Your Solution for SMART Response Plans

The Business Continuity Planning Timeline

Posted on Mon, Nov 11, 2013

Not all business continuity events are instantaneous. Although network disruptions and many emergencies are unforeseeable, instances such as significant weather and other events are often predictable, allowing companies to sequentially initiate business continuity plans, if necessary.

Business continuity planning is an ongoing process that should serve as systematically guide for employees to restore operations that are affected by abnormal conditions. Unfortunately, once a business continuity plan (BCP) has been developed, some companies check it off the list as “completed” project. However, if BCP is to be successfully deployed, it must be periodically reviewed, assessed, and updated according to ebb and flow of its designated operations. Plan development and maintenance efforts are typically aligned with the size, complexity, and volatility of a company, or facility.

Below is a general timeline for business continuity implementation. This timeline is inclusive of predicted events, however, it can be accelerated to account for emergency situations and/or timing disparities.

Weeks leading up to identified events:

  • Execute a business impact analysis (BIA) and review
  • Submit BCP updates for each department, as necessary per the BIA
  • Ensure required information/contact list is accurate
  • Train employees on BCP implementation and restorative operations
  • Make specific recommendations for the yearly training program
  • Identify and coordinate all logistical and administrative resources
  • Identify any additional BCP preparation actions

4 Days from identified event

  • Ensure that all actions required for BCP accuracy are complete
  • Advise the BCP management team regarding the developing situation
  • Establish BCP meeting schedule
  • Set incremental time frame for situational updates
  • Evaluate the need and timetable for BCP implementation
  • Advise department heads/coordinators of BCP intentions regarding the situation
  • If relocating operations, coordinate specifics of the move after initial BCP activation
  • Obtain hotels reservation in alternate location, if applicable
  • Execute the final review of the BCP

Business_Continuity_Plan_TRP.jpg

2 Days (48 hours) from identified event
  • Ensure that all BCP actions required up to this point have been completed
  • If BCP is being implemented, move forward and coordinate implementation procedures
  • If applicable, move operations to alternate site
  • If relocating, review the lodging requirements/assignments with BC staff
  • Review the Communication Plan with staff
  • If evacuation is necessary, communicate expectations to staff

During the event

  • If the event occurs without time for added preparation, immediately implement current BCP procedures
  • Confirm all preparedness activities and required actions for implementation are complete
  • Coordinate operations from alternate site
  • Communicate with Department Heads/Coordinators regarding BCP level/status
  • Produce status reports and distribute to BC management team
  • Produce status reports/press releases for stakeholders, clients, and media
  • Generate information bulletins for employees and contractors

Recovery/Post event

  • Ensure all departments are able to implement a full recovery
  • Receive completed status reports and updates from department coordinators
  • If necessary, mitigate any requirements from critical business units to ensure full recovery
  • If applicable and safe, relocate to original operational site
  • If necessary, continue to coordinate recovery operations from alternate site
  • Organize documentation of all executed actions for review and historical record
  • Communicate current BCP level, or deactivation readiness
  • Review expenditures and submit expense reports
  • Prepare the final report, and send to corporate BCP coordinator
  • Review reports and conduct debrief meetings to identify lessons learned
  • Update BCP with lessons learned
  • Schedule BCP training to review updated BCP procedures

 

For a free download on how to conduct an effective emergency exercise, click the image below:

TRP Corp Emergency Response Planning Exercises

Tags: Business Continuity key points, Business Continuity, Extreme Weather, Business Continuity Plan, BCM Metrics

Business Continuity Planning Hazards, Assessments and Analyses

Posted on Thu, Oct 11, 2012

Man made and naturally occurring risks and hazards can have an enormous impact on companies and their ability to operate. As a result, site-specific hazards with the potential to cause injury, damage facilities, or adversely affect the environment should be identified through a risk assessment and incorporated in subsequent emergency planning procedures and business continuity plans

Company assets are continually in jeopardy from potential threatening scenarios. Once risks are identified, mitigation measures can be implemented and emergency scenarios can be addressed. The chart below offers examples of hazards, assets at risk, and potential impacts created by those threats to existing hazards.

Assessment chart (Image provided by Ready.gov: http://www.ready.gov/risk-assessment)

Details of the Risk Analysis

All management levels should take an interest in their company’s risk management program. In order to plan for emergencies and mitigate as necessary, potential risks and hazards must be identified and evaluated. Risk recognition can occur through many paths, including inspections, audits, and job hazard analyses. However, a detailed risk analysis should include, but is not limited to the following:

  • Identify site-specific assets: Assets are unique to each specific industry, company, and site. (See “Assets at Risk” list on the chart above)
  • List hazards that corresponds with each asset:: (See “Potential Hazard” list on the chart above) Multiple hazards may be applicable to a singular asset.
  • Impact and probability factors:  For each hazard consider both high probability/low impact scenarios and low probability/high impact scenarios.
  • Mitigation opportunities: As you assess potential impacts, identify any asset vulnerabilities or weaknesses that would make it susceptible to loss. These vulnerabilities are opportunities for hazard prevention through procedures/processes upgrades or risk mitigation.
  • Probability of occurrence: Identify if the threat scenario is low, medium or high.
  • Impact of scenario estimates: Identify if the impact is low, medium or high for each of the following:
    • people
    • property
    • operations
    • environment
    • financial
    • regulatory or legal
    • contractual
    • brand image or reputation
  • Overall Hazard Rating: Ready.gov suggests using a two-letter combination of the rating for “probability of occurrence” and the highest rating in for “Impact of scenario estimates”. The probability and impact severity of a risk should determine the priority level for planning and mitigation the hazard.

Evaluate each hazard rating for probability and severity resulting from an accident or emergency. The probability and impact severity should determine the priority level for correcting the hazard. The higher the probability and impact severity, the higher the emphasis should be on corrective action. With priorities in place, mitigation measures may include:

  • Changes in daily processes and procedures
  • Isolation and elimination of the root cause of a potential threat
  • Addressing regulatory compliance issues resulting from audits
  • Implementation of risk reducing engineering controls, when applicable
  • Implementation of proactive administrative controls or work place practices
  • Establishment of process to identify inoperable or malfunctioning equipment and machinery through systematic inspections

Companies should also consider the benefits of a business continuity plan (BCP) to counteract the impact of risks and hazards. A BCP may limit operational “down time” due to unforeseen circumstances by prioritizing the needs of core business processes and establishing recovery time objectives. In addition to constraining fiscal viability, operational impacts can be detrimental to relationships with customers, the surrounding community, and stakeholders.

NOTE: Ready.gov offers a basic risk assessment guidance table to aid in performing risk assessments.

Fire emergencies continue to be one of the greatest risks to facilities. For an understanding of the necessary elements in creating an effective fire preplan, download our Fire Pre-Planning Guide.

TRP Corp Fire Pre-Plans Pre Fire Plan

Tags: BCM Standards, Resiliency, Event Preparedness, BCM Metrics