Your Solution for SMART Response Plans

Supply Chain Business Continuity: Have you Planned for Disruptions?

Posted on Thu, Jun 25, 2015

Weather, natural disasters, and other uncontrollable events can interrupt transportation flow and your supply chain – anytime, anywhere, and with little warning. - FedEx.com service alert

In January and February of 2015, blizzards, ice, and frigid cold temperatures targeted the eastern half of the United States. The deluge of extreme weather brought residents, cities, and supply chains to their knees. Meanwhile on the west coast, labor disputes between the International Longshore and Warehouse Union and the Pacific Maritime Association created the partial closure of 29 ports. The Port of Oakland experienced a 39% drop in cargo imports because of the circumstances (Wall Street Journal). The trucking and railroad industries lost valuable time and money, and customers experienced delayed delivery of tons of expected goods. The ripple effect of delayed shipments forced many customers to stockpile goods when available, and alter contracted shipping means when time sensitive goods were required.

Ensuring ample supplies in the midst of an incident can be challenging, especially when external forces create delays. Supply continuity and preparedness efforts are becoming more important as more companies depend on world-wide suppliers. These recent major supply disruptions, both on the east and west coasts, emphasize the need to develop business continuity plans (BCPs) that identify primary and secondary suppliers and alternate resources. By identifying and contracting with vendors and alternate suppliers prior to an incident, a company improves its ability to quickly and successfully respond to unforeseen disruptions.

Pre-emptive identification and mitigation efforts are crucial to preventing supply chain interruptions and costly consequences. Factors to consider in the identification of critical suppliers are complex and extend well beyond first glance analyses. While suppliers of material goods and business-specific products may be critical to business practices, suppliers may also include those that provide the following services, utilities, or infrastructures:

  • Sole source services
  • Electrical power
  • Water
  • Fuel
  • Telecommunications
  • Transportation
  • Staffing
  • Waste Management
  • Facilities

Companies should utilize BCPs to prepare for incidents that could impair or impede the ability to operate as a result of a temporary or permanent loss of required supplies, equipment, critical staff, data, and necessary infrastructure. A BCP can help minimize or counteract many of the potential impacts of a supply interruption or set procedures in motion that limit the effects on operations.

Identification of risks and business impact analyses (BIA) should be performed for critical supply chains as part of the development of BCPs. For common disruptions, inept supplier performance, required resources forecasting errors, and transportation and delivery breakdowns, companies can typically utilize historical data to quantify the level of risk and necessary response effort. However, when extraordinary events impact the supply chain, such as the east and west coast incidents, companies may encounter atypical and domino effect impacts. Continuity plans with supply chain response measure must be in place to mitigate the disruption, sustain operations, and restore “business as usual”.  The following supply chain related questions, while not all-inclusive, can be used as response planning discussion points to identify necessary supply-related business continuity and response elements:

  • How would a potential critical material supply disruption affect both internal and external resources?
  • Have critical supplies, interdependencies, and potential bottleneck scenarios been identified?
  • Have critical materials and response equipment needs, minimum levels, and recovery time limits been evaluated and defined?
  • Are processes in place to monitor internal and external supply chains that identify potential delivery disruption?
  • Have back up suppliers been identified and communicated with?
  • Are memorandum of understandings (MOUs) for services, and equipment or supply contracts been established and/or up-to-date?
  • Do business continuity initiation procedures encompass verified primary and secondary supply chain contacts?
  • Is there historical data that indicates potential impacts and durations that can be used for planning?
  • Are “Best Practices” supply chain continuity procedures available from like-companies and industry experts?
  • Do critical suppliers have alternate processes and delivery methods in case an event affects their operations?
  • Have supply disruption scenarios been included in emergency response and business continuity exercises?
  • Are employees trained in the event of supply disruption?
  • Have mitigation measures been examined and implemented based on BIAs?

TRP Corp - Emergency Response Planning Crisis Management

Tags: BCM Standards, Business Continuity key points, Business Continuity Plan, Business Disruption, Mitigation

How to Maximize Corporate Emergency Preparedness for the Unpredictable

Posted on Thu, Oct 02, 2014

Planning for the unpredictable is part of emergency preparedness. Whether preparedness is mandated by corporate policy or regulatory agencies, risk management in cooperation with widely accessible emergency response plans can maximize efficiency and minimize the impacts on employees, the environment, and infrastructure. However, efforts to prepare for, manage, or mitigate risks are often unexecuted, shelved by constrained resources, profit margins, politics, or alternative goals.

