Trouble can arise unexpectedly for any business, forcing you to cease operation and potentially losing you a lot of money. This is why it’s important to have a business continuity plan in place, to make sure that you’re ready should this happen. In this article, we look at what a business continuity plan should include to help you form a plan that suits your business’s individual needs.

What is a business continuity plan?

Business continuity planning is a management process that proactively identifies the potential impact a disruptive event would have on your organisation’s ability to function. This means that you’ll know what to do in the event of business disruption.

Your business continuity plan should:

• Proactively improve your organisation’s resilience against disruption
• Provide a planned method to restore products or services
• Help you to manage an incident to protect the reputation and brand of the organisation.

Planning should recover all aspects of the business and involve:

• Pre-planning with a view to preventing any incidents in the first place
• Emergency response in the immediate aftermath of an incident
• Crisis management including salvage and reinstatement of assets and/or premises, relation, etc, within an acceptable time frames
• Business recovery which involves the management or provision of an acceptable level of service to customers, allowing a return to normal trading.
  
  

How do you make a business continuity plan?

As every business is unique, there may be differences between business continuity plans for different organisations, but there are several key stages which should always be completed.

A business continuity plan should include:

• Project initiation and definition
• Analysis of the potential impact on the business
• Analysis of the threat(s)
• A strategy for dealing with the threat(s)
• Developing a plan
• Testing and review.
  
  

Project initiation and definition

In your plan, you should define what you are trying to achieve, determine realistic timescales and allocate responsibility. Responsibility for implementing and coordinating should be defined and allocated to an individual. They should ensure all areas of your business are represented, see that departments are involved in their own plans, and control the overall development of the plan.

What assumptions are you prepared to make? Can you envisage a total loss of the site or do the existing precautions protect areas adequately? What aspects are to be considered? Normally this will include hard issues such as physical damage from fire, storms, flooding, etc. But does the business need to investigate soft issues such as product recall?

Tolerance is also key. What interruption or disruption can your business tolerate? Perhaps your business exists in a competitive environment which will see customers migrate to competitors in the event of a prolonged interruption. Financial tolerance may be a more relevant measurement in terms of a reduction in turnover or profit.

You also need to define what represents a crisis. This will depend upon the nature of your organisation and its circumstances. Disruption is managed on a day-to-day basis by businesses, so you will need to establish when an incident falls outside the normal coping mechanisms of your organisation. It is important not to invoke the plan too early for fairly minor issues, but equally, any delay in invoking the plan could undermine its effectiveness.

Analysis of the potential impact on the business

This is a key stage of the process that involves looking at what is key in terms of the operation of the business, identifying critical assets and functions and determining the effects of their loss. This may include key pieces of equipment such as computers, IT systems and access to the premises. The continuity plan examines the loss of a function (including external sources) and determines the effect on the business and how quickly it could be replaced or restored.

Analysis of the threat(s)

In this stage, you must now consider the risks to the key assets outlined in the previous step. Are they protected? Hard risks are relatively easy to consider – protection against fire, flood, etc. Soft issues are harder to evaluate, but risks such as product failure and associated recall functions also need to be considered.

Given the potential impact on the business in the event of loss and the potential likelihood of the loss, are your existing protections adequate? If not, can they be improved on a cost-effective basis?

A strategy for dealing with the threat(s)

Your business needs to determine a strategy for overcoming any disruption which fits its needs and tolerances. Sometimes, it may not be possible to come up with a cost-effective solution which replaces production in the event of a prolonged disruption. A valid solution may be to protect the assets from potential loss to the highest possible limit and reduce the risk of total loss occurring. It may then be possible to develop recovery strategies for the resulting partial loss. There are many solutions, including duplication, outsourcing and stockpiling. You can also prioritise the recovery of certain functions to support customers in the event of being unable to fully reinstate.

It is important that the recovery strategy is fully approved and embraced by the organisation and it is fit for your business’s needs.

Developing a plan

When developing a plan, a management team should be formed involving senior management and representation from all areas of the business. The team needs to be able to comment on and take decisions on behalf of the organisation. It will be responsible for overseeing and managing any incident, allowing the business to recover in the most effective manner.

It is important to define an escalation process for incidents. The business will manage issues during normal operations, but you need to know at what stage you want to escalate these to the next level.

It is essential to outline responsibility for lines of communication including staff, media, customers, emergency services, etc.

The plan should include three key areas:

• Emergency response: Procedures at the time of the incident to ensure adequate initial response to and control of the incident. This could be an emergency evacuation procedure or chemical spill procedures.
• Crisis management: This aspect should include an assessment of damage
• Business recovery: Responsible for the recovery of key processes and services within the timescales outlined in the plan.
  
  

Testing and review

Once the plan has been developed and distributed, it should be reviewed on a regular basis, particularly in the event of a change in circumstances to your business.

Testing should be undertaken on a regular basis. This will assist not only in ensuring the plan is a workable document and will highlight any deficiencies, but also will give the team real life practice at implementation.

A good business plan won’t only help you to secure funding or map out goals, it will also highlight potential risks that can impact your business. Having the right insurance in place can help to mitigate these risks. To find out more about Towergate’s comprehensive risk management service, click here.

Consistent with our policy when giving comment and advice on a non-specific basis, we cannot assume legal responsibility for the accuracy of any particular statement. In the case of specific problems we recommend that professional advice be sought.