The primary purpose of a Business Continuity Plan (BCP) is to minimize the negative impacts of a business interruption by accelerating the return to “business as usual”. A BCP should be applied to every business, small or large, to provide a framework to ensure operational resilience in the event of business disruption. Industries including manufacturing, healthcare, education, financial, energy, and retail can benefit from business continuity planning, but each organization must create a detailed and specific plan for each of their locations, business units, or functional groups.
Numerous events, such as this winter’s perpetual snow storms, can cause business disruptions. Business interrupting events typically result in the loss or temporary disruption of key business resources including:
- Facilities or Workspace
- Infrastructure or IT Applications/Systems
- Supply Chain
In order to protect a company’s viability, site-specific recovery strategies should be developed with the assumption that a disruption will occur during a peak business cycle, when the services or output are at the highest level and most critical point. A Business Impact Analysis (BIA) enables a company to identify and quantify which business unit that, when absent, would impact profitability and threaten its survival. While the size and complexity of essential business elements required for sustainability vary among companies, the ability to quantify and prioritize critical workflow components is a key business continuity element. Some departments to consider when conducting a BIA for peak cycles include, but are not limited to:
- Finance and Treasury
- Supply and Trading
- Financial Accounting
- Emergency Response/Crisis Management Team
- Accounts Payable
- Environmental Health and Safety
Once critical components are identified, managers should review the following business continuity planning elements for each critical business function:
- Determine what personnel, software, and vendors are required to continue these processes.
- Identify the duration and point in time when an interruption would impair critical processes and develop recovery time objectives.
- Estimate the maximum allowable downtime for each specific business function.
- Identify alternate locations where these processes can be maintained in the event normal facilities are not accessible.
- Identify how communications will be maintained
- Provide training for BCP personnel that are assigned to support the continuity of operations.
A BCP should include site-specific details that can direct process continuation or restoration. The following continuity plan components should be included in a site-specific BCP.
1. Plan distribution list: Names, addresses, and contact information of those that retain secured access to the BCP.
2. Key contacts and notification procedures: Identify all primary and secondary contacts that must be made aware of a business interruption. It is important to routinely verify contact information for accuracy, and train personnel in BCP activation and notification procedures.
3. Key staff roles and responsibilities: Develop position-specific checklists and procedures detailing responsibilities from business continuity implementation through recovery. Task teams should be formed, at a minimum, to cover each critical business process. Business Continuity Team structure, organization charts, and interfaces should be clearly communicated. It may be necessary to provide cross team training, in the event that primary team members are not available.
4. Off-site recovery location(s): Include address, contact information, available on-site equipment, and any necessary external equipment for effective operations.
5. Recovery action plan: Identify/develop incremental processes and procedures necessary to recover each critical business process. Response checklist timelines may include time increments such as 1st hour, 24-hours, 48 hours, one week, one month, and long-term recovery.
6. Customer data: Identify communication methods and necessary contact information in order to inform customers of disruptions of deliverables. Effective customer relations and communication may be critical in retaining clients and maintaining positive relationships during a business interruption.
7. Primary suppliers contact list: Identify contact information of supply dependencies and interdependencies. Transportation delays or events at suppliers’ locations could affect delivery times; therefore the plan should address this issue.
8. Alternate suppliers list: Primary supply chain failures can be crippling to key business components. Through the planning process, alternative suppliers should be explored, and contact information and materials should be documented in order to reduce the impact of primary suppliers’ disruption.
9. Documentation and Insurance details: Identify details of insurance coverage and accurate contact information. The burden of proof when making claims typically lies with the policyholder. Accurate and detailed records are imperative. Documentation forms should be made available to all critical business unit leaders for timely documentation.
10. Technology requirements: Identify necessary hardware and software, and the minimum recovery time requirements for each business unit.
11. Backup data details: Business continuity plans should identify details of data backups and recovery methods. If current backup procedures are questionable, mitigation measures should be evaluated prior to a business disrupting event.
12. Equipment requirements: Identify equipment requirements for each business unit, primary and alternate suppliers, and recovery time goals.
13. Review and revise: On an annual basis or following an incident, incorporate newly identified hazards and vulnerabilities into the business continuity plan. Include necessary equipment used (requiring replacement or replenishment), altered processes, and lessons learned.