Ensuring that your business can keep going when unexpected events happen has always been important, but the events of the year 2020 have brought the need for sound business continuity to the fore. This article will help you to understand what business continuity is all about, provide guidance on creating a business continuity plan and model that’s right for you, give you advice on an appropriate strategy, and help you to maintain the continuity of your business whatever the world might throw at you in the future.
Disruption to any organization’s business can be very costly, and in today’s online consumer choice marketplace, it can even lead to you losing business to your competitors. Using business continuity techniques to prepare for and plan your reaction to disruptions can help you to significantly mitigate risks, reduce any harm, and in turn, improve the experience of your customers.
Your business can be disrupted at any time by circumstances that are outside your direct control. Business disruption can be a dramatic as a natural disaster or seemingly unimportant such as one of your employees getting sick. Other examples include your premises being flooded by a water leak, one of your suppliers going out of business, or a transport strike that stops your workers from getting into the office. Disruptions like this to your business can happen at any moment, with no warning, and are out of your direct control. Without any emergency preparedness, the implications of these disruptions to your business can be severe.
Business continuity is all about having a plan to deal with these situations so that your organization can continue to function with as little disruption as possible. What is business continuity in detail will be different for each organization, as each organization is different, but each will use the same business continuity principles. Whether you run a commercial business, a public sector organization, a charity, or any other type of organization, you need to understand what is business continuity to help you to keep operating in unforeseen circumstances.
Business continuity doesn’t happen all by itself. Sometimes you might get lucky and be able to carry on as usual after an emergency, but more often than not, your business will be disrupted unless you have created plans for how to keep it going. This might be a high-level business continuity plan that sets up a crisis management team and lets them make the decisions about what to do next. Or it could be a set of more detailed plans that direct the different parts of your business in what they should do next. But trying to keep going without any form of business continuity plan will risk your organization’s survival.
The cycle of events for maintaining business continuity is mostly the same, irrespective of the organization or event that leads to it. Every cycle starts with something untoward happening. This is what should happen next:
Many people get confused between what is business continuity and what is disaster recovery. They are not the same thing and have different goals, but there are relationships between them. Business Continuity is concerned with keeping all essential functions of an organization going when there is a significant disruption to any part of the organization, including IT systems, essential infrastructure, people, and premises.
Disaster recovery (DR) is usually only concerned with the IT and technology infrastructures that support critical business functions. DR is aimed at restoring these critical technology-based systems and services in an emergency after a major event stops them from working. This often involves switching services from the primary site to an alternative location, then switching back again once the emergency is over. Disaster recovery is often considered to be a subset of business continuity.
Consider a holiday booking company that takes orders both online and over the telephone. Both rely on IT systems hosted on the company’s premises. Disaster recovery preparations could include having back-up IT systems in another location, with the data backed up to it several times a day. If the primary IT systems fail, then users could rely on back-up systems. Business continuity arrangements would, of course, include this but also extend to non-IT issues. For example, making preparations for staff to work from home if they were unable to get into the office for any reason.
A business continuity plan, often abbreviated to BCP, is a plan that outlines the actions to be taken when one or more defined events disrupt normal business operations. Having a plan will help you to ensure business continuity. Business continuity planning is the process that helps you to create your BCP, designing a system for prevention and recovery from potential threats to an organization.
Having a well-designed business continuity plan will ensure that your staff and assets are able to get back to operation safely and quickly following a disaster. A BCP should be created using input from key staff and stakeholders, and should be regularly reviewed and updated, particularly if circumstances change. The plan should consider all risks that could materially affect operations, both internal and external. Hence business continuity planning is a key element of any organizations risk management strategy.
Risks should include natural disasters such as fire and flood, anything that could prevent access to your premises, cyber-attacks, and pandemics that could reduce your available workforce. All of the identified risks should be included in your BCP, together with:
Every business, irrespective of its size, should have a BCP. Disruption to normal operations will lead to loss of revenue and higher costs, contributing to reduced profitability. Relying on insurance policies alone will not cover the costs of trying to win back the business that you have lost.
The complexity of the BCP will vary according to the size of the organization, how it is structured, the nature of its business, the risks to continuity, and any external regulatory requirements. The aim should be to create a BCP that is in enough detail to be easily followed but not so complex that it is difficult to understand.
In order to keep the correct focus, it is important to understand what is the primary goal of business continuity planning. It is easy to get side-tracked and think that having a BCP is the primary goal. It isn’t. The purpose of your business continuity plan is to enable your business to continue in operation in as many circumstances as possible. That must be the primary goal of BCP for every organization. The only reason why BCP is required is to keep your company operating. Your BCP strategy must ensure that this is the case.
There are a number of lower-level goals that can help you to understand what is the purpose of a business continuity plan, including:
Creating a good BCP needs investment in time and money. A big part of justifying the value of business continuity planning is understanding how a BCP helps mitigate risk.
Every business faces risks to its continuing existence. While some of these may be unique to each organization, many of them are common. These include:
The process of creating a business continuity plan forces you to consider all these types of risk in the context of your own business operations. That includes assessing the likely impact and the probability of the risk actually materializing. For example, if your premises are on the top of a mountain, then the likelihood of flooding may be very low! This is why trying to adopt a business continuity plan from another organization without reviewing and updating it for your own circumstances isn’t a good approach. At a high level, it can provide a useful BCP plan checklist to act as a guide for your own business continuity requirements, but you need to do the thinking at a detailed level.
