What it’s not
A business continuity plan is not the same as a business plan. Confusingly, your business plan may include business continuity as a part of it, but more often than not, that will focus on more on the financial and management aspects of your business, your plans for growth and funding and so on.
What it is
In simple terms, a business continuity plan is a plan you have in place to ensure you can continue to run your business effectively in the event of some unforeseen occurrence.
Depending on the nature of your business, they can be extremely simple or highly complex. For example if, like me, you work from home, mainly on a computer and communicate with your customers by phone, email or other online methods, then your plan might only need to describe how you store and would retrieve your crucial work files and other data and get your business back up and running if you were suddenly unable to use your usual equipment, in your usual place of work. However, if your business involves stock, which could be stolen or damaged, then you need to include elements that mitigate those risks. Or, if your business involves people who rely on your services to maintain their own day to day lives (e.g. care at home) then your plan needs to incorporate many more elements to ensure you can get back to full capacity within a reasonable timescale without adversely affecting those customers.
Why might you need such a plan?
Well, aside from the fact that it would be pretty handy to have a pre-configured plan to follow in the event of such circumstances, many tenders will ask you about your business continuity plans as part of the tendering process.
This is a relatively recent trend in tenders looking to attract SMEs and other small organisations and many contracting authorities will be content for you to state that you are in the process of developing such a plan, if you haven’t yet done so, so long as you can guarantee that it will be in place prior to contract commencement. That said, many others will deem this a ‘pass/fail’ question and, in those cases, it’s best to get a plan developed before you submit your tender.
Why do tendering authorities ask for business continuity plans?
Quite simply – security. As public spending comes under ever more scrutiny, tendering authorities look for ways to ensure – as far as is reasonably possible – that the money they spend is ‘safe’. In the same way that many tenders will require you to prove your financial stability, so that they can be reasonably sure that your business won’t fold mid-contract, you must also now prove your operational stability. While to some extent that stability can be addressed within your responses to the tender questionnaires, by providing a working business continuity plan you are providing evidence that you have assessed and addressed the possible impacts various disasters or events might have on your business and, subsequently, your ability to continue to deliver the contract.
How do you create a business continuity plan?
The Cabinet Office provides a fairly comprehensive toolkit, which guides you through the various scenarios that might be applicable to your business, the aspects of your business that you will need to consider and the crucial and optional elements of business continuity management that you would or could include in your plan. There are also companies that specialise in developing business continuity/disaster recovery plans; this might be a good option if your services are complex, subject to strict legislation or affect customer or public health.
In brief, while developing your plan, the questions you should be asking are:
- What are your organisation’s key products and services?
- What are the critical activities and resources required to deliver these?
- What are the risks to these critical activities?
- How will you maintain these critical activities in the event of an incident (loss of access to premises, loss of utilities etc.)?
Other things to include
It’s helpful to have a number of checklists within your plan that will help you easily manage and track what’s happening should you need to invoke the plan. This could include:
- Communication Tree – Who will contact whom and in what order? Include staff, customers, service providers, insurers. Will one person contact everyone or will it cascade, so that each manager contacts their individual teams etc.?
- Running Log – Include type of incident, location, building/data access issues, projected impact to operations and on-going actions that relate to each
- Critical Equipment Evaluation – include the equipment affected and its condition (undamaged, damaged but useable, damaged requiring repair, destroyed requiring replacement)
Is buying a standard plan or template a good idea?
Many bid writers will have access to a stash of basic business continuity plans that could be adapted to fit your business. However, this assumes that all businesses in a particular sector or industry operate in the same way and, in reality, that is rarely the case.
Buying a standard plan removes from the equation the ‘discovery’ phase of planning, otherwise known as ‘Business Impact Analysis’. This is an important part of the development of a plan because it tests the risks to your business against the practical functions of your particular organisation, highlighting any areas of weakness that may cause significant issues or delays in the event of a disaster. It forces you to consider the many ways your business might be affected by unforeseen circumstances and how you would respond to them.
Of, course, if aliens land tomorrow or we suffer a global zombie outbreak, then most of us will not have plans in place to deal with these highly unlikely situations. However, by undertaking a business impact analysis, you will be able to identify situations that may well occur and prioritise different elements of your business for each scenario, ensuring that you will be able to get back to full speed as soon as possible with the least disruption, no matter the circumstances.
Involve your staff
These are the people who will be following the plan’s instructions if you invoke the plan for real, so it’s crucial that they understand the plan and the instructions within. A business continuity plan is only as good as the individual links in the chain – keep everyone informed and up to date with any changes.
Testing your plan
The only way to know for sure if your business continuity plan works is by invoking it. I’m not advocating sending all your staff out into the car park to appeal to the gods for a flood, but it is a good idea to test the plan, as far as is possible, through some form of drill. Similar to how you might test your fire safety procedures, or the efficiency and ability to cope in a crisis of your nominated First Aiders, a drill can really highlight the true weaknesses of your plan in a way that brainstorming in an office can’t. That said, it may not be practical to undertake a full drill that involves every aspect of your plan in one go – rare is the business that can afford to halt all its day to day activities unless it is absolutely unavoidable – in that case, try to break it down into aspects you can practically test and those you can’t.
Reviewing and updating your plan
Business continuity plans should tested and reviewed at least annually, more often if there have been changes to your business practices or to relevant legislation. Examples might include (but are not limited to):
- Office relocation or addition of new offices
- New suppliers for your crucial business systems
- Changes in management or other staff with plan responsibility
- Changes or additions to the products or services your business offers
- Changes to legislation, e.g. data protection, which might require more secure offline backup systems
- External events beyond your control, e.g. major building works nearby, impending civil unrest etc.
Why did I need to write this post?
Over the last few years, more and more tenders have required business continuity plans and the main response I get from my clients is: ‘what the hell are they talking about?!’. Something about the word ‘plan’ seems to either send people into panic mode, or decide that it’s not an important part of the bid, especially when it’s not really made clear in the tender what exactly it refers to.
Often, although the question asks for the bidder to attach a copy of their plan, it is assumed that a brief response – along the lines of ‘we will do whatever needs to be done to return to full capacity’ (in other words ‘ah, it’ll be fine, no worries’) – will suffice. It won’t.
I believe the confusion comes from the wording – business continuity plan – when what it really is, is a policy. For example, within the average Health & Safety policy would be a number of ‘plan’ type aspects – what are the risks, how to you minimise them, if something does happen, who do you call, how do you respond, what happens next etc.? – the same goes for business continuity.
Thinking of it as a key company policy will ensure that, even when two thirds of your staff have become members of the undead and are slowly lumbering up the high street looking for brains, you’ll already have plans in place to take on those new guys with the tentacles, glowing fingertips and probes and get back to business.