If the COVID-19 pandemic taught us anything it’s that you can never be too prepared for a crisis. Although crises on such a macro scale are not the norm, firms will always be at risk for operational and service disruptions as that’s just the nature of business. However, having a well-designed business continuity plan (BCP) in place provides policy and guidance to your organization in times of crisis, allowing for faster response times to remediating service disruptions while restoring essential services to clients as quickly as possible. Failing to plan for the unexpected leaves your firm susceptible to competitive poaching as your clients are hindered by service interruptions and even on the extreme end you run the risk that your business may fail to recover all together. By incorporating a comprehensive BCP plan into your recovery strategy you can proactively safeguard yourself and firm while getting back to business as usual.

 

Identifying Your Weaknesses

When beginning the development of a business continuity plan it’s imperative to evaluate your weaknesses, or in other words, what functions are critical to the general operation of your business and how could a disruption affect them. Running a business impact analysis (BIA) and a risk evaluation can help identify both operational and financial impacts of disrupted business so you can better understand what’s needed to put an effective plan in place. Running a successful BIA and risk evaluation can be accomplished through the following steps:

  1. Identify all business functions
  2. Prioritize those functions which are deemed critical to the restoration of business
  3. Identify any interdependencies (IT network)
  4. Evaluate operational impacts of disruption
  5. Evaluate financial and legal impacts
  6. Analyze the potential associated losses
  7. Develop recovery time objective (RTO)

Important impacts to consider include:

  1. Lost sales or income
  2. Increased expenses (overtime, outsourcing, etc.)
  3. Regulatory or contractual fines
  4. Negative reputational impact
  5. Opportunity cost of lower growth prospects
  6. Client dissatisfaction and potential loss

 

Planning for The Unexpected 

Once you have identified which areas of your business are critical to continued operations, especially during a crisis or emergency, you can begin to construct the layout of your action plan. Having already established the priorities and deadlines for your BCP in your business impact analysis and risk evaluation, it’s important to next consider the possible scenarios for which your BCP would be needed and the likelihood of their occurrence, such as:

  1. Physical damage to your facilities/building
  2. Damage or breakdown of machinery and equipment
  3. Interruption or complete failure of the supply chain
  4. Utility outage
  5. Damage to, loss or corruption of information technology including voice and data communications, servers, computers, operating systems, and applications
  6. Nonappearance of critical employees

With a better understanding of possible crises and their chance of occurrence, you can begin to map out how to recover business operations to an acceptable level following an emergency incident. Although that sounds simple enough, recovery strategies take time, people, and resources to enact which may not always be accessible during emergency situations. Therefore, it’s critical that during the development of your plan you incorporate an analysis of the resources required to carry out any of your strategies along with alternative recovery plans in case resources become inaccessible. Additionally, when designing your BCP it’s important to:

  1. Develop both internal and external communications procedures
  2. Specify an alternative operations site in case your facilities are damaged or inaccessible
  3. Cultivate alternative action plans in case there is a loss of resources
  4. Identify a crisis management team with specified segmented duties
  5. Ensure technology is in place to support telecommuting and remote connectivity
  6. Determine if partnering with a BCP support vendor is in the best interest of your firm
  7. Develop manual workaround procedures for functions that are currently automated

 

Practice Makes Perfect

With your plan established, it becomes critical that your employees are properly trained on the general plan as well as their specific roles and responsibilities in the event of a crisis. By providing training on your BCP, you can ensure that your employees are prepared with the necessary tools to know what to do, where to go, and who is responsible for what to get your business back to functioning level as soon as possible.  After providing sufficient training, it’s time to test your plan. Effective testing supports improved organizational coordination and communications while revealing weaknesses and gaps in your strategies. Comprehensive testing should be conducted to certify that all systems and functions of your business continuity plan are working in a manner that resembles your everyday work environment to the best of their abilities.

Testing your plan through live exercises is perhaps the best way to prepare your firm and employees for any potential crises that lie ahead. Facilitating walkthroughs and functional exercises familiarize team members with simulated emergency response and the real-time implementation of your plan, procedures, and resources. Looking back to your list of potential emergency situations and their likelihood, you can establish an exercise program that is tailored to your firm’s most probable crises. At the conclusion of your exercise it’s imperative to solicit feedback from your participants so you can identify areas for improvement. With a comprehensive backend process in place to analyze the success of your exercise, you can ensure that when faced with a real crisis you’ll be ready.