- Artificial Intelligence
- Business Operations
- Cloud Computing
- Data Center
- Data Management
- Emerging Technology
- Enterprise Applications
- IT Leadership
- Digital Transformation
- IT Strategy
- IT Management
- Diversity and Inclusion
- IT Operations
- Project Management
- Software Development
- Vendors and Providers
- United States
- Middle East
- Netherlands
- United Kingdom
- New Zealand
- Data Analytics & AI
- Newsletters
- Foundry Careers
- Privacy Policy
- Cookie Policy
- Member Preferences
- About AdChoices
- Your California Privacy Rights
Our Network
- Computerworld
- Network World
How to create an effective business continuity plan
A business continuity plan outlines procedures and instructions an organization must follow in the face of disaster, whether fire, flood or cyberattack. Here's how to create one that gives your business the best chance of surviving such an event.
We rarely get advance notice that a disaster is ready to strike. Even with some lead time, though, multiple things can go wrong; every incident is unique and unfolds in unexpected ways.
This is where a business continuity plan comes into play. To give your organization the best shot at success during a disaster, you need to put a current, tested plan in the hands of all personnel responsible for carrying out any part of that plan. The lack of a plan doesn’t just mean your organization will take longer than necessary to recover from an event or incident. You could go out of business for good.
What is business continuity?
Business continuity refers to maintaining business functions or quickly resuming them in the event of a major disruption, whether caused by a fire, flood or malicious attack by cybercriminals. A business continuity plan outlines procedures and instructions an organization must follow in the face of such disasters; it covers business processes, assets, human resources, business partners and more.
Many people think a disaster recovery plan is the same as a business continuity plan, but a disaster recovery plan focuses mainly on restoring an IT infrastructure and operations after a crisis. It’s actually just one part of a complete business continuity plan, as a business continuity plan looks at the continuity of the entire organization.
Do you have a way to get HR, manufacturing and sales and support functionally up and running so the company can continue to make money right after a disaster? For example, if the building that houses your customer service representatives is flattened by a tornado, do you know how those reps can handle customer calls? Will they work from home temporarily, or from an alternate location? The BC plan addresses these types of concerns.
Note that a business impact analysis is another part of a business continuity plan. A business impact analysis identifies the impact of a sudden loss of business functions, usually quantified in a cost. Such analysis also helps you evaluate whether you should outsource non-core activities in your business continuity plan, which can come with its own risks. The business impact analysis essentially helps you look at your entire organization’s processes and determine which are most important.
Why business continuity planning matters
Whether you operate a small business or a large corporation, you strive to remain competitive. It’s vital to retain current customers while increasing your customer base — and there’s no better test of your capability to do so than right after an adverse event.
Because restoring IT is critical for most companies, numerous disaster recovery solutions are available. You can rely on IT to implement those solutions. But what about the rest of your business functions? Your company’s future depends on your people and processes. Being able to handle any incident effectively can have a positive effect on your company’s reputation and market value, and it can increase customer confidence.
“There’s an increase in consumer and regulatory expectations for security today,” says Lorraine O’Donnell, global head of business continuity at Experian. “Organizations must understand the processes within the business and the impact of the loss of these processes over time. These losses can be financial, legal, reputational and regulatory. The risk of having an organization’s “license to operate” withdrawn by a regulator or having conditions applied (retrospectively or prospectively) can adversely affect market value and consumer confidence. Build your recovery strategy around the allowable downtime for these processes.”
Anatomy of a business continuity plan
If your organization doesn’t have a business continuity plan in place, start by assessing your business processes, determining which areas are vulnerable, and the potential losses if those processes go down for a day, a few days or a week. This is essentially a business impact analysis.
Next, develop a plan. This involves six general steps:
- Identify the scope of the plan.
- Identify key business areas.
- Identify critical functions.
- Identify dependencies between various business areas and functions.
- Determine acceptable downtime for each critical function.
- Create a plan to maintain operations.
One common business continuity planning tool is a checklist that includes supplies and equipment, the location of data backups and backup sites, where the plan is available and who should have it, and contact information for emergency responders, key personnel and backup site providers.
Remember that the disaster recovery plan is part of the business continuity plan, so developing a disaster recovery plan if you don’t already have one should be part of your process. And if you do already have a disaster recovery plan, don’t assume that all requirements have been factored in, O’Donnell warns. You need to be sure that restoration time is defined and “make sure it aligns with business expectations.”
As you create your plan, consider interviewing key personnel in organizations who have gone through a disaster successfully. People generally like to share “war stories” and the steps and techniques (or clever ideas) that saved the day. Their insights could prove incredibly valuable in helping you to craft a solid plan.
The importance of testing your business continuity plan
Testing a plan is the only way to truly know it will work, says O’Donnell. “Obviously, a real incident is a true test and the best way to understand if something works. However, a controlled testing strategy is much more comfortable and provides an opportunity to identify gaps and improve.”
You have to rigorously test a plan to know if it’s complete and will fulfill its intended purpose. In fact, O’Donnell suggests you try to break it. “Don’t go for an easy scenario; always make it credible but challenging. This is the only way to improve. Also, ensure the objectives are measurable and stretching. Doing the minimum and ‘getting away with it’ just leads to a weak plan and no confidence in a real incident.”
Many organizations test a business continuity plan two to four times a year. The schedule depends on your type of organization, the amount of turnover of key personnel and the number of business processes and IT changes that have occurred since the last round of testing.
Common tests include tabletop exercises , structured walk-throughs and simulations. Test teams are usually composed of the recovery coordinator and members from each functional unit.
