The UK Government agency CPNI (Centre for the Protection of National Infrastructure) provides an authoritative source of advice on continuity planning. We believe that the information they offer is an excellent introduction to continuity planning for any organisation.
“The Business Continuity Plan (BCP) is an essential part of any organisation’s response planning. It sets out how the business will operate following an incident and how it expects to return to ‘business as usual’ in the quickest possible time afterwards. A BCP need not be specific to terrorist incidents and will apply to any major disruption such as a major fire, flooding or power fault.
Mapping the organisation
The first step is to identify the assets and processes that are critical to the organisation’s continued operation. Questions to be asked in continuity planning include:
- Which roles and individuals are vital for fulfilling business commitments?
- What equipment, IT, transport etc will staff need to maintain operations?
- How long can the business function before full operations are restored?
- What alternative resources are available?
- Which departments are vital for fulfilling orders and contractual obligations?
- Which suppliers and other third parties are integral to daily routines?
The continuity plan must cover all the steps that staff are expected to follow after an incident in order to maintain essential operations and return to ‘business as usual’ as soon as possible.
The initial response
- Clearly defined roles and responsibilities are vital for those who will co-ordinate the initial response in each location.
- Those designated people working with emergency services must have access to relevant incident response procedures that have been prepared for such situations.
- All factors determining part or full evacuation of premises must be clearly specified.
- There must be rehearsed arrangements for providing first-aid by trained personnel.
- One of the response team’s critical tasks will be to manage internal and external communications.
- Arrangements for marshalling crowds towards pre-determined muster points must be clearly signposted and the response team must be familiar with these.
- There must be a provision in the continuity plan for supporting people with disabilities, restricted mobility or other special needs.
- Alternative accommodation and facilities should be identified as part of the business continuity plan and a specification produced as to when they will be utilised.
- Arrangements must be in place for maintaining access to key records and IT systems.
- Contingency arrangements must be in place for maintaining critical operations – financial transactions, client orders, receipt of deliveries, production commitments.
- Provision must be made for access by appropriate staff to any contingency sites.
- Agreed procedures must be established for re-commencing routine operations.
- Arrangements must be in place for keeping staff informed after they have left the site.”
Continuity planning preparations
The best place to start in preparing your business continuity plan is to fully review your current situation. We recommend first completing our strategic risk management audit (iRMA). This risk audit benchmarks your current operations across 20 management disciplines and compares them with best practice standards.
The audit report will enable you to prioritise the highest risks and also to assess how well prepared you are to manage incidents and to ensure that business continuity is managed effectively. The established international standard for business continuity is ISO 22301. We will work with you to adapt this framework to your organisation’s structure and processes.