Nicola Hemming
Nicola is a Principal Resilience Consultant, leading a team of Emergency Planning and Resilience specialists supporting a range of clients.
What is a Business Continuity Plan?
A business continuity plan (BCP) is a structured strategy of how an organisation would recognise, activate and inform stakeholders during and after an unexpected disruption. The plan should provide a clear map for continuity essential to business activities despite the disruption.
Why Are Business Continuity Plans Important?
A business continuity plan is essential for helping an organisation to continue to deliver its critical services during and after a disruption. With no plan, any incident can result in loss of key services and downtime, financial impacts, irreparable reputational damage, loss of clients and potential harm to customers or the public.
What Are the Benefits of a Business Continuity Plan?
- Minimises downtime in disruption.
- Better understanding of risks.
- Improved incident response for staff.
- Financial benefits.
- Improved organisational resilience.
- Enhanced staff confidence.
- Improved customer and stakeholder reputation.
- Contractual compliance.
- Competitive advantage.
When Would a Business Continuity Plan Need to Be Activated?
A business continuity plan would be activated when an event, either internally or externally, threatens an organisation’s ability to operate normally. When the BCP is activated, a process is followed to minimise the impact the event may have on the organisation and identifies short and long-term steps for recovery. A BCP is a broad plan that should encompass a wide range of triggers, including:
- Environmental incidents such as fires, flood, drought and extreme weather.
- Supplier loss / closure.
- Loss of resource due to pandemics, industrial actions and food poisoning.
- Cyber attacks or ransomware demands.
What Are the Key Components in a Business Continuity Plan?
A business continuity plan does not only include how to react to an unexpected disruption, but it is tailored to individual organisations to ensure the plan is actionable and robust to a wide range of incidents. So, the contents of the BCP are dependent on what the organisation is and what its priorities are. However, there are some key components that are present within all BCPs.
Scope
This component outlines the objectives of the plan and what it is responsible for. This is where it is highlighted if the plan refers to a specific department, service area, location, system, or the whole organisation. This is required to set clear boundaries of when the plan should be referred to.
Recognising an Incident and Who to Notify
It is essential that staff not only know how to notify other staff of an unexpected disruption, but also to recognise when an incident occurs. Different departments may have different versions of what a business continuity incident is and different triggers for the plan. Therefore, clarification is required to ensure staff align on how a business continuity incident should be identified and the correct channels in which to communicate and escalate the incident notification.
Team Roles and Responsibilities
A successful response is critically dependent on the team understanding who is responsible and for what. There are many roles required and it is important that there are clear actions or responsibilities outlined within the plan. This is commonly done through an action card or a checklist for each role.
Priority Targets
A common misunderstanding is that the business continuity plan is all an organisation needs. Information from a business impact analysis (BIA) feeds into and is displayed in the BCP, such as priority services, recovery time objectives (RTO), recovery point objectives (RPO) and contingency options. This information is captured within the BCP to allow incident responders to easily and cohesively identify priority services and targets to restore their services within an acceptable period of disruption.
How do you Maintain and Update a Business Continuity Plan?
The plan needs to be maintained by assigning ownership. A BCP owner should be responsible for maintaining the plan and issuing updates at different intervals. This is essential because if the business continuity plan is not updated, the plan will no longer be effective.
The business continuity plan should be reviewed at the below times:
- At least annually.
- Following any major organisational changes or restructure.
- Following an incident or near-miss event.
- After an exercise of the plan.
As the organisation develops and evolves, the business continuity plan should too, because priorities and services may change and these would need to be reflected within the business continuity plan.