Business continuity planning for small businesses

Just starting your first business continuity plan? Cole Seger provides some pointers.

Over the past years, business continuity has been becoming an increasing concern for organizations of all sizes. If a business can’t continue, it can’t generate income. This is a static concept across all organizations. Having a business continuity plan (BCP) creates security for the continuation of business processes, IT operations, administrative operations, and financial incomes.

A business continuity plan is NOT a disaster response plan. These are not steps to take during the actual disaster event, but rather steps to take after the emergency to return towards normal business operations. The purpose of the plan is due to normal operations not being as easy to return to as you might think. Dependent on the event, you may no longer have some of your most vital resources.

Creating a business continuity plan isn’t always an easy process. Small business owners may understand the importance of having one but it may be difficult for them to understand exactly how to go about creating one or obtaining buy in from employees. To create a useful plan it requires that all employees play a role in the creation process, as well as in the maintenance of the plans.

Before even starting a business continuity plan it is important to outline a plan of action:
First determine how many plans you are going to have for your organization. Most organizations have broken there plans down by department, but there are some who elect to create one ‘umbrella’ plan.

The next step is to create the template for your plan. Have each employee task out each critical function that they perform, and categorize your plan based off of employee positions. Another way is to simply outline each critical function within the department and have a designated business continuity manager, or team, who, after a disaster or event, would be in charge of ensuring that each critical function is performed. Once this has been decided you must obtain buy in from employees for the creation of the plan. It is important to stress to them that their job is their livelihood and if the organization cannot operate then they will lose their livelihood. Buy in is vital because to create a successful plan it will require that the employees themselves detail what it is they do on a normal basis and how they would perform these functions should there be a loss of vital resources.

The best way to have your critical functions detailed is to have employees first write down a list of all of the critical functions that they would absolutely need to perform within a 48 hour period (this may vary). I normally use a 48 hr. period because this will help them to understand that it may not be necessary to write down every single function that they perform. You do not want to over complicate the plan to the point that it becomes confusing or inefficient during a recovery period.

After they create this list, have them detail all the necessary resources to perform each of those functions. Once this is done, start asking them how they would perform the functions with each of those original resources unavailable. This will in essence be your continuity plan. It will become a detailing of how to perform each function on a regular basis, as well as how to perform them when the primary resources are no longer available.

Another key feature of a business continuity plan is alternative resources. Will you have alternative office supplies, facilities, computers, etc.? It isn’t always necessary or cost efficient to have these alternative resources purchased and waiting off-site but it is good to detail within your plan where and how you will obtain these resources in the event of a disaster. This may include a section of your plan dedicated to vendor contacts for obtaining all your necessary resources. Not only is this useful in the fact that you now have a listing of where to obtain all resources but it also works as a checklist reminder of all of the resources that you would need to consider.

Included in the resource section can be all facility needs and ‘show stopper’ resources. It isn’t always necessary to even have a facility for a short term period. Make a list of all employees who have the ability to work from home. For the ones who can’t, have a recovery site in mind to relocate them to for a short period of time. Show stoppers are resources that your operations absolutely can’t continue without (computers, phones, network connections etc). Within the resources section it may also be useful to add all contact information for any clients or vendors. You may no longer have access to these items if the event keeps you from accessing your offices. Having them listed will act as a checklist which can be utilized to determine which ones would need to be made aware of your current situation. Do NOT require that all vendors and clients be contacted as whether or not they should be contacted may depend on the seriousness of the event.

Now that you have the critical functions and resources detailed and all of the departmental contacts listed, it is time to organize your plan into a format that can be easily followed. It can be suggested to break your critical functions up by each department. Should a department need to recover from an event they can simply go to their section and utilize it as a checklist to ensure that all operations are continued. A good plan can also be used in instances that are not disaster events. Should there be a change in a departmental employee; the newly designated employee can use this section as a reference into the critical tasks that they are to be performing on a daily basis.

Plans can be broken down into four key sections; Recovery Procedures, Departmental Overview, Critical Functions, and Key Resources. The recovery procedures section should detail how to go about utilizing the other three sections. It is also beneficial to designate a team of business continuity coordinators who will be the focal contacts for each department during a recovery period. This will help to organize and centralize all recovery efforts.

Once your plans have been completed, it is time for simulations. These can be simple table-top exercises in which each department is given a scenario and tasked with utilizing their plan to determine how to regain functioning. The best way to test a whole plan is to give a scenario that takes away their most vital resources. A fire in the building which will cause them to be unable to enter the premises for a month would work as a fine and realistic scenario. Have them run through how they will go about normal operations without access to their building. Where will they operate from? Where and how do they obtain the necessary resources? Who do they need to communicate with? Be sure to keep notes of how well each department performs. This will be useful for the third step in business continuity creation; Maintenance.

Maintenance is the final stage in good business continuity planning. After the simulation you will probably find that many things were missing from your plan. It is usually very difficult for employees to think of everything they will need until they are put into a scenario in which they no longer have that resource. A business continuity plan will really become complete once it has been tried and tested in a real scenario. That is when you will see what the critical functions and necessary resources truly are for each department.

Be sure to have employees keep an activity tracking sheet during any scenario or simulation. This will help during maintenance periods for your plans. After Action Reviews (AAR) may also be beneficial. Asking employees what worked, what didn’t work, and what resources were you lacking can help create a more useful plan. During plan creation be sure to not over complicate procedures to the point that the plan is overwhelming and not useful. Be sure to make it easy enough for someone outside of the department to follow.

By following this basic plan of action towards the creation of a business continuity plan, you will be ensuring continued operations for both your employees and business alike. Remember to always keep additional copies of your plan off-site from your offices for easy access during and emergency.

Author: Cole Seger, Purdue University, BS, Forensic Biology, IUPUI-MS, Public Safety and Criminal Justice Certificate in Homeland Security and Emergency Management. Current Work: Corporate Facilities Document and BCP Coordinator, Allied Solutions.

Contact: cole.seger@alliedsolutions.net

•Date: 3rd Oct 2012 • US/World •Type: Article • Topic: BC plan development

Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here