To many people a Business Continuity Plan (BCP) is a ‘tick the box’ process following a well-defined formal structure, but is this the right way to do it? The answer is ‘no’. The reality is that there are several key steps involved in the development of a BCP, and it ought to be defined as a framework for creating continuity capabilities, and not necessarily as just a detailed process that produces an end document. With this in mind here are the 5 key stages to developing a BCP, which we shall take in turn:

 

Stage 1: Understand your organisation’s priorities

Firstly, you need to undertake a Business Impact Assessment (BIA). This takes into consideration the operational priorities of your organisation, how these priorities would be impacted by a range of disruptions (loss of IT systems, loss of workplace, loss of staff availability etc.), and how quickly the organisation would need to recover before those exposures would become unacceptable (i.e. before the situation developed into a full-blown crisis).

 

Stage 2: Understand your current capabilities & available resources

Next, you need to commence a GAP analysis. Therefore, having understood what you need to be able to do, you then need to establish whether your organisation has the intrinsic capabilities to achieve it. This will answer questions like:

  • Could we continue to work as an organisation if our normal place of work was unavailable?
  • Could we recover our IT systems in sufficient time to mitigate financial losses, meet contractual obligations, and importantly, maintain customer goodwill?
  • Do we have sufficient flexibility within our workforce to respond to a significant event that affects the company?
  • Do we have the resources to accommodate alternative working practices?

 

Stage 3: Develop Response & Recovery Plans

In developing the plans it is important to not to make them  too document heavy, as they’re hard to follow and will tend not to be used. Plans should be written as a guidance of key activities to be undertaken in exceptional circumstances. In highly pressurised environments, Checklists and Visual Aids are much easier to use.

For most organisations detailed plans are only required for critical functions within the organisation for, for example, those people who will be directly involved with the overall incident management. The majority of your employees just need to know what to do, and where to get information from, during a major incident.

 

Stage 4: Build the Business Continuity Organisation

There are two main aspects for the organisation to focus on when developing the BCP:

  1. The establishment of a Business Continuity Steering Committee. They role is to ensure that business continuity capabilities remain relevant to the organisation’s requirements, and can be relied upon if activated.
  2. The training and understanding of key individuals who will collectively respond when an incident occurs, and adopt specific roles to manage the incident

 

Stage 5: Oversight & Assurance

These processes ensure that the resources and plans can be relied upon during a major incident. These should include:

  • Periodically review the company’s capabilities, and available resources, to confirm that the plans are still in line with organisation’s objectives.
  • Initiating a Change Management Process to ensure critical activities are updated and stay relevant to changes happening within the business.
  • Failover testing of IT to make sure they can be recovered within the required timeframes and to gain assurances that these capabilities are still working correctly.
  • Regular remote working “stress” tests to ensure that the offsite access capabilities are capable of supporting your staff during an incident; these could be carried out in your designated work area recovery facilities.

To conclude, these five steps are key in establishing business continuity capability for any organisation. The objective of a BCP is not the production of a weighty document, but an ongoing activity with a goal of building and maintaining resilience and recoverability if an unforeseen event occurs – as we have recently seen with the Covid-19 pandemic.

Lastly, if, after reading this, you feel need for some assistance in putting together a BCP, then contact ADAM Continuity. With over 25 years of experience in supporting hundreds of organisations, we are the trusted experts that you can rely upon. Click here for more information.