation at the time of the disaster. Since the shelf life of many products these days is less than 12 months, the recovery plan must be able to accommodate such circumstances.

The recovery plan that is developed should, as a minimum, cover the following:

* Emergency procedures to deal with the initial period of the incident and those actions that can be taken in conjunction with the emergency services and public authorities to stabilize the situation.

* The recovery organization and teams that will implement and manage the recovery process. This will include the team membership and their roles and responsibilities. Use of the Incident Command System should be considered as the basis for the Recovery Management Organization.

* Checklists, action plan and decision matrix to facilitate recovery functions and decisions.

* Several recovery scenarios should be considered and possible recovery strategies developed. The actual strategy utilized will be dependent upon the business circumstances at the time of the disaster. This may be one of the strategies that have been detailed or a combination of several.

* Recovery strategies can range from the use of alternative locations, if these are available, to the use of competitors' facilities or the re-labeling of competitors' products to emphasize on alternate similar products that the company produces. The intent with the recovery strategies should be to maintain the viability and integrity of the company rather than any one individual item or goal.

* Procedures for conducting a situation assessment. This will be the basis for determining at the time of the disaster, the actual recovery strategy to be utilized. The situation assessment must consider the damage that has occurred and the business situation of the company at that time.

* Reconstruction/repair procedures that will be utilized, whether these will be the company's standard procedures or special procedures such as fast track/design build. This will also detail procedures for handling the necessary permits and coordination with local authorities.

A major part of the plan should also be the recovery informational database that will maintain and provide a foundation to support the recovery process. To facilitate repair or replacement, the database should include information on employees, customers, suppliers, asset listings, and equipment specifications. Such a database can be expanded to include other information such as computerized building drawings. Much of the information in the database will be available from various existing sources in the company. However, it must be realized that such sources may not be available at the time of the disaster - they may be in the damaged area. Maintaining such information in the database provides a central point for all the information that is needed. It does, however, necessitate that procedures be developed and implemented to ensure that the information in the database is kept current.

It addition to keeping the database current; there must also be procedures to keep the entire plan current and subject to both a periodic review and a special review should company changes necessitate such a review.

Once the plan is developed, there must be an education and training program to train management and employees in their roles and responsibilities and the overall requirements of the plan.

This should be coupled with an exercise program for the plan. Such a program expands the education and training of management and employees and assists in identifying potential problems and gaps in the plan. Unlike Data Processing recovery plans, it is usually not possible to move to another facility and set up operations. However, that cannot be entirely ruled out as it depends on the individual company's circumstances and the specific arrangements they have internally or externally. However, the normal exercise program utilizes procedures originally developed and utilized in the public sector for exercising emergency management plans, these range from tabletop to full simulation exercises.

One final point that should also be a major consideration in the recovery planning process is the incorporation of an Employer Preparedness Program. It can be said that "Business Recovery begins at Home," particularly when regional type disasters are involved and a program which encourages the use of Family Disaster Plans, employee involvement in Community Response Plans and the formulation of a Key Employee Support Network will facilitate the recovery of manufacturing operations.

About the Author:
Melvyn is President of the Musson Consulting Group and a Principal of the Recovery Facilitation Network, Tel: (314) 461-0536, Fax: (314) 461-0051.