We all know that the modern business environment is highly competitive. If you are unfortunate enough to suffer a major incident or interruption then it will be a challenge for you to continue to satisfy your clients and remain in business. A key factor to a business recovering quickly from a major disaster such as a fire or terrorism event is whether the business has a Business Continuity Plan (BCP) in place. Of course, you may never need to use this, but if the worst does happen, it may be the difference between your business recovering or failing. To address this, we’ve arranged some Guidance Notes to assist SME’s. By following the guidance, you should be able to create a BCP which, in combination with the correct insurance cover, will help your business survive and recover.
Benefits of a BCP
1. Significantly increases the chances of your business surviving a major incident.
2. Insurance plays its part, but many of the effects of a disaster such as damage to your brand or reputation may not be insurable.
3. Without a BCP in place, it is difficult to be sure that your Business Interruption insurance period of cover is set long
enough for your profits to return to pre-incident levels.
4. Customers may ask for evidence of such a plan as part of contract negotiations.
5. Provides evidence of good risk management which could improve your overall insurance deal.
Overview of the process
Business Continuity Planning is important for organisations of all sizes because at its most fundamental level it seeks to:
• Minimise the chance of the business suffering an incident which damages or disrupts your business
• Maximise the ability of the business to recover from an incident and continue trading.
We believe that small businesses can significantly benefit from preparing a BCP, but we also recognise that your time is precious.
So, to help you understand the process, we’ve broken it down into 5 simple stages so you can quickly prepare a plan.
Stage 1 – Service levels
This stage is about documenting what your business does – and must continue to do – to operate effectively.
• Normal Service Levels
– What does your business routinely aim to deliver to your customers in terms of service, product and timescales?
– This will allow you to record what is important to your business before any incidents occur and have a target for the business to recover to.
– Think about your business targets and what outputs are required to ensure these targets are delivered.
In simple terms, this is what the business exists to do on a day-to-day basis.
– Remember to include any specialist areas or processes.
• Minimum Service Levels
– What is the minimum service level required to fulfil customer requirements and keep important customers and to avoid
permanent loss of custom?
– This is the basic service you will need to continue to deliver to ensure your business survival.
– Ask yourself if you need to continue with any specialist services or processes or if you can introduce acceptable alternatives.
• Maximum Downtime
– How long will your customers tolerate an interruption to your service before taking their business elsewhere?
– How soon until your market reputation is damaged?
Stage 2 – Risk assessment
This stage involves:
• Identifying the key threats facing your business, e.g. fire, flood, machinery breakdown, IT issues and data loss.
• Deciding on measures which would minimise the likelihood of these threats occurring.
• Deciding which of these measures are practical to implement and over what period of time.
Stage 3 – Incident Management Planning
The next stage is to put a plan in place to help your business cope with the initial period after an incident.
Of course, the welfare of your staff and visitors to the site will be your priority, after that has been taken care of you can turn your attention to your business. Pre-planned actions taken in the immediate aftermath of the incident can have a significant impact on the subsequent speed of recovery for your business.
There are three areas you will need to cover:
• Implement damage limitation measures especially relating to security, avoiding further damage (e.g. by weather causing further damage to weakened property) and the salvage and removal of machinery, contents and files.
• Contact those who can help and those who need to know about the incident. You may not have access to your usual company records and contact directories after an incident. Think about who you’ll need to contact and record their details in your business continuity documentation.
• Stabilise your business at the Minimum Service Level you have already defined. Now you need to think about the short-term measures and temporary work-arounds you can undertake to enable you to return to delivering your minimum service level.
• Make contact with your insurance intermediary
To address these areas your BCP needs to include:
• A list of Emergency Contacts
• A list of Immediate Actions required to limit disruption following major loss, e.g. fi re, flood etc
• A list of actions required to address disruptions to specific activities, e.g. short-term homeworking, arranging subcontracting and alternative supply arrangements.
Battle Box: To ensure you have all the resources you will need, you should prepare a ‘battle box’ of items that will help manage the incident and complete your first actions. Carefully consider where you’ll keep your battle box. It must be in a location that’s secure but also accessible. Examples of what you might want to include in your battle box are:
• A copy of your Fire Risk Assessment
• A copy of your BCP
• Asset register and inventories
• Company stationery and letterhead
• General stationery and writing materials
• Data restoration instruction
• Disposable camera
• Yellow Pages/local directory
• Insurance documents.
Stage 4 – Business Recovery Planning
Once you’ve stabilised your business at delivering its minimum service level, you’ll need to move forward. Firstly, you must establish how quick the physical recovery will be. If the premises, office systems, machinery and supplies will be repaired or replaced quickly then you may not need to take further action other than preparing to ‘hit the ground running’ once the repairs have been completed.
Your customers are unlikely to wait for an extended period and will move to other suppliers if you don’t act to restore your normal service. You will need to think about issues such as:
• Implementing alternative working practices such as working from an alternative location.
• Consider subcontracting if applicable to your business.
• Identifying and equipping temporary premises, perhaps temporarily using second hand equipment and bringing as much work back in house as possible.
• Monitoring the progress of the reinstatement work at the damaged premises, ensuring that this goes to plan and that machinery etc is ordered, installed and commissioned at the appropriate time.
• Keeping in contact with customers and trying to win back lost business as capacity improves.
Stage 5 –Plan Rehearsal and Maintenance
Rehearsal: The first stage is to ensure you – and anyone in your business that will have a key role in assisting you – are familiar with the plan and its contents. Plan some time when you can read through the plan without distractions and ensure that it all makes sense to you. The next stage is to run a desktop rehearsal. This will also involve getting together with those in your business who will have a key role in assisting you. You can agree on some ‘what if’ questions and see if the plan can be used to assist you in dealing with the incident. For example, you might want to ask, “what if we had a fire?” Does the plan have enough information to allow you to deal with the incident?
If you uncover uncertainties during this exercise, then your BCP probably requires further work.
Maintenance: The objective of maintaining your plan is to ensure that the data and contact details are up to date.
You’ll find it difficult to use your BCP if these details are out of date. So, it’s important to regularly maintain the plan data and contact details (this needs to be done more often than plan rehearsals).
Contact Damian Hayes at De Novo Risk Solutions to discuss your BCP in more details and find out how we don’t just concentrate on price but also risk management.
Damian can be contacted on 01684 218 618/07495 327 055 or damian@denovorisksolutions.co.uk