A tabletop exercise usually occurs in a conference room with the team poring over the plan, looking for gaps and ensuring that all business units are represented therein.
In a structured walk-through, each team member walks through his or her components of the plan in detail to identify weaknesses. Often, the team works through the test with a specific disaster in mind. Some organizations incorporate drills and disaster role-playing into the structured walk-through. Any weaknesses should be corrected and an updated plan distributed to all pertinent staff.
It’s also a good idea to conduct a full emergency evacuation drill at least once a year. This type of test lets you determine if you need to make special arrangements to evacuate staff members who have physical limitations.
Lastly, disaster simulation testing can be quite involved and should be performed annually. For this test, create an environment that simulates an actual disaster, with all the equipment, supplies and personnel (including business partners and vendors) who would be needed. The purpose of a simulation is to determine if you can carry out critical business functions during the event.
During each phase of business continuity plan testing, include some new employees on the test team. “Fresh eyes” might detect gaps or lapses of information that experienced team members could overlook.
Review and improve your business continuity plan
Much effort goes into creating and initially testing a business continuity plan. Once that job is complete, some organizations let the plan sit while other, more critical tasks get attention. When this happens, plans go stale and are of no use when needed.
Technology evolves, and people come and go, so the plan needs to be updated, too. Bring key personnel together at least annually to review the plan and discuss any areas that must be modified.
Prior to the review, solicit feedback from staff to incorporate into the plan. Ask all departments or business units to review the plan, including branch locations or other remote units. If you’ve had the misfortune of facing a disaster and had to put the plan into action, be sure to incorporate lessons learned. Many organizations conduct a review in tandem with a table-top exercise or structured walk-through.
How to ensure business continuity plan support, awareness
One way to ensure your plan is not successful is to adopt a casual attitude toward its importance. Every business continuity plan must be supported from the top down. That means senior management must be represented when creating and updating the plan; no one can delegate that responsibility to subordinates. In addition, the plan is likely to remain fresh and viable if senior management makes it a priority by dedicating time for adequate review and testing.
Management is also key to promoting user awareness. If employees don’t know about the plan, how will they be able to react appropriately when every minute counts? Although plan distribution and training can be conducted by business unit managers or HR staff, have someone from the top kick off training and punctuate its significance. It’ll have a greater impact on all employees, giving the plan more credibility and urgency.
Related content
How to overcome the data silo challenge, a feat of skill: moving sap workloads to the cloud, a critical next phase of cloud transformation: reducing wan complexity, healthcare providers focus on quality for the next phase of digital transformation, from our editors straight to your inbox, show me more, the raci matrix: your blueprint for project success.
What is an SLA? Best practices for service-level agreements
United Airlines gives employees the digital tools to make customers happy
CIO Leadership Live with George Eapen, Group Chief Information Officer at Petrofac
CIO Leadership Live with Marc Hale, Chief Technology Officer, AIA NZ
CIO Leadership Live with CIO/CTO Kirk Ball of Giant Eagle
Sponsored Links
- Lenovo Late Night I.T. - Emmy-nominated host Baratunde Thurston is back at it for Season 2, hanging out after hours with tech titans for an unfiltered, no-BS chat.
- Discover why the worlds most essential organizations rely on NETSCOUTs Visibility Without Borders platform to keep their networks secure, available, and unstoppable.
- dtSearch® - INSTANTLY SEARCH TERABYTES of files, emails, databases, web data. 25+ search types; Win/Lin/Mac SDK; hundreds of reviews; full evaluations
- Get Support
- Help Me Remote
Home » 5 Helpful Tips for Business Continuity Planning
5 Helpful Tips for Business Continuity Planning
There are many occurrences that could disrupt your business, leading to loss of revenue and possibly additional, unplanned expenses. The biggest concern for many businesses used to revolve around inclement weather or natural disasters.
These days, data breaches are a more immediate threat. Whatever the cause of disruption, however, a company’s ability to move ahead relies on having a solid business continuity plan in place to address the issue and recover in a timely manner. Here are a few tips to help you create a continuity plan for your operation.
1. Identify Potential Threats
Your business continuity plan may apply to any number of scenarios in which business is disrupted, from power outages, to employee strikes, to cyber-attacks on computer networks. However, identifying and understanding potential threats can only help you to better prepare for every possible contingency.
2. Identify Potential Outcomes
In addition to knowing the threats that could derail your operations, it’s important to walk through what will happen in the wake of such catastrophes. What happens when your company becomes the victim of ransomware?
If you’re unprepared for this possibility, chances are you’ll end up paying the ransom in order to regain control of your network and access to your files. The other potential outcome is that you refuse to pay and you have to start from scratch.
The third option, of course, is preparing with a business continuity plan that includes appropriate technical support. This might include a managed services provider that hosts off-site system backups you can implement in just such an emergency to keep your business up and running.
3. Build a Recovery Team
Whether you hire in-house IT staff or you work with a third-party vendor, you’re going to need a team in place that can spring into action when a disaster occurs. This team could help to create your business continuity plan as well as implement it should the need arise.
4. Create a Recovery Plan
A solid business continuity plan will have to identify essential business functions and find ways to restore them in the event of a partial or complete shutdown. The goal is to disrupt normal operations as little as possible.
5. Train Employees
Employees are trained not only to do the jobs for which they were hired, but also to interact appropriately with coworkers, observe basic computer security protocols, and generally behave in a safe, responsible, and appropriate manner in the work environment. Part of their training should also include steps to follow in the event that business is somehow disrupted, including informing superiors, contacting a recovery team, or following other prescribed protocols.