In an effort to maximize preparedness and minimize inherent risks, corporate emergency management should provide:

  • A system for assessing and prioritizing incidents
  • Streamlined and standardized response methods
  • Communication and notification procedures
  • Roles and responsibilities for corporate and incident level response teams
  • Optimized training, drills and exercises
  • A demonstrated commitment to safety

By prioritizing an emergency management program, a company demonstrates the foresight to address emergency situations and associated challenges, and proactively affirms its efforts to ensure the safety of employees, the environment, and the surrounding communities. However, in order to maximize safety and plan for inherent emergency situations, site-specific threats and risks must be identified, assessed, mitigated, and planned for.

To manage workplace risks, each facility should be analyzed for potential hazards. These threats to operational status quo may be present in the form of unsafe acts and/or unsafe conditions. Once risks are recognized and evaluated, they should be eliminated if possible, or controlled through procedural planning. A risk management program should include, but not be limited to the following processes and prevention program.

RISK RECOGNITION:

  • Risk recognition can occur through inspections, audits, and job hazard analysis
  • All levels of management should take interest in their company’s risk management program
  • Each manager should establish realistic goals for risk reduction and prevention within their area of responsibility
  • Consult with local or online sources that have pre-identified risks based on site operations and location.

RISK EVALUATION:

  • Evaluate accident probability for each process, procedure, and handled material and resulting level of potential severity if an accident were to occur
  • Evaluation should take into account the time, place, and conditions in which threats or hazards might occur
  • The probability and severity of a risk should determine the priority level for correcting the hazard. The higher the probability and severity of risk, the higher the emphasis should be on corrective action

Business_Continuity_Plan_TRP.jpg

RISK ELIMINATION or RISK CONTROL

  • Targeted effort should be made to isolate and eliminate the root cause
  • Realized mitigation opportunities may reduce the amount of response resources required in the event of an incident
  • If root cause cannot be eliminated, changes in process and procedure should be made in order to reduce risk:
    • Implement risk reducing engineering controls, when applicable
    • Implement proactive administrative controls or work place practices
    • Establish process to identify inoperable or malfunctioning equipment and machinery through systematic inspections
    • Establish processes to minimize the effects of naturally occurring hazards
    • Ensure control does not hinder regulatory compliance

RISK COMMUNICATION:

  • Apply the results of analysis through planning and exercises. Employees should be made aware of hazards associated with any workplace process, materials, or location.
  • Accident prevention signs should be posted to remind occupants of the presence of hazards
  • Establish and communicate emergency response plans to employees and appropriate emergency response teams. This includes up to date contact information and notification procedures
  • Calculate, specify, and communicate resource requirements and operational capacities for each targeted scenario to internal and external responders
  • Counteract onsite response deficiencies for each scenario by implementing coordinated interoperability communication

Understanding your company’s risks, from the facility to the corporate level, is essential to preparedness and sustainability. Companies that prioritize risk management and integrate preparedness goals are better prepared to educate employees on potential incidents, and their role in protection, prevention, mitigation, response, and recovery.

Auditing your current program is crucial. Click here, or the image below, to download a free Audit Preparedness Guide:

Regulatory Compliance with TRP Corp

Tags: BCM Standards, Emergency Management, Emergency Preparedness, Business Risk, Emergency Management Program, Hazard Identification

Checklist for Web-Based Business Continuity Plans

Posted on Thu, Sep 11, 2014

In business, every threat can result in the same consequence: the loss or temporary cessation of key business processes. In order to minimize impacts when a threat materializes, business continuity plans (BCPs) must be intuitive, yet dynamic, to account for each critical business process. Effective business continuity planning institutes a clear path to sustainability and operational recovery.

The following core business continuity elements should be included in a BCP. Each element must be cyclically assessed for accuracy, potential mitigation opportunities, and lesson-learned insights in order for established processes and communication to be effectively maximized.

