A well-thought-out business continuity strategy can help companies not only survive but thrive after a crisis. Operational business continuity is no longer something to be glossed over, but rather a topic that merits serious discussion. Approximately 40% of businesses do not reopen following a disaster, according to the Federal Emergency Management Agency (FEMA).
Here are five steps you can take to protect your company from the next crisis.
Putting Together an Operational Business Continuity Plan
Don’t wait for another crisis to happen before developing an operational business continuity plan. Having a plan in place allows for an efficient return to work process when the crisis subsides. It also gives direction on how to deal with any damage in the wake of the disaster.
While organizations can implement these plans alone, it often helps to bring in a strategy consultant with an outside perspective and a deep pool of experience of how successful business continuity plans come to fruition.
Businesses equipped with such plans are more resilient than entities without contingency plans and stand a better chance of recovering in my experience. Further, they tend to re-emerge faster than their competitors as well.
So, what’s involved in putting together an operational business continuity plan? A comprehensive contingency planning program is defined by three elements:
- Emergency response
- Crisis management
- Business recovery and resumption
The structure of this plan should involve the following five core steps:
- Establish the scope of the proposed plan
In this step, the main focus is establishing a specific focus and identifying the crisis management team, technology recovery team, and business recovery teams that will work on implementing the business continuity plan. This team will be responsible for exploring different avenues to see how the company can best protect employees, suppliers, and customers, as well as business operations during a disaster.
- Define the major business sectors
How many departments or sectors is the organization made up of? IT, sales, accounts, human resources, back office, and front office—each of these sectors needs to be defined and outlined so that a response protocol for each can be developed.
- Carry out a business impact analysis (BIA)
A business impact analysis (BIA) is carried out to foresee any potential impacts to critical business operations. Business impact analysis can be facilitated by asking the following three questions:
- What are the prioritized activities that are critical to the organization’s core operations?
- What are the resources which need to be obtained in order to resume these prioritized activities? This is inclusive of both internal and external resources such as inventories, vehicles, and personnel.
- What is the maximum period of time that disruption to the business operations can be tolerated? This particular question identifies the time frame for the prioritized activities to be resumed.
Once these questions have been answered, it is time to assess the external risks that may affect the business. After this has been done, it is easier to work through the different types of disasters that the business may face.
- Develop strategies based on the collected information
With the data you have gathered during this due diligence process, it becomes possible to come up with strategies to assist the enterprise in tackling any emergency and resume operations efficiently afterward.
This is perhaps one of the most important stages as it requires extensive research and study of other organizations’ continuity strategies. Having a point of reference from other businesses, especially those that have weathered previous setbacks, will prove invaluable.
- Create a viable continuity plan to maintain operations
When the business continuity plan has been laid out and clearly written, it is imperative that it is tested. This involves carrying out exercises and simulated disaster events to see areas of the business that need further improvement and planning.
In an uncertain world, a business continuity plan will go a long way in helping to protect your business and its interests.
Testing Out the Business Continuity Plan
A comprehensive business continuity plan that has been tried and tested will prepare you for the unexpected. It helps you practice working remotely, work in a different setting, and work perhaps without critical personnel.
Testing helps you check systems such as your data backup recovery. In addition, testing your plan will reveal gaps or weak spots and provide you with invaluable insight on how to best refine and strengthen the plan moving forward. Lastly, demonstrating rigorous testing can help your business obtain proper insurance.
So, how do you go about testing out your business continuity plan?
- Review the BCP with employees
Making your employees aware of the business continuity plan is crucial. The majority of BCPs fail due to employees not knowing the protocols they are expected to follow in the event of a disaster. Outline the objectives of the simulation exercise and get them to understand that this is more than a drill exercise. Their roles and responsibilities must be clearly explained to avoid excuses during evaluation. Including partners and vendors in the simulation is also a good idea.
- Decide on a time to test the plan
With the staff briefed on their business continuity roles and responsibilities, it is time to select a time to carry out the testing exercise. Depending on what the team in charge of implementing this exercise has decided, this simulation may take anywhere from one day to a few weeks. The key isn’t the length of time but to gauge the level of preparedness of the organization and the employees’ responses.
Good days to schedule simulation exercises are Friday and Saturday. If you’re planning on simply conducting table-top sessions with your senior management and personnel, you may wish to carry these out during the weekends. The reviews can then be held during the week without disrupting normal business operations.
- Simulate a disaster situation
Disasters can come in any form—flooding, tornadoes, hurricanes, cyberattacks, stock market crashes, or global pandemics like the current COVID-19 outbreak. Select any of these and create a simulation that you present to the employees. They are expected to take this drill exercise as if it is actually happening. Their responses should be in line with what has been laid out in the business continuity plan.
Track the time taken to get the situation under control. If your organization is dependent on other companies for critical functions such as IT systems, you may wish to include them in this simulation exercise so you can also gauge their preparedness. How often should a full simulation be done? At least once a year. You can employ different scenarios so you get to test out a variety of potential problems.
- Evaluate the testing exercise
When the testing period is over, get everyone together for an evaluation session. Let the employees speak. Listen to the feedback given, it will help you fine-tune the business continuity plan. Areas that still need to be polished will come to the forefront, and the strategies that worked well will also be highlighted. Sometimes, it might be necessary to swap the responsibilities of different people within the team for a better outcome.
Business Continuity Plan Best Practices
The journey to developing a good business continuity plan is complemented by the following best practices:
- Have an experienced sponsor
Any company that is planning on crafting a business continuity plan would do well to work with an experienced team that can build, review, and help with the testing of the BCP. Someone needs to ideally be in charge or oversee this entire process.
- Choose a strategic policy
A strategic policy will guide decisions and will act as a roadmap on the way forward. Employees must be given a copy of the policy, along with the full business continuity plan, to familiarize themselves with. Ideally, everything should be put into a manual that employees receive as part of their ongoing training.
- Work with a methodology
What systems and methods will you use to carry out your business continuity plan from its inception to testing? The methodology should be clear and easy to follow. A good methodology will be appreciated by the auditors who will assess your business continuity plan. For example, understanding the operational process that is required to originate, transact, and manage a sale is imperative to document so that in the event of business disruption, the company can immediately identify and resolve the gaps that are created. The methodology should be as close to set in stone as possible to allow all employees to conduct business in the same way while management is always working to refine the process to make it more efficient and streamlined.
- Employ regular assessments
The only way to evaluate your business continuity plan is through carefully thought-out assessments. These assessments are a way of gauging your preparedness as a business. It’s good to conduct regular risk assessments, perhaps even once every quarter. These do not have to involve all the employees. You can simply gather team leaders from different divisions or departments.
- Deploy frequent testing
Exercising or testing the plan so you know how well it will work when the time comes is one of the best practices that you can deploy. Carry out a series of drills at least once every quarter using different scenarios to keep your employees up to date on what’s expected of them during disasters.
- Schedule reporting and feedback sessions
There must be a reporting protocol in place as well. How does the team that’s coordinating and running with this project report to management? After the development and testing of the plan, a report should be sent to management to summarize the level of preparedness of the organization given an emergency situation.
In my experience, the better defined and more tested your business continuity plan is, the higher your chances are of recovering efficiently and protecting your employees, customers, and business operations.
Everyone working in the organization should be aware of the business continuity plan and their role in post-disaster recovery. No one is exempt. Participation at every level allows for a faster rebound and smooth transition into a new phase of business operations.