We make use of javascript for rendering content on this page. Please enable Javascript in your web browser.
- MyUGA Portal
- Log in to UGAMail
- Wireless Access
Policies, Standards, and Guidelines
Recommendations for business continuity planning and disaster recovery planning.
The Office of Information Security strongly recommends that all units have a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) for critical information systems that have a high need for availability without interruption.
Recommended Framework
The National Institute of Standards and Technology Special Publication 800-34: Contingency Planning Guide for Federal Information Systems is a useful guide that can assist UGA units in creating BCPs and DRPs for their critical systems.
NIST SP 800-34 defines various types of IT contingency plans--including BCPs and DRPs--and outlines a six step planning process for creating contingency plans:
- Develop the Contingency Planning Policy Statement
- Conduct the Business Impact Analysis (BIA)
- Identify Preventative Controls
- Create Contingency Strategies
- Plan Testing, Training and Exercises
- Plan Maintenance
Please contact the Office of Information Security via the EITS Helpdesk if you need any assistance creating BCPs or DRPs for your unit, or if you have any questions about using the recommended NIST SP 800-34 framework for contingency planning.
5 Essential Steps to Business Continuity Planning
While over half of small and midsize business owners say it would take at least three months to recover from downtime, 60% don't have an emergency response plan . However, according to Gartner , the average cost of downtime can climb up to $5,600 per minute.
When it comes to business continuity planning, there are several critical issues leaders should be addressing. You must lay out the steps you will take to react to business shocks now, but also entirely reshape your business continuity plan.
Now is the time to create an active recovery plan if your organization doesn't have one. It takes effort, but you will give your business the best chance at survival after (and during) an unexpected event.
Keep reading to learn the steps to effective business continuity planning.
What Is Business Continuity Planning?
Business Continuity Planning focuses on maintaining business functions or efficiently resuming them in the event of a major disaster. A major disaster can be anything from a flood, fire, malicious cybercriminal to a pandemic.
A business continuity plan (BCP) outlines the procedures your organization will follow in the face of such disasters. It covers crisis communication strategy, assets, business partners, human resources, and more.
You've likely heard of a disaster recovery plan that focuses on restoring IT infrastructure and operations after a disaster. However, disaster recovery is one small part of a complete BCP, as it seeks to ensure the continuity of the entire organization.
As time passes and the COVID-19 pandemic is controlled, organizations must review and renew business continuity plans. You will need to assess how your current BCPs are working—if you have any.
The best way to locate any gaps is through business continuity testing . If you spot deficiencies, you must highlight them and identify the root causes, whether it's external environmental issues, lack of infrastructure, or timeliness of action.
Agility Planner is an intuitive business continuity planning and preparation tool that streamlines, simplifies, and supports your BC management process. Agility Planner has been developed to help your business go from reactive to proactive with its business continuity planning.
Then, outline new procedures based on lessons learned, and contingency plans to build resilience and adequately respond to future disasters.
COVID-19 is unlike anything our economy has ever experienced, so it was impossible to prepare for with traditional wisdom and forecasting tools. However, you should view this disaster as something to learn from and carry the lessons learned forward once the pandemic has passed , and you've had time to analyze your response.
Top Threats to Your Organization's Continuity
Depending on your industry and level of risk, every organization will have different primary threats to daily business. Risk assessments before creating a BCP is helpful for this reason. You don't need to have a plan for every possible scenario, but you should watch out for the following common disruptors.
Global Pandemics
You've likely experienced how a global pandemic can throw a wrench in the best of business plans, from all angles.
Many employees must work from home, demand for specific items grows, and supplies decrease due to disturbances across the supply chain.
When considering how your organization will respond to a global pandemic, put in place a solid disaster communication plan. You'll need to envision how your employees will work together and conduct necessary business offsite.
It's also necessary to consider alternate suppliers and products to avoid a single point of failure.
Use what's happening now to determine what is and isn't working for your business, then plan for how you will handle similar scenarios in the future.
Power Outages
Imagine the disruption to your "business as usual" that would be caused by a loss of communication lines, power generation, or water shutoffs.
Unexpected utility outages can also potentially damage physical assets, causing a loss of productivity and downtime.
Power outages have been on the rise in the past couple of years . Particularly, the region that got affected the most was the state of California, with hundreds of thousands of customers being affected in April alone . A single power outage event can devastate an organization's revenue, productivity, capacity, and labor. Increasingly, utilities are practicing planned de-energization events, or Public Safety Power Shutoffs (PSPSs). As a last resort to prevent power lines from starting wildfires and putting human lives in danger, planned power outages are scheduled to take place during hot, dry days.
Natural Disasters
A natural disaster describes any weather-related disaster, such as hurricanes, tornadoes, ad tsunamis. It also refers to natural phenomena such as earthquakes, volcanic eruptions, and wildfires.
The worst disasters happen in an instant and are impossible to predict. Any business could experience grave damage to its physical structures and assets.
Natural disasters also disrupt supply chains in affected areas, causing a lack of supply for in-demand items.
Cybersecurity
A cyberattack is a malicious computer-based attack on a technical asset.
Cyberattacks include data theft, ransomware attacks, SQL injections, and distributed denial of services (DDoS) attacks.
If you have the right security measures in place, you may only experience limited IT functionality until the issue is resolved. If you don't have data backup or recovery, you could potentially lose access to valuable business data. We have developed a brief and actionable cybersecurity checklist to help your organization take the first steps to check for any signs that may lead to a data breach or a cyberattack at your organization and develop preventative measures to safeguard your operations.
