Human nature is such that we go about our days under the impression that disasters will never happen to us. As a result, preparedness is often low on the list of priorities. Beneficial uncertainty, financial strain, and daily workloads leave many companies without a sustainable and actionable business continuity plan (BCP).
The 24/7 news bombardments of impending doom and heart wrenching disasters continually emphasizes the need for a BCP, despite its high degree of beneficial uncertainty associated with implementation. Unless regulations require implementation, business practices are not typically based on “what if” scenarios. To add to the complexity, performing a cost-benefit analysis for business continuity is challenging. Managerial decisions are generally based on concrete financials that benefit departments, stockholders, and profitability. Benefits resulting from BCP and mitigation efforts are dynamic in nature, and are not limited to a single structure, department, or operation.
However, nearly every company relies on the following essential functions and/or resources for productivity and profitability:
If one or more of these essential functions and/or resources fails, companies must have alternative processes in order to remain functional. When the disruptions or failures are extended over hours, days, or weeks, a company's general viability is at risk.
Awareness has made it evident that business continuity plans are crucial to insure long-term viability. Companies that prepare for disruptions limit their impact on the overall business processes and accelerate the return to normal business operations. For those not prepared, the situation can negatively affected profitability, customer relationships, and overall business performance.
Most C-level executives’ role is to support and protect company assets. Implementing a BCP with key details and alternate provisional elements can better ensure that a company will survive any type of disruption or disaster. The following elements can be used as a basic outline for a BCP.
1. Plan distribution list: Names, addresses, and contact information of those that retain access to business continuity plan.
2. Key contacts: Identify all primary and secondary contacts that must be made aware of the business interruption. It is important to routinely verify contact information for accuracy.
3. Key Staff Roles and Responsibilities: Job specific checklists and procedures detailing responsibilities from business continuity implementation through recovery. Task teams should be formed, at a minimum, to cover each essential business process. It may be necessary to provide cross team training and provide extended knowledge in case primary team members are not available.
4. Off-site recovery location: Include address, contact info, available on-site equipment, and any necessary external equipment for effective operations.
5. Recovery Action Plan: Incremental processes and procedures necessary for each critical business process to meet goals. Checklists may be developed in increments such as, 1st hour, 24-hour, 48-hour, one week, one month, and long-term recovery.
6. Key customers’ data: Identify communication methods and necessary contact information in order to inform customers of disruptions of deliverables. Effective customer relations and communication may be critical in retaining clients and maintaining positive relationships during a business interruption.
7. Key supplier contact list: Dependencies and interdependencies should be identified and contact information confirmed and detailed. Transportation delays could affect delivery times. Plan mitigate, and communicate accordingly.
8. Alternate suppliers list: The consequences of a supply chain failure on associated key business components can be crippling to productivity. Through the planning process, alternate suppliers should be explored to reduce the impact of supply chain disruptions.
9. Insurance details: Identify details of insurance coverage and accurate contact information. The burden of proof when making claims typically lies with the policyholder. Accurate and detailed records of disruption are imperative.
10. Back-up data: Identify details of computer-back ups and the recovery methods.
11. Technology requirements: Identify necessary hardware and software, and the minimum recovery time requirements for each business unit.
12. Equipment requirements: Detail applicable equipment requirements for each business unit and recovery time goals.
13. Review log: Newly identified hazards and vulnerabilities should be incorporated into the business continuity plan. Log can include necessary equipment used (requiring replacement or replenishment), altered processes, and lessons learned.
For a free download on conducting effective exercises, click the image below: