Business continuity resources for smaller businesses: part three

So, you have decided that your organization needs to develop a business continuity plan – how do you get things moving to get it done? There’s no shortage of information on what should be in a business continuity plan – in this article we are going to focus on how to get the plan development done. Let’s start with the main milestones in a business continuity plan development initiative – we covered the main deliverables at each stage in previous articles.

They were:

Scope & priorities – deciding the things your business continuity plan is going to focus on.
Operational response plans – the envisaged response to different types of disruption.
Leadership incident response framework – where senior management establishes overall coordination and control of a major incident.
Communications – what channels of communication will be used to inform and advise affected parties.
Oversight, assurance, and awareness – establishing a framework for the general guidance of colleagues and ensuring that response plans remain fit for purpose.

The preliminary step is making sure that we are properly prepared to start the project. In this step we need to ensure that the project is adequately resourced to move forward by considering:

Who should be involved in this project, and who do we need to make a meaningful contribution. Although this can change as the project progresses, we’ll need to start with representation from those parts of the organization involved in the day-to-day operation of customer ‘touchpoints’ as well as representation from areas that support the organization’s physical and IT infrastructure.
Do we have committed availability from these areas of the organization to provide resources to participate?
What is our timeline for development? Having a realistic development timeframe will help to establish coordination of resources and help those participating in the project to schedule their time (because they will also have a day job!).
When does the plan need to be operational? Having a plan is a step, not a destination. Once a plan (think of it as a blueprint) is established, operational capabilities may need to be developed to meet its objectives.
How will we collaborate and communicate during each stage? What technologies can we leverage to ensure that project participation, information sharing, feedback, quality of deliverables, agreement and consensus, and progress towards milestones is efficiently achieved? Creating a team site in SharePoint or using collaboration tools such as Slack can significantly reduce project administration overhead. These tools will help to keep track of documents, give feedback, and ensure that each stage is completed on time and to an acceptable quality. They also help you to create transparency and clarity of the overall process.
How will we manage the quality of deliverables? Having access to checklists, templates, etc. will facilitate the development of quality, fit-for-purpose content.
Orientation of participants. For many participants this may be their first introduction to business continuity principles and concepts. Ensuring that all participants have been provided with an overview and roadmap of the project and the commercial reasons for undertaking it will ensure greater understanding – and commitment.

Scope and priorities

This first stage of the business continuity plan development process sets the overall direction based on the threats and exposures associated with a significant operational disruption. As this is the first stage of the business continuity planning initiative, the following steps will facilitate its completion:

Invite participants to the workshop, providing a briefing that includes time, date, required commitment, and any required information to be brought to the workshop.
Within the briefing, highlight any tools that will be used to capture and analyse information. It can be helpful to have a facilitated walkthrough of this activity as a first step prior to initiating the workshop, as it may be an unfamiliar exercise for many participants – providing an introduction to tools and techniques will raise awareness and understanding.

Operational response plans

Once the critical functions in the organization have been established, the potential consequences associated with being unable to perform them, and the organizational infrastructure required to maintain them, it’s time to think about what would need to happen if a major incident did occur and what steps would be required to mitigate the consequences. That’s when operational response plans need to be developed. Plans will be required for all priority functions, together with plans for departments that operate the organization’s infrastructure (such as IT and Facilities). The plans should be designed for ease of use so that they can be used in a pressurised situation. To ensure consistency and standardisation – and provide guidance – a template can be extremely helpful. To complete this stage of the business continuity project, the following steps are advised:

Conduct a briefing session or workshop with those responsible for formulating the operational response plans.
Walk through the template with participants.
Provide a checklist so that they can ‘check their homework’.
Review and provide feedback if necessary.

Senior management incident leadership

As part of the development of the business continuity plan, we now need to think about actions that the leadership team will need to take to obtain command and control of a situation and mobilise an operational response.

For this stage, it may not be possible to follow the briefing > workshop > deliverable process outlined for earlier stages. This stage of the project may require a presentation to the leadership suggesting actions that could be taken, and recommendations for roles and responsibilities.

Communications

The communications framework identifies all likely parties an organization will need to communicate with during a major incident. It enables the organization to map the parties to be advised, the communications channel best suited for the purpose (i.e. website updates, social media platforms, SMS, etc.), and the individual or team responsible for managing each communications channel.

This will be a wide-ranging exercise requiring broad participation across the organization for both internal and external communication. Based on the outcome of the scope and priorities exercise, likely communication channels may be required with the following parties who could be affected by an incident:

External parties
o Customers / beneficiaries
o Regulators
o Local community
Internal two-way communication between groups
o Operational response teams
o The leadership team
o Internal service providers
o The wider organization

The main considerations of this exercise will be:

Do we have appropriate communications capabilities to support both internal and external groups?
What communications channels are the most appropriate for the needs of each audience?

For internal communication, a standard platform that will support collaboration and decision-making as well as messaging is generally required. For external audiences, a choice will need to be made that considers the size of the audience and how incident updates and advice will be sent.

Oversight and awareness

When the required content of the business continuity plan has been developed, it’s time to think about a process that will preserve the investment made to create it and ensure that it will remain fit for purpose. This task often falls to the business continuity planning project lead in consultation with the compliance or audit functions of the organization. Their joint responsibility would be to define and document an assurance and oversight process and responsibilities for performing audit and assurance activities.

A typical assurance framework would consist of:

Testing to be performed and frequencies.
Confirmations to be obtained from third parties and internal service departments (such as confirming IT recovery capabilities and alternate workplace arrangements continue to meet requirements).
Any training required for key role holders within the plan.
Developing policy statements if required.

The final stage of business continuity plan development is the creation of an awareness programme for informing the wider organization of the incident management and business continuity measures in place, what will happen in the event of a major incident, and actions that should or should not be taken. Awareness programmes are often developed by the project manager in conjunction with HR or training functions. They would generally consist of a PowerPoint resource explaining the main features of the organization’s business continuity plan, information resources, and actions to be taken when notified that a major incident is declared.

HR collaboration would generally involve guidance on the required format of awareness materials and requirements of existing training platforms such as learning management systems.