1. Plan distribution list and contacts: Business continuity planners must be certain that the current employees listed in the plan, as well as those on the plan distribution list is verified for accuracy.  If maintaining accurate contact information is challenging, consider opting for notification verification system with email or text message capability that enables the contact to verify personal information and automatically update associated response plans.

2. Communication: By aligning mass notification methods with typical daily communication habits (cell phone, emails, texting), planners can ensure key contacts are made aware of any business interruption and BCP activation. Clear and effective communication channels must remain available in order to disseminate information to employees, assess and relay damage, and coordinate recovery strategies. Provide employees training in primary and established secondary communication methods in case of disruption of primary communications.

3. Key Staff Roles and Responsibilities: From business continuity implementation through recovery, job specific checklists and assigned procedures should be incorporated in a BCP. Task teams should be formed, at a minimum, to cover each essential business process. Each site may require unique minimum staffing levels to remain operational.
In the event that primary team members are not available, cross team training should be conducted to provide backups. Planners should make appropriate plan changes as operations and staff evolve.

4. Off-site Recovery Location: Include address, contact information, available on-site equipment, and any external equipment necessary for effective continuity of operations. 

5. Recovery Time Objectives: Incremental processes and procedures should be identified to meet specific critical business process goals.  Recovery goals may include increments of one hour, 24-hours, 48 hours, one week, one month, and long-term recovery.

6. Key Customers’ Data:  Identify effective customer communication methods and necessary contact information required to inform customers of disruptions of deliverables or services. Effective customer relations and communication may be critical in retaining clients and maintaining positive relationships during a business interruption. 

7. Key Supplier Contact List: Identify critical business unit dependencies and interdependencies and key contacts. Transportation delays could affect delivery times. Plan and mitigate accordingly.

8. Alternate Suppliers List: The consequences of a supply chain failure on associated key business components can be crippling.  Alternate suppliers should be included in the BCP to ensure consistent delivery and continued operations in the event primary suppliers are affected by similar business continuity circumstances. As a company’s needs change and new suppliers come online, plans should be updated to include these critical suppliers.

9. Insurance Details: Identify details of insurance coverage and accurate contact information. The burden of proof when making claims typically lies with the policyholder. Accurate and detailed records are imperative.

10. Data Backup Details: Identify the procedural details of computer backups, data restoration methods, and the minimum program needs to re-establish critical business processes.  

11. Technology Requirements: Identify necessary hardware and software, and the associated minimum recovery time requirements for each business unit. Companies should examine current data center outsourcing to ensure continuity and accessibility or research continually advancing alternatives.

12. Equipment Requirements: Detail applicable equipment requirements for each business unit and recovery time goals. To prevent unnecessary downtime and additional recovery efforts, identify and procure necessary equipment and establish processes for continued operations and recovery.

13. Review Log: Incorporate newly identified hazards and vulnerabilities into the business continuity plan. A log can include necessary equipment used (requiring replacement or replenishment), altered processes, and lessons learned.

A web-based platform can speed up the cycle of business continuity events. By transitioning from paper-based business continuity plans to a web-based approach, companies have the ability to maximize data and streamline information. A web-based plan enables a standardized, enterprise-wide business continuity template, yet allows for site-specific details for each particular site.

 

Web based response planning - TRP CORP

Tags: BCM Standards, Business Continuity, Data Backup, Business Continuity Plan, Disaster Recovery

Incorporating Business Continuity into Industrial Settings

Posted on Thu, Aug 21, 2014

As complex, advanced technologies, systems, and networks become ingrained in industrial operations and processes, the potential impacts from even minor disruptions increases. Industrial companies that prepare for a large variety of disruptions can limit its impact on business processes and accelerate the return to normal operations. For those not prepared, a targeted incident can become an escalated situation, negatively affecting profitability, customer relationships, and overall business performance. Business continuity plans (BCP) are crucial to ensure long-term viability, yet many industrial companies do not prioritize them.

Many business continuity issues can start as minor, isolated instances or aggravating inconveniences. However, if not addressed in a timely manner, incidents can escalate, potentially spreading to other key processes. With an effective BCP, mitigation measures, and proper employee training, potential disruptions and operational impacting events can be prevented.

