By the time many businesses realise they need a business continuity plan, it can sometimes be too late. Until then, however, it can be difficult to get sufficient buy-in, as its value is mostly hypothetical. So when business leaders do invest, they want to be confident that it will work.
The Vodafone Future Ready Report 2020 found 82% of companies which had invested in a fully documented and tested business continuity plan felt it had worked well during the pandemic.
Here are key steps for developing a business continuity plan that actually works.
Own the plan
To achieve a successful business continuity plan, a key person must take ownership of the process to ensure management fully supports it. The plan needs to be adopted, maintained and activated by people in all parts of the company with different skills and seniority.
The overall objectives of the plan need to be communicated to everyone who has a stake in making it work. What types of failures does it address and how? People need to be aware of their roles and responsibilities if the plan is put into action.
Analyse your business
To counter potential disruptions and identify their possible impact, you need crystal-clear answers to the following business questions:
What products and services generate the most revenue and profit?
What procedures and resources are vital to delivering your service?
Which staff are critical to ongoing activity and who are the key people?
Who are your main suppliers ?
What are the most important elements in your supply chain?
Who are your key customers?
Make sure you understand the relationship between internal activities, external activities, people and equipment to identify potential points of failure.
Assess your risks
To mitigate a risk, you need to know what it is. A risk assessment helps identify and prioritise risks to the organisation.
What are the risks and effects:
If a fire or flood damages company facilities or destroys important documents?
If a natural disaster occurs?
If IT systems fail?
If communication systems fail?
If there is a loss of confidential data?
If a key member of staff is taken ill or leaves the company?
If there is industrial action?
If a main supplier can’t deliver?
If a major customer can’t pay?
The risk analysis helps companies gain a more objective view of their continuity aims, including costs, benefits and the time needed to put them in place.
Agree on the risk strategy
Everyone involved with the plan needs to agree what it covers. If some key people aren’t on board, the entire plan may go off the rails at a critical moment. Each risk needs to be ranked and assessed by what action should be taken:
Accept the risk and take no further action.
Try to eliminate it.
Seek to mitigate it through the continuity plan if it occurs.
Remove or change the process if you can’t reduce the risk to acceptable levels.
Develop the plan
The company should agree procedures for the continuity plan and rehearse them to make sure they’re effective.
People need to know what their roles are and the activities they need to undertake to restore services. They should be provided with instructions on how to carry out the plan and the contact information of others who have a role to play.
The company needs to identify when each step of the plan should start and which members of staff should be involved at each stage.
Also make sure the plan is fully documented. If it only exists in the heads of a few people, operational risk grows substantially.
Test the plan
The worst time for a company to find out the plan doesn’t work is when it’s put into action.
Review and rehearse the business continuity plan to make sure it works.
Test a scenario and follow procedures to identify any areas that aren’t working or need to be addressed. This also gives the team a better understanding of their role in the process.
Adapt the plan
Try different scenarios with the plan on a regular basis, if possible. How many companies identified “a global pandemic” as the greatest risk to their business continuity before COVID-19?
The continuity plan needs to adapt to meet new challenges because there will always be different risks and threats. You can’t just “set and forget” the business continuity plan and expect it to roll out seamlessly when you need it.