Disasters continue to happen. We often under estimate the power of nature. Today, a small virus has taken entire world including so called ‘Super Powers’ in hostage. Disaster can happen and will happen. When business is disrupted, it will cost money. Lost revenues and added extra expenses would result in reduced profits. True, we have no control over the nature, but we can be better prepared. It may seem hard to prepare a plan anticipating disaster, but in reality it is harder to make decisions under stressful situations. To an extent, insurance plays a vital role in surviving an incident, still it is always important to have a plan because Insurance cannot compensate ALL losses like customer defection to the competition.
Business continuity planning (BCP) or business continuity and resiliency planning (BCRP) is the process of creating systems of prevention and recovery to deal with potential threats to an organisation. Any event that could negatively impact business is included in the plan.
There are multiple benefits of Business continuity plan. It helps to sustain the business despite the disaster, reduces the cost of disruptions and allows what would otherwise be unacceptable risks to be insured. It is potentially life-saving for the business. It helps to prevent and to recover from the threats that may occur in the future. It prepares to take action under stressful conditions. Ultimately, ensures safety for employees.
Developing a business continuity plan
Development of a business continuity plan includes five steps:
- Conduct a Business Impact Analysis (BIA).
- It predicts both the operational and financial impacts of disruption of a business function and process and gathers information needed to develop recovery strategies.
- Some of the Impacts to be considered are lost sales and income, delayed sales or income, increased expenses (e.g., overtime, outsourcing, expediting costs, etc.), regulatory fines, contractual penalties or loss of contractual bonuses, customer dissatisfaction or defection, delay of new business plans etc.
- The point in time when a business function or process is disrupted and duration of disruption can have a significant bearing on the loss occurred. A store damaged in the weeks prior to the holiday shopping season may lose a substantial amount of its yearly sales. A power stoppage lasting a few minutes would be a minor inconvenience for most businesses but one lasting for hours could result in significant business losses.
- BIA questionnaire could be used to survey those with detailed knowledge of how the business manufactures its products or provides its services. Ask them to identify the potential impacts if the business function or process that they are responsible for is disrupted. The BIA should also identify the critical business processes and resources needed for the business continuity at different levels.
- The BIA report should document the potential impacts resulting from disruption of business functions and processes. Scenarios resulting in significant business interruption should be assessed in terms of financial impact, if possible. These costs should be compared with the costs for possible recovery strategies. It should prioritise the order of events for restoration of the business.
- Those functions or processes with the highest potential operational and financial impacts become priorities for restoration. The point in time when a function or process must be recovered, before unacceptable consequences could occur, is referred as the “Recovery Time Objective (RTO).”
- Identify and document Recovery Strategies
- Recovery strategies are alternate means to restore business operations to a minimum required level subsequent to a business disruption and are prioritized by the Recovery Time Objectives.
- An analysis of the resources including people, facilities, equipment, materials and information technology required to execute recovery strategies should be conducted.
- Utilisation of other owned or controlled facilities performing similar work is one option. Operations may be relocated to an alternate site – assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to assume the work of the impacted site. Prioritization of production or service levels, providing additional staff and resources and other action would be needed if capacity at the second site is inadequate.
- Telecommuting is a strategy applied when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters are equipped with or have access to a computer with required applications, data and a secure broadband connection.
- In an emergency, space at another facility can be put to use. Cafeterias, conference rooms and training rooms can be converted to office space or to other uses when required. Equipping converted space with furnishings, equipment, power, connectivity and other resources would be required to meet the needs of employees.
- Partnership agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation and allocating expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. Periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.
- Many vendors support business continuity and information technology recovery strategies. External suppliers can provide a full business environment including office space and live data centers ready to be occupied. Other options include provision of technology equipped office infrastructure, replacement machinery and other equipment. The availability and cost of these options can be affected when a regional disaster results in competition for these resources.
- Organise a business continuity team and compile a business continuity plan to manage a business disruption.
- Based on recovery strategies develop broad framework
- Organise recovery team which comprises of location specific and domain specific experts.
- Develop relocation plans, write business continuity and IT disaster recovery procedures and document manual workarounds, if required.
- Once the entire plan is ready, validate it and seek management approval
- Conduct training for the business continuity team
- Conduct training for business continuity team
- Conduct orientation exercises
- Update Business Continue Plan (BCP) periodically
- Conduct tests and exercises to evaluate recovery strategies and the plan.
- Incorporate lessons learned from testing and exercises
- Between 6 – 12 months, BCP to be updated to make it relevant.