Steps to Creating a Business Continuity Plan
While creating an effective BCP is a lot of work, it's a critical piece of operating a resilient business.
You, your appointed business continuity team, and your staff must take continuity planning seriously. Here are five steps to help you get started.
Step 1: Assemble a Business Continuity Management Team
The makeup of your team depends on your continuity objectives and the size of your company.
A good BCP should detail what your staff needs to do in the event of a disaster, what communication methods are required, and the timeframe in which critical IT services need to be available.
- Create a contact list of key people involved in your company's BCP, including names, titles, and communication info (both work and personal) such as phone numbers, email addresses.
- Provide a detailed overview of their roles and responsibilities so that everyone knows what is expected of them in an outage event.
- Have a process in place for how your BCP will be updated and how these updates will be communicated to the team.
This team will prepare standards for the project and train additional team members. They will also identify clear processes to improve project flow.
Step 2: Ensure the Safety and Wellbeing of Your Employees
- When planning, you must prepare to prioritize the safety of your employees amid a crisis. They will look to you, their community, and the government for guidance. Be proactive and transparently address their concerns. Right now, many companies have to decide to initiate or expand remote work arrangements and other policies that allow employees to work flexibly.
- Depending on your industry, you'll want to reallocate resources and reorganize teams, as well as establish employee wellbeing programs and procedures that support a safe working environment .
- Make sure you have proper communication channels in place to get in touch with all of your employees at the same time. Sending an email may not be sufficient if the wifi is down. Consider implementing a BC Planning software with an integrated emergency messaging tool to ensure all business processes are continuous, and everyone is safe. Communicate with your teams early and regularly. You want to engage your employees as you navigate through the current crisis.
Reimagining your usual business environment while minimizing disruptions requires a delicate balance. In some situations, telecommuting and flexible work arrangements aren't possible. In scenarios during which you'll have workers in direct contact with customers, you must prepare to provide personal protective equipment.
Step 3: Understand the Risks to Your Company
Once your business continuity management team is assembled, you must conduct a business impact analysis (BIA).
This type of analysis will help you identify specific threats to financial performance, operations, supply chains, reputation, employees. It can serve as a starting point when identifying risks.
You and your team should brainstorm a list of threats and potential risks to your business. Then discuss how the risks mentioned above could affect business operations.
Don't undermine the importance of this step—or how long it could take. A proper BIA will typically involve a comprehensive questionnaire to gather the breadth of information you will need. BCP production tools such as Agility Planner help get started with creating a BCP or a BIA and provide access to historical data and ready-to-use templates.
Step 4: Implement Recovery Strategies
Once a disaster occurs, and financial losses begin to grow, it can be challenging to get back on track without a BCP in place. Consider the following questions as you discuss options with your team:
- Do you have a way to get sales, HR, manufacturing, and support personnel back to work after a disaster to continue operating your business?
- How will you continue to meet the demand for products or services if your equipment or facility is damaged?
- If your facilities are impacted, will your employees work remotely at home or from an alternate location?
You'll address concerns like these and more in your business continuity plan.
Address Every Business Function
It's essential not to leave any business function out of your plan. Be sure to address the following:
- Level of risk
- Impact on customers and employees
- How you will communicate with stakeholders
- Financial resources available in the event of a disaster
- Emergency policy creation
- External partners who can work together with you in a mutually-beneficial way.
Set realistic timelines and intentions across your company's resilience journey to ensure you reach your goals and exceed expectations.
As you work through your plan, develop relevant reports to share with all stakeholders. Use highly visual reports to highlight areas that need attention and show progress.
Step 5: Test, Test Again and Make Improvements
No matter how long you spend perfecting it, a business continuity plan is never truly finished—just as the risks and requirements of your industry are never set in stone.
Testing your business continuity plan allows you to validate it as you manage risks. While 88% of companies test their strategies to identify gaps, 63% of them do so to validate their plans.
The result of this testing is not "pass or fail," yet continuous improvement by identifying findings through a live exercise. Prepare your organization for success by using this checklist for business continuity testing.
Prepare for Disruption with a Business Continuity Solution
While you may never encounter a significant disruption to your business, nothing is ever certain. The chances are that you'll have your fair share of hurdles.
Identify risks and what you need to do to keep your business in motion. Planning will give you a competitive edge and help alleviate any financial risk involved.
Sleep easier at night by knowing you have a plan to reduce the impact of business disruptions before, during, and after a disaster occurs. Request a demo today to learn how Agility Central can help your organization remain resilient.
Discover Agility's Software Suite
Agility offers business continuity tools to help you plan, train, and respond to disruptive incidents.
Subscribe to Our Newsletter
Get the latest business continuity news and insights
Central bc platform.
See how Agility is helping more than 4,000 businesses of all sizes across various industries plan, train, test, alert, and recover–all in one central platform.
Related Content
Best Practices to Effectively Respond to & Recover from Disasters
Business Continuity Checklist
Train derailment checklist.
Get the Latest Business Continuity Insights
By clicking the "Subscribe" button you agree to the Terms of Use and Privacy Policy
Cloud Infrastructure
Oracle E-Business Suite
Managed Services
Cloud Applications
Digital Transformation
How to Maintain Business Continuity: 5 Key Strategies
With the current situation, organizations all over the world are looking for ways to mitigate the disruption and keep things as operational as possible. In this blog, we’ll discuss some strategies companies can look into to maintain business continuity.
What is Business Continuity?
According to TechTarget , business continuity is an organization’s ability to maintain essential functions during and after a disaster has occurred. Business continuity planning is important because it establishes risk management processes and procedures that aim to prevent interruptions to mission-critical services, and re-establish full function to the organization as quickly and smoothly as possible.
It also helps companies identify which functions are essential to allocate the available budget accordingly. The plan should enable the organization to keep running at least at a minimal level during a crisis.
Difference Between Business Continuity Plan and Disaster Recovery Plan
As mentioned by the Business Continuity Management Institute or BCM Institute , IT Disaster recovery and business continuity are related but not interchangeable terms. Business continuity is the process of getting the entire organization back to full functionality after a crisis or disaster, whereas disaster recovery is about getting all-important IT infrastructure and operations up and running again.
5 Key Strategies to Maintain Business Continuity
1. Empower your team. As more employees are working remotely, companies need to ensure that their workforce is able to fully leverage the tools available for them. Companies still relying on traditional training methods, should integrate modern training practices that would allow them to create engaging training experiences that ensure employees can be as engaged as possible when working in a remote scenario.
2. Enhance your reporting. Analytics are critical during a disruption of operations like the one we are living in. Data can help predict what might happen during a business interruption by analyzing different types of incidents. They can identify an organization’s vulnerable areas and propose solutions that allow you to closely monitor daily changes in productivity and absenteeism, improve the well-being of your organization and employees, identify business scenarios and the data needed to monitor and manage the impact on areas of business (e.g. supply chain, production, finance, HR, IT), and develop core KPIs and design organizational impact dashboards to enable business impact measuring and tracking.
3. Keep communication constant. Your workforce will look for your guidance during these times. Keeping open and transparent communication, addressing their concerns, and on a regular basis, will help keep them engaged and maintain business continuity.
4. Automate as much as possible. As more employees must start working from home, companies that are trying to drive operational costs down and maintain service levels should really turn to robotics and automation. As we know, RPA technologies can take care of repetitive, rule-based tasks through software robots. By turning to robotics and automation, companies can redeploy their workforce into activities that are more critical and add more value to their clients, while the robots take care of those tasks. On top of this, RPA technologies are not costly, can deliver significant improvements in a short period of time, and are fairly easy to deploy.
5. Provide the necessary tools. Companies need to ensure that they provide the proper software and have a solid infrastructure to support a seamless and secure transition to a fully remote work model. In order to do this, companies might need to quickly acquire new software (Secure video conferencing, collaboration, digital adoption solutions , and document sharing tools) or scale their technology capabilities (additional bandwidth and network capacity).
Subscribe to our blog
- Change Management
- Cloud Managed Services
- AI & Machine Learning
- Data Visualization
- Oracle Analytics Cloud
- Digital Adoption
- Oracle 12.2
- Oracle EPM Cloud
- Oracle HCM Cloud
- Oracle Cloud Infrastructure
- Oracle ERP Cloud
- Oracle Hyperion
- Press Releases
Related Posts
- How to Enable Hyperautomation Using iPaaS
- How to Choose the Right Use Cases for RPA in EBS 12.2.x
- Top 5 Benefits of Robotic Process Automation in your Oracle EBS
- Robotic Process Automation (RPA) in Retail Industry
- RPA in Banking and Financial Industries
CONTACT ITC TODAY
Privacy overview.
- Hubspot Blog
- HubSpot.com
Oh no! We couldn't find anything like that.
Try another search, and we'll give it our best shot.
What Is A Business Continuity Plan? [+ Template & Examples]
Published: December 30, 2022
When a business crisis occurs, the last thing you want to do is panic.
The second-to-last thing you want to do is be unprepared. Crises typically arise without warning. While you shouldn't start every day expecting the worst, you should be relatively prepared for anything to happen.
A business crisis can cost your company a lot of money and ruin your reputation if you don't have a business continuity plan in place. Customers aren't very forgiving, especially when a crisis is influenced by accidents within the company or other preventable mistakes. If you want your company to be able to maintain its business continuity in the face of a crisis, then you'll need to come up with this type of plan to uphold its essential functions.
In this post, we'll explain what a business continuity plan is, give examples of scenarios that would require a business continuity plan, and provide a template that you can use to create a well-rounded program for your business.
Table of Contents:
What is a business continuity plan?
- Business Continuity Types
- Business Continuity vs Disaster Recovery
Business Continuity Plan Template
How to write a business continuity plan.
- Business Continuity Examples
A business continuity plan outlines directions and procedures that your company will follow when faced with a crisis. These plans include business procedures, names of assets and partners, human resource functions, and other helpful information that can help maintain your brand's relationships with relevant stakeholders. The goal of a business continuity plan is to handle anything from minor disruptions to full-blown threats.
For example, one crisis that your business may have to respond to is a severe snowstorm. Your team may be wondering, "If a snowstorm disrupted our supply chain, how would we resume business?" Planning contingencies ahead of time for situations like these can help your business stay afloat when you're faced with an unavoidable crisis.
When you think about business continuity in terms of the essential functions your business requires to operate, you can begin to mitigate and plan for specific risks within those functions.
Business Continuity Planning
Business continuity planning is the process of creating a plan to address a crisis. When writing out a business continuity plan, it's important to consider the variety of crises that could potentially affect the company and prepare a resolution for each.
IV. Strategies and Requirements
1. [Proactive strategies to prevent crises]
2. [Reactive strategies to immediately respond to crises]
3. [Reactive strategies for long-term recovery from the crises]
After conducting your business impact analysis, you should have an understanding of how your business will need to respond to crises when they arise in order to come out on top. Spend a week or so crafting the strategies that will make up your continuity plan, and collaborate with relevant stakeholders.