Regardless of the size of your enterprise or scope of facility operations, industrial locations should have the following continuity elements in place.

  • Standard procedures and assigned responsibilities regarding risk management, restoration, and IT recovery for each critical business area.
  • A BIA (Business Impact Analysis)
  • A risk assessment that identifies and prioritizes operational imposing scenarios
  • Recovery Time Objectives (RTOs) based on cost-benefit analyses and BIAs
  • Documented BCP with response, recovery, and restoration procedures
  • BCP exercises aimed at improving RTOs and strategies by ensuring plans are accurate, actionable, and thorough
  • Audits that test corporate-level standardization and policy implementations
  • BCP training for managers and employees

The process of developing a BCP can identify continuity weaknesses within an enterprise and at specific facilities, as well as lapses within individual responsibility and operational processes. To strengthen the prospects of corporate viability, planning and training should include detailed standard operating procedures for BCP activation and address RTOs for each key business process. The BCP should offer procedural flexibility based on real-time situational assessment, as well as procedural variations for each scenario. Precise, site-specific, and accurate BCPs in conjunction with effective training and carefully planned exercises can often counteract a lack of general continuity awareness.

Many industrial facilities managers typically have expertise in proper hazard communications and emergency response techniques. However, industrial facility managers and their employees may lack business continuity experience and necessary expertise. If establishing BCPs or initiating continuity efforts are beyond the scope of managers, companies should consider hiring consultants who specialize in business continuity planning.

Employees who are trained in daily continuity procedures, in addition to response and restorative continuity methods will be better prepared in the event of a business-interrupting incident. By incorporating business continuity training, companies can expand their resilience strategies while minimizing risks to their employees, operations, reputation, and the financial bottom line.

BCP training should include a detailed account of specific roles and responsibilities. This will ensure continuity of knowledge among participants, enterprise-wide standard operating procedures, and site-specific business continuity processes. Companies should also be vigilant in training new hires, as well as be receptive to unique business continuity lesson learned that can be used to strengthen the BCP.

Although all companies should prepared for inevitable business disruptions, industrial facilities typically have heightened levels of vulnerabilities. In an industrial setting, hazards are often identified in order for potential impacts to be fully analyzed and countermeasures to be implemented. For business continuity strategies, a business impact analysis (BIA) can identify, quantify, and qualify the impacts in time of a loss, interruption or disruption of business activities on an organization, and provides the data from which appropriate continuity strategies can be determined.  

Whether business disruptions stem from technological, man-made, or natural disasters, business continuity plans can be a valuable tool for protecting viability, securing resources, and maintaining customer relationships.

Click on the image below to download TRP Corp's free Industrial Preparedness white paper.

Preparedness and Emergency Management - TRP Corp

Tags: BCM Standards, Business Continuity, Resiliency, Training and Exercises, Business Continuity Plan, Business Disruption

Managing The Key Resources of Industrial Business Continuity Plans

Posted on Mon, Jul 21, 2014

Emergency management is continually evolving. The changing threat environment, including acts of nature, accidents, infrastructure weaknesses, cyber security attacks, and terrorist related incidents, coupled with tightly intertwined supply chains, has increased the urgency to revamp emergency management and business continuity efforts.

Building business continuity and emergency response plans to maintain personnel safety, and protect and restore operations is vital. Companies continue to develop and improve upon existing processes to seamlessly aid in managing risk and the rapid restoration of operational processes. However, with ever-changing threats, multiple sites, and human resource variables across an enterprise, most companies find it challenging to develop and maintain accurate and realistic business continuity plans (BCPs).

While the planning process may be executed with in-house staff, some companies prefer to use seasoned consultants for impartial critical process evaluations and experienced guidance. Consultants should have hands-on experience in business continuity and disaster preparedness. Specialized consultants may offer web-based, database driven platforms that incorporate site-specific business continuity information while streamlining company formats across an enterprise. The web-base option eases maintenance efforts and reduces administrative costs associated with managing BCPs. However, consultants must be able to comprehend core business needs and clearly communicate recommendations in order to successfully develop a customized, site specific, and functional BCP.

According to FEMA, the ability to perform essential functions lies within four key resources.

