Business Continuity Planning
What is Business Continuity Planning?
Business Continuity Planning is a management process that provides a framework for building resilience of an organisation with respect to any eventuality. It provides a basis for planning to ensure continuity of key services, in the event of a disruption.
A business continuity plan involves thinking ahead and planning for any crisis that may occur to ensure that the business can recover quickly and survive. It is a set of arrangements that enables people to manage at a time of crisis.
There are many unplanned events which can occur which pose a risk to any organisation and which can cause major disruptions to services rendered by the organisation. These unplanned events could be external (extreme weather conditions/ natural disasters) or internal (systems failure).
Why Business Continuity?
Consider the following in relation to a business or organisation;
• Mass absence ( e.g. Pandemic Flu)
• Disruption of transport network
• Natural disasters ( Floods)
• Loss of utilities ( e.g. water, fuel, electricity)
• Loss of premises ( due to fire)
• Loss of IT and telecommunications.
• Terrorist attacks
Whilst these are the major events that make the headlines, there are other internal events that could also have dire effects/impact on an organisation or business’s ability to function e.g. theft, fraud, sabotage, loss of key suppliers, etc. It is imperative that both big organisations and small businesses alike should have a plan in place to help keep the key functions running in event of any catastrophe to facilitate the recovery of the critical processes.
What are the benefits?
Business Continuity planning sets in place emergency plans to help an organisation function and maintain delivery of services in case of events listed above. Experience shows that businesses are far more likely to survive a disaster if they have thought about it in advance and planned accordingly.
Insurers, banks, investors, customers and suppliers, look favourably on companies with business continuity plans. Reduced premiums and better access to finance would give a business commercial advantage even before an event occurs.
Business continuity planning builds employee confidence on the fact that the business is doing well. It also drives operational efficiencies and adds competitive advantage. Rapid response to an emergency or crisis enhances the reputation of the business and builds customer confidence.
Setting up a Business Continuity Plan
In setting up a BCP (Business Continuity Plan), the planning team has to first of all identify the risks which would impact on the key activities or functions of the business. These include activities in the organisation, which if stopped would cause the greatest impact on the business. The impacts could be on cash flow (payments of staff wages and payments to suppliers), or meeting legal/statutory requirements.
By identifying the risks, you should also identify how these activities are delivered by your organisation, the processes in place, and what resources are needed to support said activities? The process will also allow you to identify suitable strategies as to how you intend to manage recovery following a disruption in your organisation. The resources could include:
- Premises (including furniture): What is the best solution should your business not be able to occupy its current location or part of it is unavailable? Are they alternative locations that can be used?
- People: Who in the organisation would be required in a crisis situation and what are their roles and responsibilities?
- Providers (including suppliers and distributors): Who depends on the organisation i.e. clients? What is the best way to notify them?
- Telecommunication (IT, phones): What equipment and systems (including Databases and other information systems) does the organisation need in order to function adequately? How do they affect the operational processes? Are they any natural fluctuations e.g. month-end payroll, end of year accounts, monthly bill payments and council tax etc.
- Plant and Machinery: Identify all organisational processes and equipment required for the business to be operational.
- Profile: What are the best methods for maintaining the business brand, reputation and image? Are there any service level agreements i.e. legal or regulatory obligations on the organisation?
Having identified the resources needed to deliver key activities, it is necessary to consider the likelihood that these resources could be lost and the risks the resources are prone to. By identifying these, you also have to identify the effects, the impact and its duration. In addition to identifying key activities, resources and associated risks, it is important to determine how you would manage these risks. The following strategies could be followed
1. Accept the risk and change nothing
2. Attempt to reduce the risks
3. Attempt to reduce the risks and make plans to restore key activities as soon as possible
4. Cease the activity
These approaches will need a detailed plan outlining the arrangements for the incident, and you should also consider a time line to quickly recover the strategic areas of your business or organisation.
In creating the BCP, details of your strategy should be formatted as a guide material for a management team to follow during a recovery process. The BCP should include the following key information:
- Coordinating team: Key personnel that will be involved in co-coordinating the recovery and their availability.
- Relocating Point: Alternative locations, in situations where your main base is inaccessible (partially or totally).
- What to do if your IT, and other communication (telephony) infrastructure is lost? How to proceed and hardware available to be used as an alternative?
- Communication: Communicating with staff, clients, suppliers, distributors and media.
- Staff: How to deal with staffing issues.
- Finance: How to function with limited finance and how to deal with other financial issues such as wages, debt, payments and creditors?
- Reputation: Response to loss of reputation.
- Contacts: Provide contact sheet detailing names, addresses, email, and telephone numbers etc of key staff, clients and suppliers including key members of other agencies needed for the coordinating activities.
Every director or manager of the organisation should receive a copy of the BCP, including members of the coordinating team.
Another important issue is communication and awareness, Staff should be aware of how they would be communicated with and what is expected of them should the situation arise. Discuss risk issues and business continuity at regular management meetings and ensure new Staff know the BCP arrangements of your firm.
Finally, when the BCP is completed, it should be exercised in order to ascertain that it is a practical strategy and that it meets the recovery requirement. The BCP should be reviewed at least annually or when there have been major changes to your organisation or business.
What is Aberdeenshire Council doing about Business Continuity?
Under the Civil Contingencies Act 2004, all local authorities are designated Category 1 responders, along with services such as the Police, Fire Service, Ambulance Service and the NHS. One duty under the Act is that these category 1 responders must develop plans to ensure that they can continue to deliver their critical services during any incident, emergency or disruption.
Critical services are those services that are heavily relied on by the community and are essential to the internal operations of the council. During an emergency, the council may have to recover from disruptions to its internal operations as well as support the community in their recovery efforts.
Aberdeenshire Council has a Risk Management/BCP Team in place who collates council data on key critical activities, produce BCP’s and test the plans to ensure their viability.