V. Training and Testing
1. [Training schedule for employees]
2. [Testing schedule]
It's best to test and iterate on your plan multiple times a year to ensure that it's up-to-date with your business needs. Maybe you run through the plan once a quarter to ensure that everyone is on the same page and new hires have the chance to learn along with their experienced peers, or maybe you do scenario run-throughs twice a year.
- Select a business continuity team.
- Define plan objectives.
- Schedule interviews with key players in your departments.
- Identify critical functions and types of threats.
- Conduct risk assessments across each area identified.
- Conduct a Business Impact Analysis.
- Draft the plan.
- Test the plan for gaps.
- Revise based on your findings.
Don't forget to share this post!
Related articles.
Situational Crisis Communication Theory and How It Helps a Business
What Southwest’s Travel Disruption Taught Us About Customer Service
Showcasing Your Crisis Management Skills on Your Resume
![What Is Contingency Planning? [+ Examples]](https://blog.hubspot.com/hubfs/contingency-planning.jpg "suggestions for business continuity plan")
What Is Contingency Planning? [+ Examples]
![What Is Reputational Risk? [+ Real Life Examples]](https://blog.hubspot.com/hubfs/reputational-risk.jpg "suggestions for business continuity plan")
What Is Reputational Risk? [+ Real Life Examples]
10 Crisis Communication Plan Examples (and How to Write Your Own)
Top Tips for Working in a Call Center (According to Customer Service Reps)
![How to Create a Social Media Crisis Management Plan [Free Template]](https://blog.hubspot.com/hubfs/social-media-crisis-management.jpg "suggestions for business continuity plan")
How to Create a Social Media Crisis Management Plan [Free Template]
![Service Reps on the Most Powerful De-Escalation Techniques [Expert Tips + Consumer Data]](https://blog.hubspot.com/hubfs/customer%20service%20rep%20de-escalating%20a%20situation.jpg "suggestions for business continuity plan")
Service Reps on the Most Powerful De-Escalation Techniques [Expert Tips + Consumer Data]
Top 5 Crisis Management Skills for Business Leaders (& How to Apply Them)
Manage, plan for, and communicate during a corporate crisis.
- 10 Year Anniversary
- Mission, Vision, and Values
- Social Impact
- Opportunities
- Hiring Process
Expert opinions, insights and trends from Burnie Group’s industry leaders in management consulting.
Top 13 Priorities for a Strong Business Recovery and Business Continuity Plan
We expect that the COVID-19 pandemic will result in business interruptions for at least six to eight months, with a worst-case scenario of interruptions lasting for twelve to twenty-four months. With that in mind, we are sharing our top ten considerations for planning, developing and executing a business continuity plan and a business recovery plan.
Establish clear succession planning and assignment of authority
Prepare for reductions in resource availability, plan for large swings in demand, establish rules to triage requests, ensure critical systems are redundant, develop remote working capabilities, expand customer self-service options, automate standard tasks, develop remote options to coach and mentor employees, design solutions to maintain strong employee engagement and morale, establish clear channels for internal and external communication, establish back up practices for all essential tasks, maintain reserve funds in case of an emergency.
There are many variables that can occur during a business disruption that require additional funds. An increase in customer demand might require an increase in staff hours, while a decrease in demand might result in a decline in revenue. A natural disaster might require a company to move to a different location. Reserve funds will enable a company to pay for unplanned for expenses in an emergency. Question: Do you have enough funds reserved for a business disruption?
Read more of our insights on business continuity
21 Things Companies Do Wrong When Executing Business Continuity Plans
Work from Home Best Practices
Burnie Group’s COVID-19 Policy
Find out more about how Burnie Group can support your organization.
- Enterprise Risk Management
- Compliance Management
- Business Continuity Management
- Incident Management
- Audit Management
- Vendor Risk Management
- Workplace Health & Safety
- IT & Cyber Risk Management
- IT & Cyber Compliance
- IT Disaster Recovery
- IT & Cyber Security Incident Management
- No Code Solution Development
- Workflows Engine
- Integration Engine
- Document Engine
- News & Blog
- Partner Program
- IT Risk Management
- Custom Application Builder
3 Tips to Improve Your Business Continuity Management
Business continuity management is the process of identifying risks to your organization and exploring solutions. Good business continuity planning involves creating a set of priorities and first steps in response to any incident. It also requires understanding what’s feasible and achievable after an incident. This means business continuity management must be mindful of budgets, resources, and manpower that will be available after a crisis and prioritize how to use those resources most effectively.
Business Continuity Management Best Practices
Standards organizations, like the International Standards Organization , publish guidelines for creating and implementing business continuity management. While these standards provide a fairly regimented and technical guide to how to create a business continuity plan, the key facets of good business continuity management remain the same:
1. Discover and Analyze All Potential Threats
The foundation of all business continuity planning is threat identification and analysis. Your organization could be disrupted in a number of ways, from data breaches to natural disasters . Great business continuity management begins by brainstorming all the possible ways your business could be disrupted.
Nothing is off the table in this phase of planning, and all threats should be included, no matter how unlikely they are. Of course, it’s impossible to guess all the potential threats your organization may face, but addressing business continuity planning from as many angles as possible means you’ll likely have a plan that can adapt to fit almost any challenge you’re thrown. Analyze each of these threats for their likelihood and severity.