  • Leadership
  • Staff
  • Communications and Technology
  • Facilities

Site-specific information must be applied to the key resources. It is necessary for continued operation to evaluate and identify alternate site-specific resources that may be utilized during an incident.  If one or more of the key resources are lost, critical business processes may be affected. Keep in mind that any new business operations that may have developed also need to be included in these evaluations.

Leadership

Business Continuity Coordinators (BCCs) are typically responsible for the development and maintenance of business continuity plans. They must work closely with critical business units to understand their processes, identify risks, and provide solutions to help manage and minimize those risks. However, once an incident occurs, the BCCs must communicate, manage, and control activities associated with damage assessments and the recovery of critical business functions. Depending on the enterprise, a BCC may be assigned to an individual facility or a specific geographic location that encompasses numerous facilities with like-operations.

The BCC, in conjunction with the Incident Commander, may be tasked with activating and coordinating organization elements in accordance with an incident action plan.  By working with the appropriate business unit leaders assigned to business continuity/recovery plans, the BCC can also provide guidance for compliance with Incident Action Plan (IAP) components.

Staff

The BCP should systematically guide specifically assigned personnel to restore operations that are affected by abnormal conditions. It is critical to identify the implications of a sudden loss for each business unit or necessary resource by performing a business impact analysis. While critical process evaluations can determine operational dependencies that are required to maintain normal operations, staff must be trained to carry out the BCP objectives. BCP training and exercises should occur (at a minimum) on an annual basis, or as required by regulations or company policy.

A BCP should identify the minimum staffing levels necessary to remain operational. As recovery advances, staffing levels may require adjustments. Depending on the scenario, the least critical process participants might have to vacate the facility while leaving critical players in motion to maintain or restore necessary functions. Companies should ensure staff, contractors, and suppliers understand their initial and adjusted responsibilities, and recovery time objectives.

Communications and Technology

Clear and effective communication channels and critical technologies must be available in order to disseminate information to employees, assess and relay incident updates, and implement necessary recovery strategies. As part of the business continuity mitigation process, companies should evaluate available communication equipment, mass notification systems, and technology storage and backup processes to ensure accessibility and functionality in multiple business continuity scenarios. All critical communication and technology should be included in a BCP with detailed recovery procedures and recovery time objectives.

Facilities

Facility management should be a crucial aspect of a business continuity plan. If an area or facility cannot sustain minimum service or operational levels, companies should mobilize resources, and/or relocate equipment and personnel to alternate areas, facilities, or redundant sites. If deemed acceptable, this may include  “working from home” strategies. In order to respond quickly and effectively to facility damage, BCPs should include predetermined suppliers/contractors (tree services, plumbers, electricians, restoration companies, and/or necessary skilled trades and suppliers).

For a free download on Designing a Crisis Management Program, click the image below:

TRP Corp - Emergency Response Planning Crisis Management

Tags: BCM Standards, Business Continuity key points, Business Continuity, Cloud Computing, Business Continuity Plan

Emergency Response Interoperability and Mutual Aid Agreements

Posted on Thu, Nov 29, 2012

Broadening the scope of response expertise can greatly benefit companies in the event of an emergency incident or disaster. Interoperability and associated agreements with local, state and federal agencies may provide additional resources based on particular experiences, research, or occupational training in a particular area, potentially reducing response time during a dire situation.

According to FEMA, “mutual aid agreements and assistance agreements are agreements between agencies, organizations, and jurisdictions that provide a mechanism to quickly obtain emergency assistance in the form of personnel, equipment, materials, and other associated services.” 

Emergency managers should regularly meet with government agencies, community organizations, and specialized response organizations  to discuss likely emergencies and their ability to contribute resources. Mutual aid agreements should facilitate a rapid, short-term deployment of emergency support prior to, during, and after an incident. However, the National Incident Management System (NIMS) Planning Guide states that a response from state or federal resources can take up to 72 hours or longer to arrive.

FEMA states that mutual aid agreements do not obligate agencies, organization or jurisdictions to supply provisions or aid, but rather provide a need-based tool should the incident dictate the requirement. These agreements ensure the efficient deployment of standardized, interoperable equipment and other incident services or resources during incident operations. However, emergency managers should consult their company’s legal representative prior to entering into  any agreement.

