Business continuity resources for smaller businesses: part two

The development of many business continuity plans results in a single document that covers all aspects of business continuity. Real-life experience shows that these weighty tomes are of little use during a crisis and are cumbersome to maintain and update. This article puts forward the concept of a framework that structures business continuity plan content in formats that meet several objectives. To achieve this, a comprehensive business continuity framework will include content covering the following topics:

Defining the scope of the business continuity initiative and the organization’s recovery priorities
Ensuring that the organization has the intrinsic capabilities to recover critical aspects of its operating infrastructure and, where necessary, identify areas for improvement
Providing action plans to be followed in the event of a major operational disruption
Identifying communication channels to be used during an incident
Establishing a management process to ensure the continued relevance of the plan and recovery capabilities

An effective business continuity plan development initiative will therefore generate several different types of information resources: some to support later stages of development, some for reference and information sharing, and some that demonstrate to third parties that the organization has robust plans, maintenance processes, and resources to provide concise support and guidance when disaster strikes.

Defining scope and priorities

This is the initial stage of business continuity plan development. Some call it a business impact assessment (BIA); others may refer to it as a risk assessment or a business impact risk assessment (BIRA). What we call it is less important than what this step achieves – the process of identifying the most important activities that must be maintained in order to preserve customer goodwill, ensure staff safety, and support the survival of the organization. This stage forms the bedrock that supports the rest of the plan. It sets the scope and focuses on the parts of the organization that must recover their operational capability to prevent serious damage.

For commercial organizations, these are often customer-facing activities such as order placement, order processing, fulfilment, and post-sales service and support. An inability to perform these activities can significantly affect customer relationships and may lead to large-scale customer defections. Once customers have defected, many may lose confidence in the organization even after operations resume.

Not all organizations have commercial relationships with those they serve. Charities support beneficiaries in various ways and government organizations serve communities. In these cases, the concerns related to operational disruption are more likely to be focused on health, safety, and well-being. Disruptions can raise concerns about public health, the welfare of vulnerable service beneficiaries, and potential hardship.

Once the organization has identified what is important, it can then begin to assess its infrastructure’s capabilities to meet these priorities – particularly in terms of people, premises, IT, and other resources.

Establishing basic recovery capabilities

An organization’s overall ability to recover IT systems, establish alternative workplace arrangements, and acquire replacement equipment will determine whether it can intrinsically recover from a major operational disruption. This stage draws on colleagues from parts of the organization that deliver these core capabilities. Their specialist knowledge is needed to identify current capabilities and determine whether they are sufficient to meet the organization’s business continuity priorities.

As with defining scope and priorities, this step ensures that the business continuity plan is not built on unfounded assumptions. Many planners fail at this point – assuming unrealistic IT recovery capabilities or that workplace and equipment will be available to meet recovery deadlines.

Developing operational recovery plans

This is where we get down to the ‘nitty gritty’ of how the organization’s activities are restored after specific types of disaster. Having established what is possible in terms of IT, alternative working arrangements, and equipment, we now define action plans for specific activities – detailing who does what, where, when, and with whom they need to collaborate. These plans should be practical, easy-to-follow guidance documents that outline key actions, roles, and relationships. They should be designed for quick reference under pressure.

Establishing a communications framework

This part is the glue that holds together departmental action plans and associated recovery activities. It must also account for communications with external parties such as suppliers and customers. The communications framework defines who is responsible for communicating with different groups and how that communication will occur.

For external audiences, channels such as SMS messaging, social media, website updates, and helplines should be selected based on the likely needs of each audience.

Incident management

Gaining control of an incident, understanding its severity, and deciding on the correct response helps senior leadership establish command and control and initiate relevant business continuity capabilities.

The Gold/Silver/Bronze structure is often referenced as a model for incident management. Originally developed by UK emergency services, it suits large organizations with formal hierarchies. Medium-sized organizations may benefit more from a flexible and intuitive approach, such as:

Discovery and escalation: handling immediate on-the-ground response and assessing the speed and scale of the impact
Crisis leadership: assessing the situation, mobilising specialists, managing corporate communications, and coordinating internal communication
Operational recovery: restoring internal services and priority operations (as covered under recovery plans).

Business continuity plan assurance and organizational awareness

This final stage focuses on ensuring that the business continuity arrangements remain fit for purpose and that everyone understands their role. Organizational awareness involves providing guidance to the wider business about likely actions during an incident and any responsibilities they may have.

Every business continuity initiative should have an assurance schedule – a set of tasks to confirm that the plans remain relevant. A typical schedule might include:

Business continuity tests and exercises with defined frequency
Confirmations from suppliers and internal departments
Specific training for key roles.

To maintain awareness across the organization:

Keep staff informed about business continuity arrangements, typically via onboarding and refresher sessions
Explain what will happen during a major incident
Provide clear instructions on where to find information and updates
Distribute quick-reference guides.

Conclusion

A framework with these attributes lays the foundation for sound, comprehensive business continuity capabilities that can be maintained effectively by a small or medium-sized organization.