2. Conduct a Thorough Business Impact Analysis
After brainstorming and detailing the possible threats your organization might face, the next step is to conduct a business impact analysis to see how it would affect your daily operations and bottom line. Key questions to ask here include:
- How might my supply chain be disrupted?
- Will this limit our access to information?
- Does this put our customers’ information at risk ?
- How long would it take to establish minimum operational ability after such an incident?
- How long would it take to fully recover back to normal operations?
Be honest with your answers. A key element of a business impact analysis is reviewing the feasibility of your response. You’ll need to determine if you have the resources to respond and how long it would take you to gather those resources in a crisis.
3. Create Flexibility in Your Supply Chain and Data Structure
For companies that manufacture or distribute physical goods, creating flexibility means making sure your supply chain is responsive to global conditions. A flood in China or an earthquake in Mexico could throw your whole operation out of line. The key is identifying such weak points and creating agile supply chains that could substitute for a facility that’s shut down.
For companies in client services, the same principle applies to all your data. Make sure you have offsite backups of all your information and have a document management system in place so that an attack on one part of your network doesn’t cripple your whole organization.
Business Continuity Management, Applied
As you plan for crises and natural disasters, you’ll be better prepared to respond to incidents when they arise. With clear priorities about what parts of your organization to restore first, you’ll be backed up and running quickly with minimal hassle.
Ready To Get Started?
Learn how your business can benefit from workflow-driven software today with ReadiNow by requesting a demo.
Download the full case study
Read how one of Australia's largest financial institutions optimised their BCM processes.
You May Also Like
These Stories on Business Continuity Management
Integrating Business Continuity Management (BCM) with GRC Software
ReadiNow Awarded for Continued Innovation in Continuity & Resilience
How to structure your recovery from a cyber attack
Subscribe by email, no comments yet.
Let us know what you think
ReadiNow Corporation
Unit 27, Block B, 1 Maitland Place Baulkham Hills NSW 2153 Call Us: 1800 153 153
Email Us: [email protected]
- Integrated Risk Management
- Digital Transformation Platform
- Business Solutions
- Work With Us
An official website of the United States government
Here’s how you know
Official websites use .gov A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Business Continuity Plan
Business Continuity Planning Process Diagram - Text Version
When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. A business continuity plan to continue business is essential. Development of a business continuity plan includes four steps:
- Conduct a business impact analysis to identify time-sensitive or critical business functions and processes and the resources that support them.
- Identify, document, and implement to recover critical business functions and processes.
- Organize a business continuity team and compile a business continuity plan to manage a business disruption.
- Conduct training for the business continuity team and testing and exercises to evaluate recovery strategies and the plan.
Information technology (IT) includes many components such as networks, servers, desktop and laptop computers and wireless devices. The ability to run both office productivity and enterprise software is critical. Therefore, recovery strategies for information technology should be developed so technology can be restored in time to meet the needs of the business. Manual workarounds should be part of the IT plan so business can continue while computer systems are being restored.
Resources for Business Continuity Planning
- Standard on Disaster/Emergency Management and Business Continuity Programs - National Fire Protection Association (NFPA) 1600
- Professional Practices for Business Continuity Professionals - DRI International (non-profit business continuity education and certification body)
- Continuity Guidance Circular - Federal Emergency Management Agency
- Open for Business® Toolkit - Institute for Business & Home Safety
Business Continuity Impact Analysis
Business continuity impact analysis identifies the effects resulting from disruption of business functions and processes. It also uses information to make decisions about recovery priorities and strategies.
The Operational & Financial Impacts worksheet can be used to capture this information as discussed in Business Impact Analysis . The worksheet should be completed by business function and process managers with sufficient knowledge of the business. Once all worksheets are completed, the worksheets can be tabulated to summarize:
- the operational and financial impacts resulting from the loss of individual business functions and process
- the point in time when loss of a function or process would result in the identified business impacts
Those functions or processes with the highest potential operational and financial impacts become priorities for restoration. The point in time when a function or process must be recovered, before unacceptable consequences could occur, is often referred to as the “Recovery Time Objective.”
Resource Required to Support Recovery Strategies
Recovery of a critical or time-sensitive process requires resources. The Business Continuity Resource Requirements worksheet should be completed by business function and process managers. Completed worksheets are used to determine the resource requirements for recovery strategies.
Following an incident that disrupts business operations, resources will be needed to carry out recovery strategies and to restore normal business operations. Resources can come from within the business or be provided by third parties. Resources include:
- Office space, furniture and equipment
- Technology (computers, peripherals, communication equipment, software and data)
- Vital records (electronic and hard copy)
- Production facilities, machinery and equipment
- Inventory including raw materials, finished goods and goods in production.
- Utilities (power, natural gas, water, sewer, telephone, internet, wireless)
- Third party services
Since all resources cannot be replaced immediately following a loss, managers should estimate the resources that will be needed in the hours, days and weeks following an incident.
Conducting the Business Continuity Impact Analysis
The worksheets Operational and Financial Impacts and Business Continuity Resource Requirements should be distributed to business process managers along with instructions about the process and how the information will be used. After all managers have completed their worksheets, information should be reviewed. Gaps or inconsistencies should be identified. Meetings with individual managers should be held to clarify information and obtain missing information.
After all worksheets have been completed and validated, the priorities for restoration of business processes should be identified. Primary and dependent resource requirements should also be identified. This information will be used to develop recovery strategies.
Recovery Strategies
If a facility is damaged, production machinery breaks down, a supplier fails to deliver or information technology is disrupted, business is impacted and the financial losses can begin to grow. Recovery strategies are alternate means to restore business operations to a minimum acceptable level following a business disruption and are prioritized by the recovery time objectives (RTO) developed during the business impact analysis .
Recovery strategies require resources including people, facilities, equipment, materials and information technology. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps. For example, if a machine fails but other machines are readily available to make up lost production, then there is no resource gap. However, if all machines are lost due to a flood, and insufficient undamaged inventory is available to meet customer demand until production is restored, production might be made up by machines at another facility—whether owned or contracted.
Strategies may involve contracting with third parties, entering into partnership or reciprocal agreements or displacing other activities within the company. Staff with in-depth knowledge of business functions and processes are in the best position to determine what will work. Possible alternatives should be explored and presented to management for approval and to decide how much to spend.
Depending upon the size of the company and resources available, there may be many recovery strategies that can be explored.
Utilization of other owned or controlled facilities performing similar work is one option. Operations may be relocated to an alternate site - assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to assume the work of the impacted site. Prioritization of production or service levels, providing additional staff and resources and other action would be needed if capacity at the second site is inadequate.
Telecommuting is a strategy employed when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters have a suitable home work environment and are equipped with or have access to a computer with required applications and data, peripherals, and a secure broadband connection.
In an emergency, space at another facility can be put to use. Cafeterias, conference rooms and training rooms can be converted to office space or to other uses when needed. Equipping converted space with furnishings, equipment, power, connectivity and other resources would be required to meet the needs of workers.
Partnership or reciprocal agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation and allocating expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. Periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.
There are many vendors that support business continuity and information technology recovery strategies. External suppliers can provide a full business environment including office space and live data centers ready to be occupied. Other options include provision of technology equipped office trailers, replacement machinery and other equipment. The availability and cost of these options can be affected when a regional disaster results in competition for these resources.
There are multiple strategies for recovery of manufacturing operations. Many of these strategies include use of existing owned or leased facilities. Manufacturing strategies include:
- Shifting production from one facility to another
- Increasing manufacturing output at operational facilities
- Retooling production from one item to another
- Prioritization of production—by profit margin or customer relationship
- Maintaining higher raw materials or finished goods inventory
- Reallocating existing inventory, repurchase or buyback of inventory
- Limiting orders (e.g., maximum order size or unit quantity)
- Contracting with third parties
- Purchasing business interruption insurance
There are many factors to consider in manufacturing recovery strategies:
- Will a facility be available when needed?
- How much time will it take to shift production from one product to another?
- How much will it cost to shift production from one product to another?
- How much revenue would be lost when displacing other production?
- How much extra time will it take to receive raw materials or ship finished goods to customers? Will the extra time impact customer relationships?
- Are there any regulations that would restrict shifting production?
- What quality issues could arise if production is shifted or outsourced?
- Are there any long-term consequences associated with a strategy?
Resources for Developing Recovery Strategies
- The Telework Coalition (America’s leading nonprofit telework education and advocacy organization)
Manual Workarounds
Telephones are ringing and customer service staff is busy talking with customers and keying orders into the computer system. The electronic order entry system checks available inventory, processes payments and routes orders to the distribution center for fulfillment. Suddenly the order entry system goes down. What should the customer service staff do now? If the staff is equipped with paper order forms, order processing can continue until the electronic system comes back up and no phone orders will be lost.
The order forms and procedures for using them are examples of “manual workarounds.” These workarounds are recovery strategies for use when information technology resources are not available.
Developing Manual Workarounds
Identify the steps in the automated process - creating a diagram of the process can help. Consider the following aspects of information and work flow:
Internal Interfaces (department, person, activity and resource requirements)
- External Interfaces (company, contact person, activity and resource requirements)
- Tasks (in sequential order)
- Manual intervention points
Create data collection forms to capture information and define processes for manual handling of the information collected. Establish control logs to document transactions and track their progress through the manual system.
Manual workarounds require manual labor, so you may need to reassign staff or bring in temporary assistance.
Last Updated: 05/26/2021
Return to top
- Help Center
Ecommerce Business Continuity Planning: 7 Steps to Assess Risk and Plan for the Unexpected
Get The Print Version
Tired of scrolling? Download a PDF version for easier offline reading and sharing with coworkers.
Share this article
IMAGES
VIDEO
COMMENTS
Anatomy of a business continuity plan · Identify the scope of the plan. · Identify key business areas. · Identify critical functions. · Identify dependencies
1. Identify Potential Threats · 2. Identify Potential Outcomes · 3. Build a Recovery Team · 4. Create a Recovery Plan · 5. Train Employees.
The Office of Information Security strongly recommends that all units have a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) for critical
Steps to Creating a Business Continuity Plan · Step 1: Assemble a Business Continuity Management Team · Step 2: Ensure the Safety and Wellbeing of
Business continuity planning is important because it establishes risk management processes and procedures that aim to prevent interruptions to
Select a business continuity team. Define plan objectives. Schedule interviews with key players in your departments. Identify critical functions
Top 13 Priorities for a Strong Business Recovery and Business Continuity Plan · Establish clear succession planning and assignment of authority · Prepare for
Business Continuity Management Best Practices · 1. Discover and Analyze All Potential Threats · 2. Conduct a Thorough Business Impact Analysis · 3. Create
Organize a business continuity team and compile a business continuity plan to manage a business disruption. Conduct training for the business
Creating Your Ecommerce Business Continuity Plan · 1. Identify objectives and goals of the plan. · 2. Establish an emergency preparedness team. · 3. Perform a risk