The designated emergency manager will typically establish mutual aid agreements.  However, the incident commander, in coordination with a liaison officer, must have full knowledge of the agreements and respective roles the organization(s) will play during a response.

The NIMS Planning Guide identifies several types of mutual aid agreements that can benefit companies. These agreements include, but not limited to:

Automatic Mutual Aid Agreement:  Permit the automatic dispatch and response of requested resources without incident-specific approvals. These agreements are usually basic contracts.

Local Mutual Aid Agreement: Neighboring jurisdictions or organizations that involve a formal request for assistance and generally covers a larger geographic area than automatic mutual aid.

Regional Mutual Aid Agreement: Multiple jurisdictions that are often sponsored by a council of governments or a similar regional body.

Statewide/Intrastate Mutual Aid Agreement: A coordinated agreement throughout a State or between states that incorporate both State and local governmental and nongovernmental assets in an attempt to increase preparedness statewide.

Interstate Agreement: Out-of-State assistance through formal State-to-State agreements such as the Emergency Management Assistance Compact, or other formal State-to-State agreements that support the response effort.

International Agreement: Agreements between the United States and other nations for the exchange of Federal assets in an emergency.

Other Agreements: Any agreement, whether formal or informal, used to request or provide assistance and/or resources among jurisdictions at any level of government (including foreign), NGOs, or the private sector.

Memorandums of understanding (MOUs), or letters of intent, may be used with the private sector and nongovernmental organizations (NGOs) to facilitate potential collaborative efforts in the event of an incident.  MOUs can be legally binding depending on the intention of the contractual parties, the language used in the document, and the residing jurisdiction. However, other MOUs can be construed as a non-binding, “gentlemen's’ agreement”. 

The U.S. Department of State suggests the following regarding MOUs. 

“While the use of a title such as “Memorandum of Understanding” is common for non-binding documents, we caution that simply calling a document a “Memorandum of Understanding” does not automatically denote for the United States that the document is non-binding under international law. The United States has entered into MOU’s that are considered binding international agreements.”. 

Download this free 9-Step sample Emergency Response Procedures Check List.

TRP Corp -Response Procedure flowchart

Tags: BCM Standards, Emergency Response, Department of Homeland Security, Supply Chain, Disaster Recovery, Business Disruption

Business Continuity Planning Hazards, Assessments and Analyses

Posted on Thu, Oct 11, 2012

Man made and naturally occurring risks and hazards can have an enormous impact on companies and their ability to operate. As a result, site-specific hazards with the potential to cause injury, damage facilities, or adversely affect the environment should be identified through a risk assessment and incorporated in subsequent emergency planning procedures and business continuity plans

Company assets are continually in jeopardy from potential threatening scenarios. Once risks are identified, mitigation measures can be implemented and emergency scenarios can be addressed. The chart below offers examples of hazards, assets at risk, and potential impacts created by those threats to existing hazards.

Assessment chart (Image provided by Ready.gov: http://www.ready.gov/risk-assessment)

Details of the Risk Analysis

All management levels should take an interest in their company’s risk management program. In order to plan for emergencies and mitigate as necessary, potential risks and hazards must be identified and evaluated. Risk recognition can occur through many paths, including inspections, audits, and job hazard analyses. However, a detailed risk analysis should include, but is not limited to the following:

  • Identify site-specific assets: Assets are unique to each specific industry, company, and site. (See “Assets at Risk” list on the chart above)
  • List hazards that corresponds with each asset:: (See “Potential Hazard” list on the chart above) Multiple hazards may be applicable to a singular asset.
  • Impact and probability factors:  For each hazard consider both high probability/low impact scenarios and low probability/high impact scenarios.
  • Mitigation opportunities: As you assess potential impacts, identify any asset vulnerabilities or weaknesses that would make it susceptible to loss. These vulnerabilities are opportunities for hazard prevention through procedures/processes upgrades or risk mitigation.
  • Probability of occurrence: Identify if the threat scenario is low, medium or high.
  • Impact of scenario estimates: Identify if the impact is low, medium or high for each of the following:
    • people
    • property
    • operations
    • environment
    • financial
    • regulatory or legal
    • contractual
    • brand image or reputation
  • Overall Hazard Rating: Ready.gov suggests using a two-letter combination of the rating for “probability of occurrence” and the highest rating in for “Impact of scenario estimates”. The probability and impact severity of a risk should determine the priority level for planning and mitigation the hazard.

