For many ventures, the day-to-day running of the organisation takes up so much time and energy that there’s little left over for working out how you would respond in the event of a major disruption. Nevertheless, having a thorough business continuity plan in place is an essential safeguard against your company being shut down, perhaps permanently, by events outside your control.
A fire, flood or cyber-attack could happen out of the blue and bring your business to a complete halt. Even less dramatic events, such as a key supplier going out of business or a transport workers’ strike, can affect your operations with potentially devastating consequences.
Having a business continuity plan can be the difference between bouncing back from a crisis and being forced to close your doors.
Business continuity plan: a definition
A business continuity plan is a set of procedures and instructions for either maintaining core functions in the event of a potentially disruptive crisis, or for restoring them as quickly as possible to enable the business to continue to function with minimal financial loss and/or damage to reputation and viability. It should cover the full range of business processes, for instance manufacturing, sales, human resources, IT, assets, stock and so forth.
Business continuity plans are often confused with disaster recovery plans, but the latter are usually focused on IT and associated infrastructure. While technology is an increasingly important part of any modern business, an IT disaster recovery plan is just one part of a comprehensive business continuity plan. This should look at a wide range of possible scenarios and list clear procedures to be followed in the event of any one occurring.
Business continuity plans are often confused with disaster recovery plans
Before you begin, it’s important to have the full support of key stakeholders. A business continuity plan needs to be implemented from the top down and be fully supported, both in principle and in terms of necessary financial requirements. Everyone must understand that this is an integral part of company policy and that is authorised at the highest level.
The full range of your business activities needs to be looked at and documented, as well as the ways in which different areas rely upon each other. You should also consider reliance upon outside suppliers or contractors. A diagram could be useful to map this out. Once the scope of the plan has been established, it’s time to look at the different business areas in turn.
Business impact analysis
Your business impact analysis is the underlying foundation of your business continuity plan, so it needs to be carried out with all due diligence and care. Identify your essential business functions and what they rely upon in terms of systems, people, premises, equipment, etc. What needs to be in place for work to continue? What is the longest time that they can be out of action without serious disruption?
Next, look at how long it would take to restore the functions that you’ve just documented. If there are gaps – that is, if the estimated recovery time is longer than the maximum tolerable downtime in any area – then these need to be addressed.
Explore as many different recovery strategies and procedures as possible before deciding on the best one to follow in the event of a major disruption. There may not be a one-size-fits-all solution – different scenarios will probably require different strategies, but essentially this is about coping with the consequences rather than the causes.
For instance, if your main manufacturing workshop is out of action, the what and the why is less important than having a back-up plan. Having a strategy to temporarily relocate, or call in third-party manufacturing support, is your priority in the short term.
Building a team
You should have a dedicated business continuity team to work on the plan and implement it if needed. This should include representatives from each of the key business areas that have been identified. Make sure everyone knows their responsibilities and is ready to act in the event of a crisis. Outside of your core team, other employees need to know what is expected of them in the event of a disruptive event.
You should have a dedicated business continuity team to work on the plan and implement it if needed
It’s useful to talk to people who have been through past disasters and encourage them to share their experiences. The business continuity team can test and develop the plan through discussions, table-top exercises, structured walk-throughs and simulations involving roleplay and disaster drills. It’s important that the business continuity plan is regularly reviewed and updated as the business grows and changes.
Information is power
Keep an up-to-date list of everything you need to know in an emergency, including the location of the plan itself and the people who can implement it. This checklist should include the level and location of stocks, supplies and essential equipment, as well as back-up sites, both physical and in terms of computer data. Contact information for key personnel, emergency responders and backup providers should also be included.
Business interruption insurance should be a part of any full business continuity plan, and the details of your insurer should be on your essential contacts list. Prevention is always better than cure, however, and your insurance policy should be regarded as the last safety net, rather than a foolproof solution.
Identify and document
Creating an effective business continuity plan is about understanding your organisation and the way it works. The specific recovery strategies you put in place will vary according to the nature of your business, the likely threats you face, and the resources at your disposal. Just as some functions will need to be prioritised ahead of others, so threats will need to be prioritised according to likelihood and potential impact.
Identifying and documenting key business areas and critical functions, as well as the dependencies between each area, and the acceptable downtime for each function, will give you an idea of the situation to be tackled. Recovery strategies and procedures can then be drawn up to make sure that your business gets back on its feet as quickly as possible.
The team at Alan Boswell Risk Management can help you build a comprehensive business continuity plan. To find out more, give them a call on 01603 967900.