What is business continuity (BC) - Business Continuity Institute (BCI) video
Business Continuity Planning
Business continuity (BC) encompasses planning and preparation to ensure that an organisation can continue to operate in case of serious incidents or disasters, and is able to recover to an operational state within a reasonably short period.
Did you know?
20% of companies will suffer fire, flood, power failures, terrorism, hardware or software disaster.
Of those without a business continuity plan:
- 80% will fail in just over a year
- 43% will not even reopen
- 93% that experience a significant data loss are out of business within five year.
Preparing your business:
1. Get Suitable Insurance
Make sure you are covered before an emergency has even occurred
What does your insurance really cover?
2. Risk Assessment
What are the hazards and threats that could potentially disrupt your business?
What is the likelihood that such events could happen and what would the impact be on your business?
3. Create Your Business Continuity Plan With Five Stages
Analyse your business
The first step towards developing a Business Continuity Plan is a really good look at what your business does and what resources you need to do it.
Use our helpful templates and guides to create a Business Impact Analysis and a Critical Requirements Analysis
Design your plan
Once you have understood your business and its vulnerabilities you need to look at some ways to protect yourself. Your plan could include the following:
- Out of hours contact details for staff, customers and suppliers
- Prepare a communications plan - who will you contact in an emergency and what will you say
- Document procedures - prepare 'how to guides' so staff can follow steps to complete each other's activities
- Agreed relocation options - if you can't access your premises, where else can you go
- Remote access to ICT / cloud based technology - can you access your computer network from different locations
- Secure offsite data storage - back up your computer systems and store back up tapes in fireproof cabinets in another location
- Alternative suppliers - where will you get your equipment if a supplier stops trading
- Download this checklist to assist you with your business continuity planning: Be Ready business continuity checklist
Implement your plan
Once you have worked out what you need to do the next step is to do it. You will need to work out what is affordable and practical. Bear in mind that some things will be very straightforward to implement, whereas others may take longer to put in place.
Train your staff
Do all your staff know what the business continuity plan is? Do they know what actions they would take in a business continuity incident?
Validate your plans and train your staff
It is all well and good having plans, but how do you know they work? The best way to do this is to test them. This will also help to make sure that your staff understand their roles within the plans.
- Loss of ICT
- Loss of premises (fire, data loss, power loss)
- Loss of data (ICT outage)
- Severe weather
- Loss of staff (flu pandemic, severe weather, traffic incidents)
- Loss of external dependencies (fuel, electricity, telecommunications, water, partner, supplier)
Did you know?
- 90% of businesses that suffer total loss of a mission critical facility and do not have BCPs go out of business within 2 years.
- A company that experiences a computer outage lasting more than 10 days will never fully recover financially.
- Risk assess your business against your organisational risks
- Create a business continuity plan
- Test your plan!
A business impact analysis, known as a BIA, is a component of business continuity planning that helps to identify critical and non-critical systems and processes.
The KRF Business Impact Assessment Template can be found here.
This template can help your organisation identify its critical functions (and their dependencies) that must be planned for during a period of disruption.
The template is separated into 10 areas.
The below table outlines the areas and what you need to include in each section:
What you need to include
1. Activity summary
A summary of each activity that your department/organisation undertakes. Try not to go into minute detail, e.g. record 'call handling' as an activity, rather than 'answer calls', 'divert calls', 'action calls', 'log calls', etc.
The 'Maximum Tolerable Period of Disruption': this is the duration after which there will be unacceptable consequences from the failure to perform the activity you are analysing. This could include: the inability to maintain the service's mission critical activities, unacceptable reputation consequences, legislative non-compliance, etc.
3. Impact on service if activity fails
A brief description of the impact on the service should this activity fail, e.g. reputational damage, failure to meet statutory requirement, financial loss etc.
The minimum number of staff required to perform this activity, along with the skills required to perform the role.
5. Equipment & vehicles
Equipment required to carry out this role, e.g. cameras. You should also include the details of any vehicles required, e.g. cars, specialist vehicles, etc.
Details of all software and hardware required to perform this activity.
Details of all buildings, rooms, furniture, and welfare facilities that are required for this activity, e.g. Private interview room, generic office space, etc.
8. Internal dependencies
Details of all sections upon which this activity has a dependency, e.g. if the activity relies on finance, etc.
9. External dependencies
Details of all utilities, services, contractors and other suppliers, e.g. gas, internet, call out contracts, etc.
10. Other comments
Any other points of interest relating to this activity, e.g. key times of month/year, impending changes, or foreseeable issues.
This is the part of the process where appropriate solutions are identified to ensure the continuity of the activities identified within the BIA. This maybe at a different pre-defined and agreed level.
This is the part where the solutions agreed in the design phase get implemented within the organisation. This is normally in the form of a business continuity plan. BC plans do not need to be complicated.
Key to the success of business continuity plans is ensuring they are tested and fit for purpose. This can be achieved by testing the plans against an identified scenario.
The final stage of the BC Lifecycle is ensure the process of business continuity is embedded throughout your organisation. Do all staff know what to do, who to contact and how to undertake their part in the plan.