Evaluate each hazard rating for probability and severity resulting from an accident or emergency. The probability and impact severity should determine the priority level for correcting the hazard. The higher the probability and impact severity, the higher the emphasis should be on corrective action. With priorities in place, mitigation measures may include:

  • Changes in daily processes and procedures
  • Isolation and elimination of the root cause of a potential threat
  • Addressing regulatory compliance issues resulting from audits
  • Implementation of risk reducing engineering controls, when applicable
  • Implementation of proactive administrative controls or work place practices
  • Establishment of process to identify inoperable or malfunctioning equipment and machinery through systematic inspections

Companies should also consider the benefits of a business continuity plan (BCP) to counteract the impact of risks and hazards. A BCP may limit operational “down time” due to unforeseen circumstances by prioritizing the needs of core business processes and establishing recovery time objectives. In addition to constraining fiscal viability, operational impacts can be detrimental to relationships with customers, the surrounding community, and stakeholders.

NOTE: Ready.gov offers a basic risk assessment guidance table to aid in performing risk assessments.

Fire emergencies continue to be one of the greatest risks to facilities. For an understanding of the necessary elements in creating an effective fire preplan, download our Fire Pre-Planning Guide.

TRP Corp Fire Pre-Plans Pre Fire Plan

Tags: BCM Standards, Resiliency, Event Preparedness, BCM Metrics

Business Continuity Template Basics

Posted on Mon, May 14, 2012

In business, every threat may result in the same consequence: the loss or temporary cessation of key business processes. Business continuity management is a planning process that assists in managing the risks that may threaten a company’s survival.  A business continuity plan should be applied to every business, small or large, to provide a framework to ensure operational resilience in the event of any disruption.

While creating a business continuity plan, key details and alternate provisional elements should be considered. The following provides a basic outline for a Business Continuity Plan.

1. Plan distribution list: Names, addresses and contact information of those that retain paper copies or electronic access to one or more plans.

2. Key contacts: Identify all primary and secondary key contacts that must be made aware of a business interruption. It is important to routinely verify contact information for accuracy.

3. Key staff roles and responsibilities: Develop job specific checklists and procedures detailing responsibilities from business continuity implementation through recovery. Task teams should be formed, at a minimum, to cover each essential business process. It may be necessary to provide cross team training, in the event that primary team members are not available.

4. Off-site recovery location: Include address, contact info, available on-site equipment, and any necessary external equipment for effective operations.

5. Recovery action plan: Identify/develop incremental processes and procedures necessary to recover each critical business process.   Response checklist timelines may include increments such as, 1st hour, 24-hours, 48 hours, one week, one month, and long-term recovery.

6. Key customers’ data:  Identify communication methods and necessary contact information in order to inform customers of disruptions of deliverables. Effective customer relations and communication may be critical in retaining clients and maintaining positive relationships during a business interruption.

7. Key supplier contact list: Identify dependencies and interdependencies along with key contact information. Transportation delays could affect delivery times; therefore the plan should address this issue.

8. Alternate suppliers list: The consequences of a supply chain failure on associated key business components can be crippling.  Through the planning process, alternatives can be explored to reduce the impact of supply chain disruptions.

9. Insurance details: Identify details of insurance coverage and accurate contact information. The burden of proof when making claims typically lies with the policyholder. Accurate and detailed records are imperative.

10. Back up data details: Identify details of computer backed ups and recovery methods.

11. Technology requirements: Identify necessary hardware and software, and the minimum recovery time requirements for each business unit.

12. Equipment requirements: Identify equipment requirements for each business unit and recovery time goals.

13. Review and revise:  Incorporate newly identified hazards and vulnerabilities into the business continuity plan. Include necessary equipment used (requiring replacement or replenishment), altered processes, and lessons learned.

TRP Training

Tags: BCM Standards, Business Continuity key points, Business Continuity, Resiliency, Event Preparedness