How to develop a Business Continuity Plan
Experience shows that developing a Business Continuity Plan can help to significantly reduce the impact of disruptive incidents and the subsequent costs to your organisation. It also increases the likelihood that your organisation will be able to continue trading / delivering services if an incident or emergency were to happen.
To develop an effective Business Continuity Plan, good practice recommends a five stage process that is described below.
Stage one: Understanding your organisation
Business impact and risk assessment tools are used to identify the critical activities and the resources required to carry out these activities. This enables you to evaluate recovery priorities and assess the specific continuity risks which could lead to a business disruption.
You should also make sure that you think about local risks as part of business continuity planning, risk assessment and management is an integral part of the business continuity planning life-cycle.
Stage two: Developing your Plan
Identifying alternative strategies to mitigate the loss of critical activities and improving operational procedures/practices through writing a Business Continuity Plan.
Stage three: Testing your Plan
A plan is not considered valid until it has been tested to see if it actually works or not i.e. is it fit for purpose?
There are many different types of plan test, so it is important to choose the type of approach that works best for your organisation e.g. a desktop scenario with a full walk-through of the plan, a 'live' exercise or "dress rehearsal".
In certain cases you might also want to just test specific elements of the plan, such as the contact list, activation of the plan, communications equipment etc. This component test approach would enable more frequent testing as it is not as time or resource intensive.
The most crucial element of this stage is to identify the lessons learned from the exercise which should help inform improvements to the Plan.
Stage four: Wider staff training
This is a crucial step in embedding Business Continuity into the culture of your organisation. It is particularly important to deliver a programme of training for staff directly involved in the activation of the plan, so that they are fully aware of their roles and responsibilities.
Develop a programme of education and awareness-raising activities for all staff in your organisation; this embeds a culture of business continuity management throughout your business in its day to day activities.
Ensure external stakeholder's e.g. external suppliers or dependencies have business continuity plans in place; if not ask them to develop these plans or identify alternative suppliers etc.
Stage five: Maintaining and reviewing your plan
It is important that plans are tested, reviewed and maintained frequently; organisations can change so it is important that a plan reflects these changes.
Identify a key member of staff to take ownership of the plan and arrange for a comprehensive review of the plan to take place periodically.