How to create a business continuity plan for your company

The major disruption caused by coronavirus has prompted many companies to think about business continuity. What happens when staff can’t get to work or if a key member of the leadership team becomes ill?

How will you cope if a major client or supplier announces they’re shutting down for the next few weeks? Having a strategy ready to handle these challenges is essential.

More generally, though, in these times of economic and political uncertainty, and sector disruptors, it’s a good idea to have a business continuity plan ready to go, for all kinds of circumstances.

This could cover a fire at your offices, a flood, a power cut, supply chain issues, or a major IT outage.

Very often, though, this essential part of a company’s business strategy is missing as leaders focus on more immediate and productive issues.

According to a survey published by Mercer, a global consultancy firm, more than half of companies (51%) around the world have no plans in place to combat a global emergency.

The good news, though, is that a business continuity plan, also known as an organisational resilience strategy, isn’t as difficult to devise and implement as many people might think.

The knowledge that the business has regularly updated contingencies in place can be good for staff morale as well as reassuring clients and investors.

Business continuity vs disaster recovery

It’s worth adding at this point that there’s sometimes some confusion between business continuity and disaster recovery.

Briefly, disaster recovery plans usually form part of the larger strategy to keep the company moving. They might be focused on simply getting your IT systems up and running again, for instance.

How to create a business continuity plan

So, how do you write and implement a plan for this kind of situation? Start by assessing your risk.

A well written business continuity plan includes contributions from every part of the company, including the people on the shop floor.

Operational staff – those working at the coal face of the business – often have the most important inputs, based on their practical experience.

Allocate roles

You’ll need to allocate roles for both the researching and writing of the report and the implement of the procedures.

Getting input from throughout the company will ensure your staff are not only familiar with your plan but they also buy into it.

Identify risks

As well as issues such as fire, flood, electrical failure, building closures, staff sickness and IT problems such as cyber-attacks, identify the risks that are relevant to your particular sector. Talking to other companies in the same industry and contacting your industry body will help with your research here.

Then think about the impact of a threat and balance it with the likeliness of it actually happening.

A plane crashing into your building during working hours, for instance, would be catastrophic but it’s very unlikely. At the other end of the scale, a much-used printer suddenly grinding to a halt could easily happen but it’s hardly a disaster.

Focus on the risks that are quite likely to happen and that would also have a serious impact.

Calculating the cost to per hour, per day and per week to your business of each department being out of action will help you to prioritise procedures to support them.

Focus on policies and resources

Your business continuity plan will have two elements. The first part consists of the arrangements, measures and policies that you’ll put into practice should your business be hit with a crisis.

The second constituent is the resources. This involves the personnel, the spread of information internally and externally, as well as the facilities, equipment, legal support and funding for effective business continuation.

As well as threats, consider your key business areas and prioritise them. Identify tolerable downtimes too. In other words, how many hours or days, for instance, could the business manage without IT support or a major warehouse that is suddenly no longer operational?

Split your services

It’s a good idea to divide your services into three categories.

Essential or vital services should be up and running again within 48 hours of the crisis hitting. Category two – important services – might have a target of two to five days.

Meanwhile, in the third category, non-essential services could be allowed eight to 10 days before they’re working again.

Look at your organisational structure and identify the interdependencies in the company – if one department is out of action, how will this impact on others?

Clarify roles

Assemble your team, both for writing your plan and for its implementation. Business continuity is everyone’s responsibility but you’ll need specific people to adopt specific roles.

It’s also important to be clear on lines of authority and reporting. Will a member of your emergency team, for instance, have authority over the head of a department when the plan swings into action?

You need to clarify this point before you’re forced to implement your business continuity plan.

Usually a member of the senior management team will lead and coordinate both writing and preparation but also implementation. A programme coordinator can help by managing budgets and people.

It’s also a good idea to have someone responsible for managing information about the crisis and how the plan to mitigate the situation is being implemented.

They’ll probably work closely with your HR people for internal communications and your PR agency or marketing people to talk to customers, suppliers, shareholders, regulators and others.

Depending on the size of your company, it might be useful to assemble a small committee drawn from representatives from the various departments.

Clear goals and actions to take

The finished plan should clearly state the overall goals in any particular crisis situation, be that keeping financial losses to about 80%, fulfilling two thirds of customer orders on time, moving employees to a remote working setup, or getting the business fully operational again in two weeks.

Looking at your balance sheet, your profit and loss, and other financial indicators will help to guide you here.

However, when the IT system first fails or when staff are told to leave the office urgently and go home because of a virus, their immediate concerns will not be the long-term strategy but what they have to do in the next hour or so.

It’s important, therefore, to differentiate between the ultimate goals and strategy on the one hand immediate action to be taken on the other.

A simple, clear list of actions to take for each department should come first in any manuals and communication.

Testing and revising your plan

The temptation once a business continuity plan has been written is to put it into file and tick it off the to-do list. However, it needs to be circulated for comment from all parts of the business and then constantly updated.

As the company and the wider trading environment change, so the plan must change too.

It should also be regularly put into practice. Every six months or so it’s a good idea to run a simulation.

This can just take a matter of hours and it allows staff to become familiar with and the company’s plan as well as providing an opportunity for them to give feedback on it.

Conclusion

It’s often said that crisis and opportunity are two sides of the same coin.

The rapidly growing threat that coronavirus presents to all businesses provides an opportunity to create or update your plan in order to protect your business and your staff – whatever fate might throw at you.