Lewes District Council

Business Continuity

Shoppers walking Businesses may be at risk without planning for unpredictable events and how to deal with the effects when they do.

Business continuity management is a process that can be applied to any business, small or large, to help manage the risks that threaten survival.

The objective is to identify hazards that may affect critical functions or activities and to ensure these can be reduced or responded to in an effective way.

The process is a continuing cycle of risk assessment and risk reduction. More than 50% of companies who do not have a business continuity plan and are hit by a disaster and go out of business within 12 months.

Five steps to continuity planning

1. Analyse and assess the risks to your business

Have a thorough understanding of your business. Know the critical functions, prioritise them and consider the effect if these are disrupted.

If your organisation operates over multiple sites, each site will need a separate plan.

Consider the importance of the function on the survival of your business and how quickly each function must be re-established.

2. Assess the Risks

Look at the vulnerable areas of your business, as well as considering some of the more generic “what if” scenarios.

What if the power failed?
What if a virus wiped out your IT system?

The essential part of Risk Assessment is that you ask three simple questions for each risk that you identify:-

How likely is it to happen?
What impact will it have on your business?
What factors can reduce the likelihood or effect or mitigate the risk entirely.

Consider the worst case scenario when carrying out your risk assessment as less serious incidents will be easier to manage.

It is essential to have the active support of the senior team in your organisation. With this approach business continuity becomes the normal process of day to day activity.

Business Continuity must be included in the preparation of new contracts, partnerships and business processes. It is every manager’s responsibility to ensure this is an integral part of their normal business activity.

3. Develop your business continuity strategy

Most likely the board will consider the options for continuity which will often be one of the following strategies:

Accept the risks and change nothing
Accept the risks, but make a mutual arrangement with another business for help
Attempt to reduce the risks
Attempt to reduce the risks and make arrangements for help after an incident
Reduce all risks to the point where you should not need outside help

All of these approaches will still need a detailed plan to outline the arrangements for the incident. You will also need to consider how quickly recovery will need to occur for the strategic areas of your business or various departments.

It may be useful to draw a chart of the timescales involved in re-establishing certain functions. One essential decision is how you respond to risks that cannot be reduced.

4. Develop your plan

Your business continuity plan should contain the key areas as listed below. This is not an exhaustive list and you may find other key pieces of information that may be required as part of your strategy.

Roles and responsibilities

Make it clear who needs to do what, and who takes responsibility for each action. Always include deputies to cover key roles. Identify a recovery team and a co-ordinator.

Incident checklists for key staff

Use checklists that readers can follow easily.

First stage

Include clear, direct instructions or checklist for the crucial first hour or so after an incident.

Following stages

Include a checklist of things that can wait until after the first hour.

Document review

Agree how often, when and how you will check your plan to make sure it is still current. Update your plan to reflect changes in your organisation’s personnel and in the risks you might face

Information from outside your business

Consider getting specialist information on the roles of other organisations that may be involved in the emergency.

Landlord

If you rent your business space – find out what plans and assistance your landlord or management company may be able to provide

Neighbouring businesses

Nearby businesses may be affected, but you may still be able to help each other

Utility companies

Telephone, electricity, water, gas. Find out what they will need to know and their emergency supply procedures and their main targets for connection.

Your insurance company

Ask what information is needed and if permission is required to replace damaged critical equipment immediately. The existence of a plan may reduce your premiums.

Suppliers and customers

How will you contact them to tell them you have been affected by an incident, and find out what their critical timescales are. They will be affected by your decisions, so involve them if you can and they may be reassured by your planning process.

Local Authority Emergency Planning Officer

Find out what your local authority would do in response to a major incident

Emergency Services

What information will the emergency services require from you? Ask how you can help them by ensuring access routes, and providing information like key holders.

Points to remember

Make your plan usable. Don’t include information that will be accessed in other places. Use existing organisational roles and responsibilities and build on them in the plan. Specify the escalation of the plan. Who decides when to invoke the special arrangements and who manages the process? How will the stand-down process be managed?

5. Rehearse your plan

Testing and rehearsing your plan is one of the fundamental parts of contingency planning. It gives you an opportunity to test the arrangements and principles of the plan in a safe environment, without risk to the business.

There are various levels of rehearsal or evaluation which can be used. They will obviously vary with cost and value, however a planning lifecycle should allow for periodic tests of different types.

Table Top Exercise

Test your plan using a “what if?” written scenario. New pieces of information can be added as the scenario unfolds, in the same way that more details would become clear in a real incident.

Communications Test

With or without warning, a test message is sent out to everyone at the top of the call cascade lists in the plan(s). An audit can then take place on how well the information was communicated through your organisation.

Full rehearsal

A full rehearsal will show you how well different elements in your plan work together, which may not have become clear when you tested the individual parts. However, this can be an expensive way to test your plan.

What to do next

If you have been inspired to consider developing a Continuity Plan for your business, start immediately. Write yourself a realistic action plan based on the five steps outlined.

Be realistic about timescales, and consider getting colleagues involved. Get the support of all your senior managers, directors, shareholders and staff.

If you don’t have a business continuity plan, you may be at risk of losing work to competitors, being exposed to failures in your supply chain, suffer loss of reputation and higher insurance premiums.

Business continuity affects everyone; customers, staff, the community and ultimately the economy. Be prepared.

Emergency Planning

The Sussex Local Authority Emergency Planning Group consists of representatives from East and West Sussex County and district and borough councils.

Its role is to promote Local Authority Emergency Planning in accordance with the Civil Contingencies Act guidance and regulations and it is committed to promoting Business Continuity.

Do It Online

Report It

Apply For It

Find It

Pay It

Have Your Say

Search the site

Contact Us

External Links