¿Cómo incorpora las lecciones aprendidas de crisis anteriores en su plan de continuidad del negocio?

Learning from others is invaluable in strengthening your organisation. By analysing their mistakes, you can assess whether you might have made similar errors and take proactive steps to correct those processes. A strong organisation recognises that it doesn’t need to repeat the mistakes others have already made. Lessons learned—whether from your own experiences or those of others—are crucial and can be just as relevant and beneficial when applied to improve your own practices.

As a Business Continuity Expert, you need to think about what case studies or scenarios most apply to your industry and the size of your business. The goal is to create plans that make the best use of your team's time and resources without under or over-planning, which leads to waste. For instance, if you are in a small to medium-sized business (SMB), the impact of a hurricane on your data center primary or secondary location will be much more substantial than in a scenario where a company has multiple failover locations available to them (that are not in the path of a hurricane).

During an exercise or actual event, you should note the areas where actual activity veered from the plan, where staff stepped in to roles they weren't defined for, where the defined tasks in the plan weren't followed, and when tasks not documented in the plan were used. With your gathered notes, make a first pass at updating the plan, then sit with the business unit continuity teams and discuss what you've found. The additional insight will help you hone that draft and get it ready for review. Try to do this as soon after the event as possible, so these points will be fresh in everyone's minds.

The biggest challenge is to 'record the learnings'. Critically ask yourself 'did we learn any lessons?' do not take it as a 'tick in the box' activity. It is possible that no lessons were leant in managing a particular crisis - let it be so, record it as it is and close the 'lessons learnt' book without an entry. But, if you had some, then use them appropriately - whether training needs to be improved, or the policy, or the plans for people/ building/ IT/ utilities/ vendors/ supplies-raw material/ equipment, or testing or audit or reporting etc.

In my experience it is good to review the risk and make an evaluation to ensure that the risk has the appropriate treatment, to create value through the lessons learned I suggest analyzing the cause and defining a treatment, so the impact can be in the range accepted by the process or company, when doing this you must add a section in your plan template that refers as a topic to the scenario you had and attaches the procedure you define to recover, then inform and train all active and passive owners of the plan. and make sure the information is in the right place in the next test, so you can be sure everyone will be on the same page when the crisis hits.