Five steps for creating a business continuity plan

A business continuity plan provides a framework for returning to normalcy following an incident. Having a well-thought-out business continuity plan provides a foundation of your operational continuity and can pay off exponentially by saving recovery costs, business revenues, your organisation’s reputation and even people’s lives.  It generally covers the following key areas:

• Disaster preparedness: A listing of the types of incidents that might hurt your organisation, how large a threat they pose and how you can minimise their impact.
  
  
• Emergency response: The procedures you’ll follow when a disaster is headed your way or an incident has occurred.
  
  
• Business recovery: A listing of your organisation’s critical business functions and the steps you’ll take to restore sales, production or other operations to pre-incident levels.

1. Build a team.
   
   Get support from top management and assign an individual to lead the process. Then assemble a core team from across the organisation, with representatives from each critical department, ensuring that roles, responsibilities and competencies required for a Business Continuity Management Systems (BCMS) are addressed. 
   
   
2. Access the risk.
   
   Provide a structured process for analysing the likelihood and consequences of disruptive events, with events ranked by the risk of disruption to the organisation’s critical activities. Specific threats may include natural hazards, key facilities, technology resources, staffing, past events, supply chain issues, specialised equipment, security and/or utilities.
   
   
3. Develop a business impact analysis.
   
   This process will rank your organisation’s key functions from most to least critical, allowing the priorities and timeframes for resuming activities to be determined.  Function heads should identify potential mitigation strategies, upstream and downstream dependencies and key resources (including IT functionality and data availability) required to resume operations.
   
   
4. Put it in wiriting.
   
   Document your plan and procedures on a step by step basis. Make sure to share it with staff and assign clear responsibilities for carrying out the plan.
   
   
5. Train, exercise and learn.
   
   Think of business continuity planning as a cycle – one that requires continual reviews, updates and adjustments based on changes to your business operations. Offer training sessions so your employees are prepared to support the recovery efforts. Conduct regular exercises to assess and improve response.
   
   While the ideal time to put a business continuity plan in motion is before disaster strikes, even businesses that do not yet have a plan in place can invest time during the course of an incident to protect their employees, assess the potential impact and prepare for a smooth recovery.
   
   Additional resource: Protecting Your Business During Civil Unrest