Business Continuity Planning (BCP) is the pre-planning effort put in to make sure your business continues to operate even during adverse situations. BCP is the work put in before those imperfect days, in order to smoothly transition between “normal” operations and “backup” operations.
A backhoe digs through the internet cables, the electricity goes out, a computer stops working, the delivery truck is involved in an accident. In all of these situations, what is the backup plan?
These “adverse conditions” are situations that are explored in the Business Continuity Plan. The phrase BCP really took off after 9/11. Along with Disaster Recovery Planning, BCP has always been a part of a proper business plan even if it is not written down.
In Business Continuity and Resiliency Planning, we attempt to put some order to the chaos. The paper is not a basic BCP tutorial, but instead is written just to get you to think about your business, what might happen to cause an interruption, what you can do to lessen the opportunity for a disruption, and what you can do to lessen the impact of that disruption.
Yay, you are in business! You’ve created your company, you have your occupational license, your office and storefront set up, vendors, product lines, and best of all, customers!
But are you ready to open? What happens when things go wrong? Let’s face it, adversity comes in many flavors. Sure, emergencies like a fire, and disasters like a hurricane are adverse, but there are more adversities to consider. A storm, or a crime, your internet goes down, or even something like if your suppliers stop supplying.
What happens during these adverse conditions? What are your real risks, and how will you protect your business – and your customers – from the risks? Good resiliency planning will keep your business operating when things just don’t go right.
This paper helps you explore your exposure to risks and remedies for adversity. You don’t want to be in a position of trying to figure out what to do during a crisis. As some of us have heard through the years, prior planning prevents poor performance. Will this planning make you 100% safe from adverse conditions? Of course not. What it will do, though, is help you understand the risks your company faces, and help you get through the situations.
In this paper, we’ll focus on business continuity and resiliency planning as it relates to your product, to your business process, and to retaining your customers. We’ll look at snippets of what winds up being important to different kinds of businesses, including an Ice Cream Shop, a Home Health Agency, a roofing company, and a Restaurant. Although the content is appropriate for all businesses, the intended audience is the small business. We’ll avoid going through the purely educational process of defining Business Continuity and Disaster Recovery; instead, we’ll look at practical, real life examples of what you need to consider when it comes to protecting the interest of your company.
Chapter 1 Introduction to Business Continuity
When it comes to starting your business, there is no one “right type” of plan. There are business development plans, financial and budget plans, marketing plans, and recycling plans to name just a few. These are all great plans, and very important to any business. But let’s face it, some are more important than others.
And when it comes to protecting your business from adversity, there is truly no one “right type” of plan. These are the plans that you hope to never use, plans that are only important when things just go wrong. But equally so, these plans are important – to both your customers, and to your business interest. Take these examples,
- What happens if your building burns to the ground? Are you going to set up shop at a temporary facility, or will you cancel all pending orders? How long will it take to recover? And how many pending orders will you lose? How will this affect your customers? To manage this risk, have you installed sprinkler systems? Or a fire alarm that automatically calls the fire department when things go wrong?
- How about a hurricane warning? Do you send your workers home? How is your customer base affected by hurricane warnings? If you are selling water, you stay in business since everyone and their brother will be looking to buy water! But how about if you are an Ice Cream shop? Do you expect to get much business while everyone is scurrying around trying to board up their windows? How about if you are a licensed Home Health Agency? You may have government regulatory demands in place that force you to stay open, or maybe even force you to move all of your patients to a safe house for continued care.
- How about a tsunami that happens quite quickly? You may say, “Oh, but I’m in Florida, we don’t have tsunamis.” This is true, you don’t. However, your suppliers may by affected, and if your suppliers are affected, you are affected. Take for example the 2011 earthquake and tsunami that affected Japanese LCD and semiconductor manufacturers, thereby disrupting the worldwide supply of these components.
Certainly, you may not know at this moment what you will do in these situations. It will likely depend on many factors, such as what is your business backlog of orders. However, it is never a bad idea to have a plan, and planning may even clear up some of these unknowns.
As a reminder, plans are just that, just plans. As Winston Churchill is quoted, “Plans are of little importance, but planning is essential.” Yeah, maybe. Then Mike Tyson tells us, “Everyone has a plan until they get punched in the face.” What do we take away from all this? Have a plan, but don’t be a slave to it. Be comfortable in changing the plans as necessary. These types of plans are truly living documents. You already know your business. As you get to know more about risks, your risks plans will become more mature. In these first phases, you may or may not even document the plan – the goal is to understand your risks.
Let’s look at what we are trying to achieve here and set some expectations. This is not a Business Continuity Training document. It is intended to look at real life threats and impacts to your small business. When we think Business Continuity, we should be thinking about, “what are the threats and risks to my business when it comes to completing my mission.” That is, what adverse situations might happen that will negatively impact completing your business goals. In this document, we’ll be looking at ways to reduce the impact of those adverse situations. We will be examining real life scenarios for real life companies, including a retail ice cream shop, a home health agency, and a restaurant.
This paper will consist of the following sections. First, we will lay out objectives or principles of the risk plan that we are writing. Next, we will brainstorm business continuity threats and risk impacts to your business, taking note of all conceivable risks (some of these will be unreasonable, and we can eventually discard them as unreasonable). Then, we will outline how to document the business continuity risks and associated mitigation. Finally, we will detail some of the risks and mitigation steps required to successfully keep your business running. Along with this, we will outline how much it is going to cost to implement the risk mitigation. We’ll end with some concluding remarks and way forward for developing a more comprehensive business continuity plan.
Chapter 2 Objectives and principles of Small Business Continuity Planning
In this paper we are going to talk about Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). But what exactly is BCP, and what is DRP? First of all, BC and DR are not the same, they are not synonyms for one another. In short, the DR has a much more narrow scope than the BC; in fact, the DR is often solely a function of the IT department and focused solely on data processing, while BC has a larger scope that addresses the business at large.[3 4] You can best think of the Business Continuity Plan as the “umbrella policy” that makes sure the business continues, and the Disaster Recovery Plan is a supportive plan, a piece of the puzzle to make sure that the Business Continuity Plan works as expected. With all that said, BC and DR are closely related, and certainly in layman
speech, the two are often used as synonyms.
What are we planning to achieve with planning for adversity? The objectives and principles of the Business Continuity Planning include:
- To identify as many risks to the business as possible. Realize, you don’t have to document a corrective plan or mitigation plan for every risk that is identified, so be liberal in writing your risks down.
- To create reasonable risk aversion plans that can be budgeted accordingly. Every planned mitigation will likely need some form of financial backing.
- To make the plan simple, short, practical, and achievable. Simple, so that they can be executed without having to rethink the steps; short, so that they can be executed in a reasonable amount of time; practical, since an impractical plan will not help; and achievable, since if the plan cannot be completed the plan will not succeed in helping to mitigate the risk.
- To make the plan testable. Sure, it is great to have an idea of what to do in case of a crisis, but it is even better to see how that plan works out in real life.
- To make the plan extensible and easy to change as new business needs are discovered and technology evolves. Like we’ve said, plan, plan, plan, but don’t be a slave to it.
Please send a note if you wish to continue reading Business Continuity and Resiliency Planning