Business Continuity Plan | Ready.gov (2022)

Business Continuity Plan | Ready.gov (1)

Business Continuity Planning Process Diagram - Text Version

When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. A business continuity plan to continue business is essential. Development of a business continuity plan includes four steps:

  • Conduct a business impact analysis to identify time-sensitive or critical business functions and processes and the resources that support them.
  • Identify, document, and implement to recover critical business functions and processes.
  • Organize a business continuity team and compile a business continuity plan to manage a business disruption.
  • Conduct training for the business continuity team and testing and exercises to evaluate recovery strategies and the plan.

Information technology (IT) includes many components such as networks, servers, desktop and laptop computers and wireless devices. The ability to run both office productivity and enterprise software is critical. Therefore, recovery strategies for information technology should be developed so technology can be restored in time to meet the needs of the business. Manual workarounds should be part of the IT plan so business can continue while computer systems are being restored.

(Video) What is a Business Continuity Plan? PM in Under 5

Resources for Business Continuity Planning

Business Continuity Impact Analysis

Business continuity impact analysis identifies the effects resulting from disruption of business functions and processes. It also uses information to make decisions about recovery priorities and strategies.

The Operational & Financial Impacts worksheetcan be used to capture this information as discussed in Business Impact Analysis. The worksheet should be completed by business function and process managers with sufficient knowledge of the business. Once all worksheets are completed, the worksheets can be tabulated to summarize:

  • the operational and financial impacts resulting from the loss of individual business functions and process
  • the point in time when loss of a function or process would result in the identified business impacts

Those functions or processes with the highest potential operational and financial impacts become priorities for restoration. The point in time when a function or process must be recovered, before unacceptable consequences could occur, is often referred to as the “Recovery Time Objective.”

Resource Required to Support Recovery Strategies

Recovery of a critical or time-sensitive process requires resources. The Business Continuity Resource Requirements worksheet should be completed by business function and process managers. Completed worksheets are used to determine the resource requirements for recovery strategies.

Following an incident that disrupts business operations, resources will be needed to carry out recovery strategies and to restore normal business operations. Resources can come from within the business or be provided by third parties. Resources include:

(Video) What is Business Continuity Planning (BCP)?

  • Employees
  • Office space, furniture and equipment
  • Technology (computers, peripherals, communication equipment, software and data)
  • Vital records (electronic and hard copy)
  • Production facilities, machinery and equipment
  • Inventory including raw materials, finished goods and goods in production.
  • Utilities (power, natural gas, water, sewer, telephone, internet, wireless)
  • Third party services

Since all resources cannot be replaced immediately following a loss, managers should estimate the resources that will be needed in the hours, days and weeks following an incident.

Conducting the Business Continuity Impact Analysis

The worksheets Operational and Financial Impactsand Business Continuity Resource Requirements should be distributed to business process managers along with instructions about the process and how the information will be used. After all managers have completed their worksheets, information should be reviewed. Gaps or inconsistencies should be identified. Meetings with individual managers should be held to clarify information and obtain missing information.

After all worksheets have been completed and validated, the priorities for restoration of business processes should be identified. Primary and dependent resource requirements should also be identified. This information will be used to develop recovery strategies.

Recovery Strategies

If a facility is damaged, production machinery breaks down, a supplier fails to deliver or information technology is disrupted, business is impacted and the financial losses can begin to grow. Recovery strategies are alternate means to restore business operations to a minimum acceptable level following a business disruption and are prioritized by the recovery time objectives (RTO) developed during the business impact analysis.

Recovery strategies require resources including people, facilities, equipment, materials and information technology. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps. For example, if a machine fails but other machines are readily available to make up lost production, then there is no resource gap. However, if all machines are lost due to a flood, and insufficient undamaged inventory is available to meet customer demand until production is restored, production might be made up by machines at another facility—whether owned or contracted.

Strategies may involve contracting with third parties, entering into partnership or reciprocal agreements or displacing other activities within the company. Staff with in-depth knowledge of business functions and processes are in the best position to determine what will work. Possible alternatives should be explored and presented to management for approval and to decide how much to spend.

(Video) How to write a business continuity plan

Depending upon the size of the company and resources available, there may be many recovery strategies that can be explored.

Utilization of other owned or controlled facilities performing similar work is one option. Operations may be relocated to an alternate site - assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to assume the work of the impacted site. Prioritization of production or service levels, providing additional staff and resources and other action would be needed if capacity at the second site is inadequate.

Telecommuting is a strategy employed when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters have a suitable home work environment and are equipped with or have access to a computer with required applications and data, peripherals, and a secure broadband connection.

In an emergency, space at another facility can be put to use. Cafeterias, conference rooms and training rooms can be converted to office space or to other uses when needed. Equipping converted space with furnishings, equipment, power, connectivity and other resources would be required to meet the needs of workers.

Partnership or reciprocal agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation and allocating expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. Periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.

There are many vendors that support business continuity and information technology recovery strategies. External suppliers can provide a full business environment including office space and live data centers ready to be occupied. Other options include provision of technology equipped office trailers, replacement machinery and other equipment. The availability and cost of these options can be affected when a regional disaster results in competition for these resources.

