Business Continuity

Helping to keep your business in business

1. What is Business Continuity?
2. Why is business continuity important?
3. Developing your Business Continuity arrangements
4. The contents of an effective Business Continuity Plan
5. Reviewing, testing and implementing your Business Continuity arrangements
6. Useful websites

 

1. What is Business Continuity?

Business Continuity is the ability of an organisation to maintain essential functions during and after an incident has occurred. The most basic business continuity requirement is to keep essential functions up and running during period of disruption and to recover with as little downtime as possible.

Business disruptions can present themselves in many ways, such as:

• utility outages
• weather related incidents
• cyber-attacks
• fire
• equipment failure
• sickness outbreak
• loss of suppliers. 

All of which can disrupt your business process; they can either slow down your operation or stop it altogether.

Resilience is a measure of how quickly your organisation is able to respond and recover to disruption and return to business as usual within an acceptable time fame.

Understanding how to get your organisation up and running after an incident means that you are more likely to safeguard your staff and reputation, continue providing employment, meet customer needs and, ultimately, survive the incident.

 

2. Why is Business Continuity important?

Did you know:

• about 20% of businesses suffer a significant disruption each year
• 80% of businesses affected by a major incident do not re-open or close within 18 months
• 90% of businesses that lose data from a disaster are forced to shut within two years?

Effective Business Continuity planning helps to ensure during times of disruption your business continues to maintain their essential functions and supporting the prioritised recovery of your most time-sensitive objectives.

 

3. Developing your Business Continuity arrangements

The first stage of business continuity planning is known as a ‘Business Impact Analysis’ (BIA).

A BIA is a process of identifying your critical activities, determining the impact that a disruption to these activities would have on your business and what resources you need to maintain them to an acceptable level.

Critical activities can be defined as those activities which need to be performed to deliver key products and services that enable your business to meet its most important and time-sensitive objectives.

Key questions to consider as part of the BIA include:

• What does your organisation do and deliver?
• What are your most urgent activities?
• What do you need to deliver your most critical activities?
• What would be the impact over time if certain activities were disrupted or interrupted?
• What are the risks to service delivery, for example, do you rely on a single supplier?

It is also good to consider any local risks as part of business continuity planning and the Essex Community Risk Register highlights risks that have the highest likelihood and potential to have significant impact, causing disruption to our local area.

Once you have carried out your BIA, you can start developing your Business Continuity Plan (BCP).

Although you need to be aware of specific risks and deal with any serious ones, your planning should focus on the outcomes of disruption not its causes.

Regardless of the cause, a business continuity incident generally means you have lost one or more of the following:

• loss of staff or skills, for example, through sickness or severe weather events
• loss of critical systems, for example, ICT failure
• loss of utilities, for example, water, gas or electricity
• denial of access, or damage to, facilities/premises, for example, loss of a building, flooding, fire
• loss of key resources, for example, specialist supplies you depend on to deliver your business

 

4. The contents of an effective Business Continuity Plan (BCP)

A BCP should record how you will respond to an emergency or a disruption. It should set out the parameters and pre-defined thresholds for the activation of the plan. The plan should identify risks to the organisation, the maximum tolerable period of disruption and the recovery time objective.

The BCP will also detail alternate working arrangements requirements, which should have been identified in advance with alternate arrangements detailed to ensure that the critical activities can be maintained.

As an overview, business continuity plans should generally contain the following details:

• Document management information such as a document owner, version control or distribution list
• Roles and responsibilities
• How will the plan be activated – when, by whom and how?
• Key contact details – internal and external
• Critical functions / activities to be recovered, timescales and recovery levels needed
• Resources available to deliver critical activities during the first 24hrs and up to 2 weeks from the event, and processes for mobilising resources
• Actions to be carried out, in what timescale and who will do these
• Clear communication processes – who reports to whom or cascades information
• Process for standing down and returning to normal business.

The free, Government Business Continuity Management toolkit provides details on what your business continuity arrangements should contain and further advice on how to develop your plan.

 

5. Reviewing, testing and implementing your Business Continuity arrangements

A BCP is not considered valid until it has been tested. Does the plan actually work? Does it give the intended outcome? Are there any gaps in arrangements? Are staff prepared?

There are many different ways to test or exercise your plan, so it is important to choose the type of approach that works best for your organisation, for example, a table-top event, using a fictitious scenario for a full ‘walk through’ of the plan, or a ‘live’ exercise where people take on specific roles and simulate your response.

There may be occasions when you want to just test specific elements of your plan, such as checking your key contacts list is up-to-date.

The most crucial element of exercising BCP’s is to identify the lessons learnt. This should help inform improvements to the plan as well and identifying any training needs for those with specific responsibilities within the plan.

Business continuity training and awareness is a core part of embracing a culture of resilience within your business. It is pointless to invest time and energy in writing a plan and developing response arrangements if nobody knows about it.

It is important that all staff who are responsible for either activating the plan or delivering any element of the plan, are fully aware of their roles and responsibilities.

All plans should be reviewed whenever there are any major changes to premises, processes or services, or when a new threat emerges that threatens to disrupt your business activities.

 

6.     Useful websites

• Business Continuity Institute
• The UK Government Resilience Framework
• National Cyber Security Centre
• Guidance to help you develop a business continuity plan (GOV.UK)
• Cyber Aware - Free cyber action plan
• Business_Continuity_Managment_Toolkit.pdf