A business continuity plan (BCP) helps your company survive and continue running after a major disruption or disaster, like a fire, flood or cyber attack. It highlights the step-by-step process of what should be done to prevent risks that can lead to your business having to close down. It aims to protect critical business functions so you can continue operating and implement a recovery strategy.
But creating a business continuity plan is by no means a simple task. From determining your business processes to essential resources and contingency planning, there’s a lot to think about. This guide aims to help by explaining the key things to consider.
Determining risks, processes and impact
When creating a business continuity plan, a good place to start is by assessing the key functions of your business, the potential threats and risks, and the impact this could have on your company.
Key business processes
These are the areas of your company that it needs to function. This can differ depending on your company.
For instance, it’s likely to be your production services if you manufacture products, your IT infrastructure if you’re a website designer, or your stock if you’re a retailer. Other business process could include:
Understanding company threats
This is concerned with assessing the main risks that could disrupt your company. Consider ranking these in order of which threats could pose the highest risk to the lowest risk of disrupting your business.
For instance, an attack on the internet would be of higher risk to an online marketing company than a high-street shop. Threats could include:
- Biological hazard
- Epidemic illness
- Natural disasters, fires or floods
- Gas leak or power cut
- Malicious internet attack
This involves looking at the impact these threats could have on your key business processes. It’s also known as a business impact analysis (BIA).
A BIA predicts the potential consequences of your business processes being disrupted. It should also determine your potential business loss from these processes being down for a day, a week, a month or longer. Impacts could include:
- Loss of sales and income
- Increased expenses
- Decrease in customer satisfaction and loyalty
- Delayed service delivery and poor product quality
- Regulatory fines
Determining your key resources
Once you’ve determined areas of business functions, threats and impact, you should list the key resources your company relies on. This includes key staff, external contacts, equipment, and documents.
Consider ranking the resources in order of importance to your business, according to the maximum manageable downtime – this is how long your company can survive without that resource in place.
These are the employees that your business can’t function without. Consider staff who:
- Lead your sales services
- Manage your company accountancy
- Know the regulations associated with your services
- Lead your production processes
- Manage your clients and their accounts
It’s worth noting that some of these people can form part your business continuity team, explained later.
Key external contacts
It’s also important to list the key people (and their companies) outside your business, who are key to its operation. This can include:
- Contractors and service providers
- Suppliers and distributors
- Bankers, accountants and attorneys
- IT consultants, electricians or engineers
- Utility companies
You should list vital contact information about your key staff and external contacts. This includes personal and business phone numbers and email addresses.
Key data, equipment and supplies
This is data, equipment and supplies you need to run your operation. It could include:
- Data and databases to conduct client work projects
- Equipment such as manufacturing machinery
- Technology, including specific computers or software
- Passwords and identification data to access key files and sites
- Supplies, like materials to make products
When listing data and databases, it’s wise to also note details of back-up files and their locations.
Key business documents
This is all documentation you would need to continue running your business, or restart your company, if those documents were destroyed in a disaster. This could include:
- Banking information
- HR documents
- Legal papers, like articles of cooperation
- Tax returns
- Utility bills
It’s wise to make copies of these documents and store them off site. You should also make a list of any ongoing payment dates, such as for business loans or your email services.
Contingency planning and business recovery
Once you’ve listed your essential resources, it’s important to determine your contingency plan to help your business continue running and recover in the event of a disaster. Key to this is equipment you’ll need and a location to work from.
When thinking about equipment, it’s important to identify alternative equipment you could use, and the services you could use to access it, if your current company equipment was destroyed. This could include services for:
- Renting delivery vehicles
- Copying or printing
- Renting computers or laptops
You should also think about who in your staff will be responsible for managing the relationships with these service providers and making any key decisions.
This is where you will operate your business when your offices are unavailable. There are different places to consider, depending on your business.
This could be a hotel, a conference centre, a vacant shop, or a storage rental facility. You could also consider the offices of your contractor or attorney. Even a room in your house could work, if the space is available. When considering locations, you should also think about buildings that are:
- Equipped with business facilities
- Spacious to store your products
- Have good internet access
In your business continuity plan it’s a good idea to include a map to the new location, with all the contact information you need to access it.
You should also list those people who could work from a home office. This can be useful if, for instance, your contingency location cannot accommodate all your staff.
Putting your plan together
With all the information across your key functions, resources and contingencies, you should be able to create step-by-step instructions of how to execute your business continuity plan.
This should address what to do and when, and the people who should do it. These people will make up your business continuity team. You should also list the names of each person and their responsibilities in the plan.
You should file all your information together as one document. It’s also wise to make copies of your plan and give one to each member of your continuity team. Consider keeping a copy in a location off-site or in a safety deposit box too.
Are you prepared?
FSB members get access to a free Business Continuity Planning kit from FSB Insurance Service.
Learn why preparing your small business for the unexpected with a Business Continuity Plan is so important, and how you can access your free BCP kit.
An effective business continuity plan is essential to keep your business on track in uncertain time but how long does it take to put an effective one together?
A good business plan can help you expect the unexpected but who should be involved in its development? Our guide aims to help.