There are multiple strategies for recovery of manufacturing operations. Many of these strategies include use of existing owned or leased facilities. Manufacturing strategies include:

(Video) Business continuity planning

  • Shifting production from one facility to another
  • Increasing manufacturing output at operational facilities
  • Retooling production from one item to another
  • Prioritization of production—by profit margin or customer relationship
  • Maintaining higher raw materials or finished goods inventory
  • Reallocating existing inventory, repurchase or buyback of inventory
  • Limiting orders (e.g., maximum order size or unit quantity)
  • Contracting with third parties
  • Purchasing business interruption insurance

There are many factors to consider in manufacturing recovery strategies:

  • Will a facility be available when needed?
  • How much time will it take to shift production from one product to another?
  • How much will it cost to shift production from one product to another?
  • How much revenue would be lost when displacing other production?
  • How much extra time will it take to receive raw materials or ship finished goods to customers? Will the extra time impact customer relationships?
  • Are there any regulations that would restrict shifting production?
  • What quality issues could arise if production is shifted or outsourced?
  • Are there any long-term consequences associated with a strategy?

Resources for Developing Recovery Strategies

Manual Workarounds

Telephones are ringing and customer service staff is busy talking with customers and keying orders into the computer system. The electronic order entry system checks available inventory, processes payments and routes orders to the distribution center for fulfillment. Suddenly the order entry system goes down. What should the customer service staff do now? If the staff is equipped with paper order forms, order processing can continue until the electronic system comes back up and no phone orders will be lost.

The order forms and procedures for using them are examples of “manual workarounds.” These workarounds are recovery strategies for use when information technology resources are not available.

Developing Manual Workarounds

Identify the steps in the automated process - creating a diagram of the process can help. Consider the following aspects of information and work flow:

Internal Interfaces (department, person, activity and resource requirements)

(Video) Business Continuity Planning Basics

  • External Interfaces (company, contact person, activity and resource requirements)
  • Tasks (in sequential order)
  • Manual intervention points

Create data collection forms to capture information and define processes for manual handling of the information collected. Establish control logs to document transactions and track their progress through the manual system.

Manual workarounds require manual labor, so you may need to reassign staff or bring in temporary assistance.

FAQs

What are the 5 components of a business continuity plan? ›

In order to achieve this, every business continuity plan needs to incorporate five key elements.
  • Risks and potential business impact. ...
  • Planning an effective response. ...
  • Roles and responsibilities. ...
  • Communication. ...
  • Testing and training.
6 Jul 2020

What is business continuity plan PDF? ›

Business Continuity Planning is used to create a. detailed plan for how an organization will be able to face. disasters without hampering their operations or without. incurring too much loss.

Why do you need business continuity plan answer? ›

The importance of a business continuity plan

Communication between employees and customers. Workflow operations essential to business activity. Customer service response, especially if you are a service provider. Business security, keeping your data and information secured wherever you and your team find yourself ...

What are the 3 main areas of business continuity management? ›

Three key components of a business continuity plan

A business continuity plan has three key elements: Resilience, recovery and contingency.

How do you write a BCP? ›

This involves six general steps:
  1. Identify the scope of the plan.
  2. Identify key business areas.
  3. Identify critical functions.
  4. Identify dependencies between various business areas and functions.
  5. Determine acceptable downtime for each critical function.
  6. Create a plan to maintain operations.
18 Jul 2017

How do you make a BCP plan? ›

Steps to Creating a Business Continuity Plan
  1. Step 1: Assemble a Business Continuity Management Team. ...
  2. Step 2: Ensure the Safety and Wellbeing of Your Employees. ...
  3. Step 3: Understand the Risks to Your Company. ...
  4. Step 4: Implement Recovery Strategies. ...
  5. Step 5: Test, Test Again and Make Improvements.
28 Sept 2020

Who is responsible for business continuity plan? ›

Business unit leaders (i.e. payroll, corporate travel, physical security, information security, HR) are responsible for creating their respective unit's business continuity plan under the guidance of the program manager.

What is the BCM lifecycle? ›

Basically, the business continuity management lifecycle has six phases to it: program management, understanding the organization, determining the BCM strategy, developing and implementing a BCM response, exercising the response, as well as maintaining, reviewing and embedding BCM in the organization's culture.

What is the objective of a BCP? ›

The objectives of a business continuity plan (BCP) are to minimize financial loss to the institution; continue to serve customers and financial market participants; and mitigate the negative effects disruptions can have on an institution's strategic plans, reputation, operations, liquidity, credit quality, market ...

What is business continuity and why is it important? ›

Business continuity is a proactive plan to avoid and mitigate risks associated with a disruption of operations. It details steps to be taken before, during and after an event to maintain the financial viability of an organization. Disaster recovery is a reactive plan for responding after an event.

What is the most important part of business continuity management? ›

One of the most important tasks in managing your BCP is assessing the company's unique risks. This risk assessment is critical in determining the company's vulnerabilities and how they relate to a potential disruption in operations. Each business has its own risks.

