Writing a Business Continuity Plan
Business continuity doesn’t have to be difficult or time consuming. If you follow the 5 simple steps below, you should end up with a business continuity plan that will give you confidence that you can withstand a crisis.
If your business needs are more complex or if you are aiming for the British Standard in Business Continuity (BS25999), you may find it necessary to go through a more in depth process. Further information on this can be found in the Where can I find out more? section.
1. Get to grips with your business.
- What is the aim of your business, and what are the key activities involved in achieving it?
- What resources do the key activities need in order to happen? Think about staff, premises, equipment, communication links, IT, suppliers, specific knowledge or training.
- What deadlines do you work to?
2. Assess the risks to your business.
- What would the impact on your business be if some or all of the resources needed to carry out your key activities became unavailable?
- Are there any crises which your business is particularly vulnerable to? The section on What do I need to plan for? may prompt you.
What else could affect your business?
- staff lottery win
- power cut
- The aim of a business continuity plan is to cope with any sort of disruption, regardless of the cause. So if a particular team is a key resource, they may all be off with pandemic flu, or their syndicate may win the lottery - the result is that your key team of staff is no longer available, so you need to plan to deal with this.
3. Develop a strategy to deal with the risks.
Decide how you will handle a crisis by identifying:
- what actions will be taken in a crisis
- how the actions will be done
- who will do those actions
- where the actions will take place (e.g. on-site or at an alternative location)
- what the priorities will be
4. Write your plan.
- Using the information gathered in the steps above, write your plan. It should be simple and flexible so it can handle any sort of disruption.
You may wish to include:
- Details of who would manage an incident
- How this team would be activated and where they would go
- A prioritised list of your key activities
- The minimum resources you need to carry out these activities
- What your backup for each resource would be if they were unavailable
- Specific procedures such as details of where you could operate from if you couldn’t access your normal buildings, how you would access your data backups in this instance and how you would communicate with people
- Contact lists of staff, key suppliers and customers
5. Test and maintain your plan.Once you’ve written your plan, it should be tested to make sure that your assumptions work and that staff become familiar with it and have an idea of what would happen in a real incident. Exercising your plan can take place in a variety of ways from walking-through aspects of the plan or a tabletop exercise to a full-blown simulation. Testing elements of your plan at a time tends to be less disruptive and allows you to focus on gaining as many valuable lessons learned as possible. Once you’ve carried out testing and exercising of your plans you will have identified areas where you can improve things - at this point you should make changes to your plan to ensure it reflects these improvements and remains up to date. You should have a regular cycle of plan maintenance to ensure that your plans don’t sit on shelf gathering dust and end up out of date and next to useless when you actually need to use them.
Once you’ve carried out the steps above, it is not uncommon that you will find areas of your business which could be improved - perhaps cross-training staff so that they are able to cover for key roles; encouraging more home-working to reduce office costs and increase resilience at the same time; or simply to change processes to make them more efficient and less reliant on certain key resources.
In many cases the things which would increase your resilience to a crisis have a cost benefit to your business as well.