Make a plan
To ensure that you are able to produce a
Business Continuity Plan, key team members should be identified
along with the structure, team membership, any external customers,
partners, suppliers and internal support. Other information
such as where you would intend to manager your company's response
from (the 'command centre'), and other information such as staff
contact details, supplier contact details, etc. will be
needed. An incident box is always a good idea as it can
contain all of the relevant information for you to manage your
business from a remote location should it be necessary.
What a plan will look like
The business continuity plan should aim to
include:
- Introduction - Identify the key functions that
support your business and the scope to which you wish the plan to
be restricted.
- Objectives - Identify the objectives you wish
to cover specifically tailored to your organisation. As the
plan will be a generic plan, which can be used to cover most
emergency situations, you will need to make assumptions that will
be recorded within the plan.
- Plan Owner - It is always worthwhile
identifying the plan owner who takes responsibility with your
organisation to ensure that the plan is regularly reviewed, tested
and updated.
- Structure of the Business Recovery Team - As a
result of many major emergency, key staff that will be paramount to
the recovery of your business will need to be identified and their
roles and responsibilities known. A common term for this
group is the 'Business Recovery Team'. Other areas that need
to be identified for the team will include their accountability and
the authority to which they can act.
- Critical Business Activities (Recovery Action Plan)
- Your Business Continuity Planning team will need to
review your critical business activities to identify where any risk
to your business continuing after an emergency will occur.
These activities can then have a risk assessment undertaken with
the resultant action to mitigate the risks. A recovery action
plan can then be produced and. for ease, can cover such items as
power failure, loss of fresh water supplies, burst pipes, unplanned
staff absences, emergency evacuation procedures, emergency
procedures to be followed by a manager in the event of emergency
relocation, fire damage and other contamination issues, and in this
case, the loss of communications and information technology.
- Recovery Site Location - Identify a location
from which you are able to run your business should your main site
be lost due to the emergency. You will need to review the
type of location that you can work from during a phased approach to
your business recovery. For instance, during the first
twenty-four hours, the site may be considerably smaller to that
which is required after say one week.
To aid this recovery, a resource profile can be
produced identifying the facilities and equipment you require as
your business recovers over the recovery period.
Be aware of the types of emergencies that might
effect your company both internally and externally. Find out
if there are any natural disasters that may put your businesses at
risk. These can be found in the community Risk Register, held
by Hertfordshire County Council on their website.
In extreme circumstances, identify what to do
during a CBRN attack (chemical, biological, radiological or
nuclear attack).
- Supporting Information - You will already hold
a considerable amount of information regarding your
business. This will include information around Health
and Safety issues, communications (call-out list), emergency
service liaison, financial and insurance details, any legal
issues and important documents such as contracts, etc.
These should be held in a secure and accessible location should an
incident or emergency occur.