What are the 4 main components of the BCM Programme management? ›

At MHA, we divide up the Business Continuity Management (BCM) program into four (4) key dimensions that include:
  • Program Administration.
  • Crisis Management.
  • Business Recovery.
  • IT Disaster Recovery.
28 May 2013

What are the 7 steps of continuity management? ›

7 Steps to an Effective Business Continuity Strategy
  • Step 1 – Find the right partner. ...
  • Step 2 – Conduct a risk assessment to identify potential threats. ...
  • Step 3 – Complete a business impact analysis. ...
  • Step 4 – Design and develop policies and standards. ...
  • Step 5 – Create contingency plans. ...
  • Step 6 – Test and implement.

What is risk assessment in BCP? ›

What is a Risk Assessment? Completing a Risk Assessment is the first step in developing a Business Continuity Plan (BCP) for your critical functions and services. The Risk Assessment identifies the probability of risks to an organization and evaluates the impacts if these risks develop into an emergency.

What is the first step of BCP? ›

Step 1: Risk Assessment

Evaluation of the company's risks and exposures. Assessment of the potential impact of various business disruption scenarios. Determination of the most likely threat scenarios. Assessment of telecommunication recovery options and communication plans.

How long does IT take to create a business continuity plan? ›

The location, type, and size of your company will dictate how long it takes for you to create an effective business continuity plan. While it's possible for some smaller businesses and startups to create one of these plans in as little as one week, other businesses can take upwards of two months to complete the plan.

Is it not mandatory to test a business continuity plan? ›

So, once an organization develops a Business Continuity Plan it is crucial to test its effectiveness. Testing the Plan verifies the effectiveness of the strategy in place and trains responsible personnel for the real scenario. Moreover, the test helps identify areas of concern where the plan needs to be strengthened.

How often should a business continuity plan be tested? ›

Two times a year, conduct a high-level check that objectives are still being met by the current BCP. If you find gaps, correct the plan and recirculate to all stakeholders.

How many key phases are in the business continuity plan? ›

Companies must separate business continuity planning into three phases: planning and prevention (resolve phase), disaster response (respond phase) and, return to normal (rebuild phase).

What is the third phase of the BCP? ›

Phase 3: Design your strategy

Consider everything you'll need to protect your people, your assets and you're your functions. Start by comparing your current recovery capabilities to your business requirements and how you will fill that gap.

What are the 5 main benefits of BCM? ›

For example, it will:
  • 1) Protect your organisation's reputation. The public will be impressed if you can respond quickly and efficiently following a disruptive incident. ...
  • 2) Boost employees' morale. ...
  • 3) Build your relationship with third parties and subsidiaries. ...
  • 4) Help you meet regulatory requirements.
24 Feb 2022

What is another word for business continuity? ›

Contingency and/or contingency planning is basically a synonym for BCM.

What are the stages of business continuity? ›

The 4 phases of a business continuity plan
  • Initial response.
  • Relocation.
  • Recovery.
  • Restoration.
2 Nov 2018

What are the objectives of a business continuity plan? ›

The objectives of a business continuity plan (BCP) are to minimize financial loss to the institution; continue to serve customers and financial market participants; and mitigate the negative effects disruptions can have on an institution's strategic plans, reputation, operations, liquidity, credit quality, market ...

What is the most important step in business continuity planning? ›

Identify objectives and goals of the plan.

At the highest level, the objective of creating a business continuity plan is to keep essential business processes running or minimize disruption. But every business is different — so you'll need to identify the goals and objectives most important to the way you operate.

What is the first step of a business continuity plan BCP )? ›

The first step to creating a business continuity plan is understanding what business processes you need to be worried about. Critical business processes are those that are necessary for the survival of the company due to—for example—loss of revenue, customer service interruption or brand damage (just to name a few).

Who is responsible for business continuity plan? ›

Business unit leaders (i.e. payroll, corporate travel, physical security, information security, HR) are responsible for creating their respective unit's business continuity plan under the guidance of the program manager.

Videos

1. Ready.gov - Business Continuity Training Introduction
(FEMA)
2. Ready.gov - Business Continuity Training Part 1: What is Business Continuity Planning?
(FEMA)
3. Ready.gov - Business Continuity Training Part 3: Planning Process Step 1
(FEMA)
4. Business Continuity Plan (BCP)
(Hitendrakumar Shah)
5. Business Continuity Planning
(GraVoc)
6. Disaster recovery plan & Business continuity plan
(KnowledgeCity)

Top Articles

You might also like

Latest Posts

Article information

Author: Manual Maggio

Last Updated: 09/29/2022

Views: 5283

Rating: 4.9 / 5 (69 voted)

Reviews: 92% of readers found this page helpful

Author information

Name: Manual Maggio

Birthday: 1998-01-20

Address: 359 Kelvin Stream, Lake Eldonview, MT 33517-1242

Phone: +577037762465

Job: Product Hospitality Supervisor

Hobby: Gardening, Web surfing, Video gaming, Amateur radio, Flag Football, Reading, Table tennis

Introduction: My name is Manual Maggio, I am a thankful, tender, adventurous, delightful, fantastic, proud, graceful person who loves writing and wants to share my knowledge and understanding with you.