Creating A Business Continuity Plan

Advice On How To Write A Business Continuity Plan

What is the difference between a Disaster Recovery Plan and Business Continuity Plan?

As explained in the section on Disaster Recovery Plans, there is some variation and vagueness in the way these two terms are used. While they deal with very closely related issues, and do overlap, there are differences between them. Disaster Recovery Plans will focus on the process for how you get back to a full operation once your business has suffered a major disaster. Some people tend to use this term to relate more specifically to IT issues and focus on loss of data related disasters. A Business Continuity Plan is about putting systems in place to prevent disasters, and managing any crisis before it becomes a disaster.

Business Continuity Plan - Check Your Emergency Planning

The first stage in preparing a Business Continuity Plan is to begin with a review of your emergency planning procedures. The best place to start is with your Fire Risk Assessment. If you have carried this out, acted on its findings and kept it up to date, you will be off to a good start. In particular check that:

You have carried out a Fire Risk Assessment and communicated the findings to your staff
You have an Emergency Plan, which designates staff roles and responsibilities in an emergency and sets out clear procedures
All staff are trained in emergency evacuation procedures including any special duties
All staff are aware of accident reporting procedures and how to deal with accidents/incidents at work

Business Continuity Plan - Define The Risks -
What Are The Potential Disasters?

In order to work out how to reduce the risk of business interruptions and recover from them, you need to define the potential disasters. Think of all the possible occurrences that would have serious consequences for your business. Consider things like:

Fire
Data loss/computer failure
Flooding
Bomb threat/terrorism
Failure of vital machinery or equipment
Loss of key staff through illness or other reason
Product defects/recall
Power cut or other utility failure
Legal action or regulatory orders

Try to assess the likelihood or each possibility, and the seriousness of their impact. This should allow you to prioritise them in order of importance.

Business Continuity Plan - Make Contingency Plans

Now that you have identified the worst things that could happen and how they would affect your business, you need to begin to work on putting plans in place to mitigate the risk of each thing occurring, and improve your chances of recovery if it does.

You need to work through each area of your business, putting plans and policies in place that will protect it from the risks you have identified. Start with your most critical business functions and the greatest risks associated with them. Responsibility for this process is crucial. Depending on the size and nature of your business, you may need to assign Business Continuity Project Manager for the whole process, or a responsible person for each section of your business.

Think about the risks you have identified and work out contingency plans with reference to each of the following areas:

Premises and Equipment

Start with the worst case scenario - what would you need to do if your premises were completely destroyed? Similarly, what would happen if a vital piece of equipment or machinery were destroyed or otherwise out of action? Some of the things to consider are listed on the Disaster Recovery Plans page.

Personnel

Your staff are your most valuable asset, so no Business Continuity Plan would be complete without considering the possible impact of losing key people. Most business can deal with reasonable staff turnover, illness, etc, but what if you lose several senior people at once to a major competitor, or a few key female employees take maternity leave at the same time?

Consider the people that are critical to your business - are you doing all you can to retain them? Are they being challenged and rewarded?

Ensure that no-one is the only person with key skills. Specialist skills and knowledge should be passed on and shared. Concentration of key knowledge in one person is a fundamental weakness.

IT Infrastructure and Telecommunications

Most of us rely on IT to a certain extent these days, and many businesses would simply not exist without them. It is pretty safe to say that most companies would soon be in trouble if these systems failed for long. Think about the following:

What would the impact be of a day without these functions? What about three days or a week?
If your computer system was destroyed, would you still be able to access your data - how much would be lost?
What if a competitor got hold of your data?
Would a system failure stop production?
How would you contact customers?
How quickly could you set up alternative arrangements?

Write Your Business Continuity Plan

You now have all the raw ingredients to put together your own Business Continuity Plan. The process involved in the preparation of the Business Continuity Plan, and your subsequent risk reduction measures, will in itself be of great benefit and make your business more resilient.

Make sure your Business Continuity Plan includes the following basic elements:

Details of responsible personnel and their key duties in the event of a disaster
Contact details of all staff and plan for cascading communications
Details of the designated meeting place in the event of premises being unavailable
List of critical functions and structured plan of tasks to be undertaken in order for business to be recovered
Details of location of vital records and 'emergency recovery box' with essential supplies to aid business recovery
Contact details for each resource function (telecoms, IT, stationary, etc) and any supplier relevant to the business recovery
List of key customers and full contact details

Business Continuity Plan - Consultation and Testing

When you have a completed Business Continuity Plan, consultation should be made with all staff, as there will always be potential weaknesses that other team members are much better placed to spot. This process will strengthen the plan and help clarify and communicate individual responsibilities.

It is good practice to review your Business Continuity Plan every six months.