Business Continuity is the ability of an organisation to maintain essential functions during and after an incident has occurred. The most basic business continuity requirement is to keep essential functions up and running during period of disruption and to recover with as little downtime as possible.
Business disruptions can present themselves in many ways, such as:
All of which can disrupt your business process; they can either slow down your operation or stop it altogether.
Resilience is a measure of how quickly your organisation is able to respond and recover to disruption and return to business as usual within an acceptable time fame.
Understanding how to get your organisation up and running after an incident means that you are more likely to safeguard your staff and reputation, continue providing employment, meet customer needs and, ultimately, survive the incident.
Did you know:
Effective Business Continuity planning helps to ensure during times of disruption your business continues to maintain their essential functions and supporting the prioritised recovery of your most time-sensitive objectives.
The first stage of business continuity planning is known as a ‘Business Impact Analysis’ (BIA).
A BIA is a process of identifying your critical activities, determining the impact that a disruption to these activities would have on your business and what resources you need to maintain them to an acceptable level.
Critical activities can be defined as those activities which need to be performed to deliver key products and services that enable your business to meet its most important and time-sensitive objectives.
Key questions to consider as part of the BIA include:
It is also good to consider any local risks as part of business continuity planning and the Essex Community Risk Register highlights risks that have the highest likelihood and potential to have significant impact, causing disruption to our local area.
Once you have carried out your BIA, you can start developing your Business Continuity Plan (BCP).
Although you need to be aware of specific risks and deal with any serious ones, your planning should focus on the outcomes of disruption not its causes.
Regardless of the cause, a business continuity incident generally means you have lost one or more of the following:
A BCP should record how you will respond to an emergency or a disruption. It should set out the parameters and pre-defined thresholds for the activation of the plan. The plan should identify risks to the organisation, the maximum tolerable period of disruption and the recovery time objective.
The BCP will also detail alternate working arrangements requirements, which should have been identified in advance with alternate arrangements detailed to ensure that the critical activities can be maintained.
As an overview, business continuity plans should generally contain the following details:
The free, Government Business Continuity Management toolkit provides details on what your business continuity arrangements should contain and further advice on how to develop your plan.
A BCP is not considered valid until it has been tested. Does the plan actually work? Does it give the intended outcome? Are there any gaps in arrangements? Are staff prepared?
There are many different ways to test or exercise your plan, so it is important to choose the type of approach that works best for your organisation, for example, a table-top event, using a fictitious scenario for a full ‘walk through’ of the plan, or a ‘live’ exercise where people take on specific roles and simulate your response.
There may be occasions when you want to just test specific elements of your plan, such as checking your key contacts list is up-to-date.
The most crucial element of exercising BCP’s is to identify the lessons learnt. This should help inform improvements to the plan as well and identifying any training needs for those with specific responsibilities within the plan.
Business continuity training and awareness is a core part of embracing a culture of resilience within your business. It is pointless to invest time and energy in writing a plan and developing response arrangements if nobody knows about it.
It is important that all staff who are responsible for either activating the plan or delivering any element of the plan, are fully aware of their roles and responsibilities.
All plans should be reviewed whenever there are any major changes to premises, processes or services, or when a new threat emerges that threatens to disrupt your business activities.