Emergency management is continually evolving. The changing threat environment, including acts of nature, accidents, infrastructure weaknesses, cyber security attacks, and terrorist related incidents, coupled with tightly intertwined supply chains, has increased the urgency to revamp emergency management and business continuity efforts.
Building business continuity and emergency response plans to maintain personnel safety, and protect and restore operations is vital. Companies continue to develop and improve upon existing processes to seamlessly aid in managing risk and the rapid restoration of operational processes. However, with ever-changing threats, multiple sites, and human resource variables across an enterprise, most companies find it challenging to develop and maintain accurate and realistic business continuity plans (BCPs).
While the planning process may be executed with in-house staff, some companies prefer to use seasoned consultants for impartial critical process evaluations and experienced guidance. Consultants should have hands-on experience in business continuity and disaster preparedness. Specialized consultants may offer web-based, database driven platforms that incorporate site-specific business continuity information while streamlining company formats across an enterprise. The web-base option eases maintenance efforts and reduces administrative costs associated with managing BCPs. However, consultants must be able to comprehend core business needs and clearly communicate recommendations in order to successfully develop a customized, site specific, and functional BCP.
According to FEMA, the ability to perform essential functions lies within four key resources.
- Communications and Technology
Site-specific information must be applied to the key resources. It is necessary for continued operation to evaluate and identify alternate site-specific resources that may be utilized during an incident. If one or more of the key resources are lost, critical business processes may be affected. Keep in mind that any new business operations that may have developed also need to be included in these evaluations.
Business Continuity Coordinators (BCCs) are typically responsible for the development and maintenance of business continuity plans. They must work closely with critical business units to understand their processes, identify risks, and provide solutions to help manage and minimize those risks. However, once an incident occurs, the BCCs must communicate, manage, and control activities associated with damage assessments and the recovery of critical business functions. Depending on the enterprise, a BCC may be assigned to an individual facility or a specific geographic location that encompasses numerous facilities with like-operations.
The BCC, in conjunction with the Incident Commander, may be tasked with activating and coordinating organization elements in accordance with an incident action plan. By working with the appropriate business unit leaders assigned to business continuity/recovery plans, the BCC can also provide guidance for compliance with Incident Action Plan (IAP) components.
The BCP should systematically guide specifically assigned personnel to restore operations that are affected by abnormal conditions. It is critical to identify the implications of a sudden loss for each business unit or necessary resource by performing a business impact analysis. While critical process evaluations can determine operational dependencies that are required to maintain normal operations, staff must be trained to carry out the BCP objectives. BCP training and exercises should occur (at a minimum) on an annual basis, or as required by regulations or company policy.
A BCP should identify the minimum staffing levels necessary to remain operational. As recovery advances, staffing levels may require adjustments. Depending on the scenario, the least critical process participants might have to vacate the facility while leaving critical players in motion to maintain or restore necessary functions. Companies should ensure staff, contractors, and suppliers understand their initial and adjusted responsibilities, and recovery time objectives.
Communications and Technology
Clear and effective communication channels and critical technologies must be available in order to disseminate information to employees, assess and relay incident updates, and implement necessary recovery strategies. As part of the business continuity mitigation process, companies should evaluate available communication equipment, mass notification systems, and technology storage and backup processes to ensure accessibility and functionality in multiple business continuity scenarios. All critical communication and technology should be included in a BCP with detailed recovery procedures and recovery time objectives.
Facility management should be a crucial aspect of a business continuity plan. If an area or facility cannot sustain minimum service or operational levels, companies should mobilize resources, and/or relocate equipment and personnel to alternate areas, facilities, or redundant sites. If deemed acceptable, this may include “working from home” strategies. In order to respond quickly and effectively to facility damage, BCPs should include predetermined suppliers/contractors (tree services, plumbers, electricians, restoration companies, and/or necessary skilled trades and suppliers).
For a free download on Designing a Crisis Management Program, click the image below: