6 steps for creating a business continuity plan

How to make your business more robust

When we think of disasters, often our minds will shift to the big ones: earthquakes, floods and more recently, global pandemics. But for companies, a disaster could be a power outage, cyberattack or breakdown of critical business processes – essentially, anything that stops them from operating.

Should the worst happen, businesses need to have a plan to deal with them. However, our Future Ready Report found that many companies don’t –17% lack any form of business continuity plan, rising to 19% without a disaster recovery plan.

Without an effective, reliable plan in place, even the most successful businesses can struggle to recover. So, to ensure that your business can keeping running through the most challenging events, we’ve created a simple guide to help you build a bulletproof business continuity plan.

But, first, what exactly is a business continuity plan (BCP)?

Business continuity refers to the maintaining of a business’s functions or quickly resuming them in the event of a severe disruption, such as a cyberattack or natural disaster. A BCP outlines the actions business leaders and their employees must take to keep an organisation running throughout such events.

Here are our six steps to create a plan that will help keep your business robust during adverse times.

It’s important to create a central business continuity management team – but one that is comprised of key leaders from across the business. This will ensure that in an emergency, each part of your company has a leader that can help to guide the way.

As we all know, there is much more to a business than the goods and services it sells. There will be critical business infrastructure, processes and functions that need to be accounted for when creating a BCP, such as human resources, operations, IT and so on.

Once you and your team have defined the BCP’s scope, the next order of business will be identifying the key objectives of the plan. Every business is different, so these objectives will be relative to how your organisation operates. Your objectives will guide your business impact analysis (more on that later) as well as help form your recovery strategy.

       3. Conduct a business impact analysis

With your scope and objectives identified, the next step in preparing your BCP is to understand what types of risk your business may face in an emergency. These risks could differ in nature, be it financial, operational or physical, with each event posing different forms of risk from the next.

For example, cyberattacks are likely to pose more financial and operational risk than physical risk. As such, your plan needs to reflect the risks that different events can present.

Key to identifying these risks is through business impact analysis (BIA). The fundamental purpose of BIA is to help you identify specific risks and what danger they could bring.

Brainstorm with your business continuity management team to form a list of risks to your business, discussing how severe each risk is and how they could potentially affect your business’s operations.

        4. Identify required resources

Through BIA, you will have now identified and assessed potential risks that face your company in the wake of a disaster. It is likely that your analysis will expose discrepancies between the resources your business currently has and the resources your business will need to maintain operations in the event of an emergency.

With these discrepancies identified, the next step is to invest in the required additional resources to ensure your business remains functional in the midst of a disaster or at least swiftly recover from it.

These resources could be specific equipment needed to maintain operations such as rented delivery vehicles, or a contingency location such as a conference centre or rented facility.

        5. Establish recovery procedures

While knowing what risks face your business is critical, it is equally important to know the practical steps you should follow to recover after an unanticipated, damaging event.

Again, it’s essential that you have additional resources in place that can act as back-up in case of an emergency. This could be spare equipment such as computers or laptops, an off-premise service housing your business’s critical information (cloud or data centre), or an alternative location in case your primary workspace in made inaccessible due to a disaster such as flooding or a fire.

        6. Testing and training

Once your plan is formed and the required recovery resources are in place, the final step in establishing your BCP is testing it and training your employees to implement it effectively.

No risk is ever the same, with each emergency situation being different from the last. It’s therefore critical to thoroughly and continuously test your BCP to expose any weaknesses that may have not been accounted for or which may emerge over time. This will help to identify where your plan can be improved.

What’s more, a BCP cannot be effective if your employees are not able to action the plan from start to finish. With each business function potentially needing different protocols, it’s crucial that each department is aware of the relative actions they must take in the case of an emergency.

Disasters or unforeseen events are an aspect all business leaders must contend with. With the correct preparation and resources in place, your BCP can help your business stay robust just like the 68% of businesses we surveyed who said their BCP was effective when faced with an unforeseen event.