How to Create a Business Continuity Plan
Any disruption in your business is unwelcome, but a major issue can be catastrophic and even end your enterprise. How do you survive such a significant event? You need to plan for it, know what to do when it happens, and train your people to respond appropriately. While financial losses can be great, a loss of reputation may be even more harmful.
For example, if a bank shuts down for even a day with no way for people to get at their money, the loss of revenue is very small. If the local newspaper produces a story on the bank, shouting “Local Bank Shuts Down,” the bank can cease to exist very quickly as people lose faith in the business. If the bank had a well-defined business continuity policy, they would have press releases ready, specific directions for people to go to another branch, and people meeting customers at the door explaining the situation. A business issue doesn’t have to be a disaster; you just have to plan for the disaster and know how to appropriately respond to it.
A business continuity plan (BCP) can’t cover all the steps necessary for recovery, but it can focus on the simplest of disasters. The reason is that complex situations lasting over even a day or two can unfold in so many ways that it’s impossible to cover them in a document that isn’t hundreds of pages long. But regardless of complexity, there are critical steps to take in any potential disaster. A BCP can help implement and define those steps.
The primary purpose of a BCP is to outline the first several steps toward a disaster resolution, provide guidance regarding several options, and provide a comprehensive list of contacts that can bring assets and talents to bear in exercising those options. It will have information regarding whom to contact in which circumstances, and how to contact them.
The four major parts of a BCP are as follows.
- Notification: This section needs to provide a detailed list of people to contact, along with their phone numbers, within the organization in a calling tree scheme to quickly disseminate knowledge of the problem throughout the organization. This includes all emergency services that may have to be called in to help handle the situation.
- Reaction: The BCP has to define the appropriate actions necessary for different classes of disasters. It’s totally impossible to define a specific set of actions for every possible disaster, so the potential problems need to be broken down into categories and appropriate responses planned for each of those categories. This part of the BCP is usually the largest and most complex section of the document.
- Best preparation practices: This establishes the need for appropriate security of company assets, backup of company data, backup processing facilities (both short term and long term), and backup power generation facilities. This section is usually cross-linked with the company IT policy and data backup policy.
- Media contact plan: Communicating with the media in an appropriate manner is critical to handling a business disruption. Not every incident requires a press release, but a big enough problem does require a plan for contacting media. Getting the correct story out there first can be absolutely critical to protecting your business and reputation.
As one pundit put it, “Those who fail to plan, plan to fail.” Nowhere is this truer than in planning for a failure itself.
John C. Shovic is a partner at MiloCreek Consulting in Coeur d’Alene, Idaho.