There’s an old saying that goes something like ‘Better the devil you know than the devil you don’t know.’ The activities necessary to create a BCP make you think about what those challenges are for you, then think about how you could deal with them. That leaves you significantly better prepared when one of them jumps out at you. That will always help you to maintain business continuity.
As you work through the detail of each possible risk, it’s possible that you will identify actions you can take to mitigate against the risk fully. For example, if you operate a data center, your business continuity planning will identify a risk of total power supply failure. Depending on the likelihood and the cost of alternatives, you might decide to fully mitigate against this risk by investing in generators and fuel supplies. Many commercial data centers have taken this approach, even going to the level of paying fuel suppliers a premium to ensure that they get priority for fuel deliveries if there are fuel shortages. This is an excellent example of where BCP activities have considered every risk in detail.
When you can’t fully mitigate against a risk, then there is a chance that it might materialize. The process for BCP makes you think about what you could do to maintain the continuity of your business if this happens, at worst reducing the impact but at best reducing it to zero. In reality, this is just good risk management, but a business continuity model will give you a good structure and approach for identifying and then managing the risks.
In this section, we will try to answer the question of what does a business continuity plan look like and what should a business continuity plan include, by providing you with a BCP plan outline setting out the elements of a business continuity plan. The detail of what goes into each section will, of course, depend on your own organization and its particular risks, but it should help you to learn how to write a simple business continuity plan.
Developing a business continuity plan is a vital activity for any organization. Any BCP implementation is not trivial. Preparing a BCP is not an academic exercise just to tick a box in an auditors report or complete a BCP plan checklist. What should a BCP contain in detail will be different for each organization, but the structure can be very similar. This section provides an illustration of the structure for a typical BCP Plan should contain.
These typical components of a business continuity plan aren’t meant to be prescriptive, but following this outline will help you create your first high level business continuity plan that you can then develop and elaborate to suit your own circumstances. An organization can have a single plan that covers all functions, or a hierarchy of plans within an overall business continuity model, with each function having its own BCP. This approach helps to avoid an overly large plan that is difficult to follow, but it is a good idea that each individual plan follows the same general structure.
This section is an essential requirement for BCP implementation, as it lists the actions that should be taken in enough detail so that they can be followed if the BCP is invoked. Determining which actions are needed is a key part of developing a business continuity plan. These and all other actions in a BCP are usually set out in a table to aid understanding. E.g.
|Evacuate the building if necessary||Use standard evacuation procedures for the building|
|Ensure all staff report to the Assembly Point.|
The Assembly point for the [team/service/organization] is: The main parking lot
The alternative Assembly Point for [team/service/organization] is: the shopping mall car park
[insert name(s)] is responsible for completing this action
|Call emergency services (as appropriate)|
[insert name(s)] is responsible for completing this action
Different tables should be provided, listing the appropriate actions and responsibilities for:
The actions that the business continuity team should take are listed in this section of the BCP. The actions include:
This section should help you to understand how to create a business continuity plan. It is a good idea to use a structured approach to create a BCP. A typical BCP process flow will follow these BCP planning steps:
Implementing any BCP is a project, so you should follow a project management methodology, using a project team that includes all parts of the business. Business continuity can be implemented solely using internal staff, particularly if you have individuals with the necessary skills and experience. In a large organization, a BCP plan will be prepared by someone that has a role dedicated to business continuity. In smaller organizations, the task can be assigned to another role, but preparing the plan is not an administration task. It requires knowledge of what a BCP Plan should contain and the BCP process flow, strong risk management skills, and a good understanding of who business continuity planning is done for: the whole organization. However, many organizations bring in external companies that specialize in business continuity management (BCM).
One of the key activities for any BCP implementation is the definition of roles and responsibilities, both for the implementation itself but also for BCP execution, maintenance, and improvement. Business continuity approaches are often led by a dedicated individual or team. The BCP team’s composition will vary, depending on the nature of the disruption, and each team member will be assigned specific duties.
Defining and executing training activities and exercises is a key part of any BCP implementation. Training will ensure that employees are prepared so that they can perform their tasks effectively and operate efficiently during an invocation of the business continuity plan. Without this training, employees will not be able to react effectively or swiftly – precisely when speed is of the utmost importance.
It is imperative to get genuine management support for the business continuity plan. Far too often, the plans are created to satisfy a governance requirement, but in reality, the management doesn’t really care about business continuity or disaster recovery plan. They care more about profit, business strategy, client satisfaction, and market share. One approach to get management support is to educate them on the need for business continuity and how important it is for continued business operations. Using examples from other organizations is a good way to help.
Creating an efficient business continuity plan is extremely crucial for every company. Despite this, some organizations still underestimate the need for one, believing that nothing bad can happen to them. This is illogical if you consider the number and wide range of potential threats to any business.
Creating a BCP is not an administrative task. It requires considerable thought and effort by a lot of people. Using a robust approach to BCP implementation that has full management support is vital for success.
Any plan is only as good as its testing, so ensure that you test your BCP plan as soon as you create it, then improve and repeat regularly. Doing this will help ensure that your organization can continue to operate in the face of disruptions, helping you build trust and reputation with your customers.