A Business Continuity Plan (‘BCP’) is a comprehensive plan which provides documented guidance on how to deal with contingencies for business processes, assets, human resources, and business partners in case of an emergency. It defines steps that can be taken to re-establish productivity, secure key assets, and continue operations despite the disruptions.
In the current environment, with the emergence of COVID 19, we have observed how several Small & Medium Enterprises (SME) businesses have been severely impacted as they do not have a BCP for their Business.
BCP’s are a necessary tool in ensuring your business preparedness. They build confidence, cultivate resilience, and provide valuable business data to safeguard the business during challenging times. Large scale organizations and global corporations have a BCP in place, to deal with emergencies. Typically, in highly regulated & critical institutions such as Banks, there is a periodic review of every BCP and a live test is performed, at least annually.
If your business does not have a BCP in place, it is time to establish one.
Establishing an effective business continuity plan
A good BCP is one that’s effective in addressing the situation it’s designed for.
A BCP for a cyberattack, for example, should be able to secure your digital infrastructure and protect sensitive data without having to pay the requested ransom.
A BCP for a health pandemic (such as COVID 19) should ensure your employees’ safety while also keeping productivity stable and ensure continuity of business operations and ensuring there is no disruption to client activity
Why are BCPs important? Threats to businesses are, on the whole, increasing. Some of the common possibilities are around lack of strong IT security infrastructure, leading to cybersecurity threats.
- Risk management is especially important for any business. A single catastrophe can destroy infrastructure or debilitate your team, leaving you unable to recover.
- Disasters can be hard to predict. Many things can go wrong, and impromptu catastrophe management is difficult because you may miss important details. So when developing a BCP, it’s good to follow a guide to ensure you’ve covered all your bases.
One simple guide that you can follow is the 5W1H format answering the questions: Why, Who, What, When, Where, and How.
- Explain Why the plan exists and what the objectives are, in the event of an issue or crisis. Failing to convey the objective of a BCP clearly to all employees will lead to lack of clarity and support from employees.
- Determine roles and responsibilities (Who) for the BCP: Explain and document who will be affected and who is responsible for each action, during an actual crisis. When planning a BCP, there should be a point person nominated for that function, who would be responsible for each action during an actual crisis. Every BCP plan should also have a plan for the continuity of leadership in the absence of key decision-makers and managers. The team should know their responsibilities and understand which decisions need to be made.
- Explain What steps are needed: This aspect of the BCP should address what needs to be done to mitigate risks. Essentially, these are the steps that need to be followed when disaster or crisis hits.
- A BCP has to be tailored to each Business operating activities and model. For example, a business which is in the area of providing Financial Advisory services can plan their BCP in such a way that in the event of a crises, any core operations can continue from home by the staff, while any critical client-facing staff can operate from backup site, if there is a need to visit clients or they can work from the clients location.
- The BCP should clearly identify roles are responsibilities in the event of any event, and a BCP lead should be appointed whose role is to ensure execution of the plan and looking into any matters that are escalated.
- Establish Timelines (When) of your Business Continuity Plan: Every BCP should include a timeframe. It’s like fighting a fire. You need to deal with the emergency as quickly and efficiently as possible to reduce your losses and minimize damage, before normal business activities can continue.
- Eg. In case of any hindrance to physical premises (eg. Electricity outage), a back up plan could be to immediately inform staff to work remotely, until any issues have been resolved.
- Address How to implement the plan: Addressing the how of your BCP involves defining the tools you will use to carry out each step of the process and also describe how and when the communication will take place, at every stage, in the event of an actual crisis.
- We witnessed during the COVID 19 global pandemic, businesses in the SME sector could use the directives of the government and accordingly execute the BCP strategy, based on the advisory from the Government.
- Explain Where to continue normal business operations: The BCP needs to include locations of physical premises involved and from where operation business operations need to continue. For example, in the scenario of a temporary network disruption, instructions to staff could that critical members of staff will need to operate from an alternate physical site, while the rest of the staff could continue to operate from home.
- Prepare for an actual crisis: Large established and global organizations always ensure that their staff is made aware of their divisions BCPs. SMEs and Start-Ups should also periodically communicate and test their BCP, at least annually and also perform test scenarios, where possible.
*The opinions expressed in this article are those of the author. They do not purport to reflect the opinions or views of Intuit QuickBooks.*