by Spectrum Business
Business continuity planning is a process that identifies potential threats to an organization or company and the impact on operations that those threats may have. Most people associate business continuity with major incidents and disasters that could prove detrimental to operations, but business continuity planning needs to be more than just preparation for major acts of God or third-party impacts.Â
Any incident or occurrence, however minor, could have a negative impact on a business's operations. The process of planning for continuity allows a business to highlight areas of vulnerability in everyday activities or things that may be taken for granted, rather than just planning for major disasters.
Consider the risks that every business is exposed to on a daily basis and it should be apparent that operational continuity could be affected by a number of factors, such as loss of access to a critical site or building, the loss of records, IT infrastructure or information, disruption to the supply chain, health-related pandemics or general loss of critical staff.
The planning process should focus on three main areas: responding to emergencies, managing incidents and recovering business operations. The overall business continuity plan should therefore comprise three plans in one to ensure each area is covered.
When an incident occurs, a degree of emergency response will usually be required. For small incidents, this may only be basic activities to limit the impact or scale of the incident. But for large incidents, it could involve implementing a pre-planned, large-scale response and team to deal with the immediate effect.Â
While a plan cannot identify and exhaustively prepare for every eventuality, the emergency response plan should identify the principal roles within the emergency response team with clear lines and methods of communication documented to avoid any confusion in the heat of the moment. It should also lay out key processes associated with incident management. For example, a pre-determined process for recording actions and decisions along with protocols for escalations and possibly preserving the scene of an incident for later investigation.
The emergency response plan should outline guidance for how to approach the initial 12 to 24 hours after an incident has occurred. This should include initial communications with all agencies or services involved to understand the situation and communications with staff and employees to ensure their safety and their understanding of the situation being managed. Whether this is a major or minor incident, the communications in the emergency early stages will prove to be vital in recovering the situation.
Following the initial period of response to an emergency situation — whether one hour or 24 hours — time needs to be designated to manage the incident and its effects. The second element of the business continuity plan should address this time period and the actions needed. Many of the preparations will be similar in terms of communication lines and recording of information, but with more focus on understanding the impact of the incident and making sure that the business, suppliers and customers are made aware of what level of service interruption can be expected, if any.Â
Clear responsibilities within the company management structure need to be addressed and documented for this stage to minimize the time needed to get the right people involved at the right time. The incident management plan should provide focus for ensuring no further damage to business operations occurs and the impact on operations is properly investigated and articulated. This will provide the foundation for actions that will follow later to recover and restore full operational capability.
The last — and arguably largest — part of the three-stage process is the business recovery plan. This should provide the basic foundations to allow the company to restore services or operations based upon the information and impact assessed at the incident management phase.Â
Again, like the other plans, this will give clear and concise information on who the main points of contact are within the company as well as within the main supplier and customer bases. This plan should detail agreed procedures for restoration of key business aspects, for example, restoration of business critical data, installation of IT back-ups, restoration of telecommunications or vital records.Â
Procedures that have been agreed upon by key suppliers or customers should be laid out in the business recovery plan to allow them to be acted upon without delay. Where mitigation actions have previously been carried out to provide a level of protection for data or systems, the plan should explain what has been done and how to restore the information or service in the pre-planned manner.
Business continuity plans also need to be regularly tested. Since every business changes through time, the plan will have to change to reflect new procedures or changes in operational emphasis. Testing the plan using specific scenarios will not only test the procedures and communication lines established, it will also test the knowledge and preparedness of the individuals associated with the plan.
While a business can never plan for every eventuality, it is possible to be prepared to handle most incidents that could occur. Basic levels of preparedness around predetermined procedures and communications can have a significantly positive effect on how a business reacts to, and recovers from, an incident, whether large or small. While the planning process is important, it is worthless without proper communication of its existence and content across the organization. From the company boardroom to the shop floor, every employee needs to have been briefed on the business continuity plan and needs to understand their role in the plan.
