Business Continuity Planning: Are you prepared for any eventuality?

Business Continuity Planning is a must for every business, especially in light of the COVID-19 pandemic. We explain how to plan for the worst-case scenario, what processes need to be in place when disaster strikes, and why asking ‘What if?’ is such an important question.

If there’s one thing you should plan for, it’s that not everything will always go to plan. Every business has to manage risk, and if risk turns into reality you need to be able to respond quickly and continue functioning after disaster strikes.

This is where Business Continuity Planning (BCP) comes in. BCP is the process a company undergoes to create a prevention and recovery system from potential threats, whether it be natural disasters, cyber-attacks or even the odd global pandemic. This guide follows on from my previous blog on risk and resilience, which highlights some of the common top-level risks that every manufacturing business needs to consider.

The ABCs of BCP

BCP is designed to protect personnel and assets and make sure they can function quickly when risk mitigation fails. While vulnerabilities and threats to a business are endless, the funds to address them are not, so organisations must build a solid foundation for making risk-based decisions and preparing for and managing incidents. 

The planning process starts by identifying the top-level risks to your business. They will generally fall into one of the following four categories:

1.    Workplace Disruption: An event that causes a workplace to be impaired or unavailable, such as a building failure or a temporary closure

2.    Workforce Disruption: Circumstances that cause the workforce to be impaired or unavailable, for example as a result of strikes or civil unrest, or extreme weather preventing employees getting to work

3.    Technology Disruption: Outages that cause machinery or technology to be impaired or unavailable, such as cyber-attacks, hardware or software failures, or equipment damage from poor operational practices (accidental or otherwise)

4.    Supply Disruption: Circumstances that disrupt the supply of a product or service, for example disruptions to transport infrastructure, utilities or your supply chain.

The events of 2020 were a perfect advert for BCP because the COVID-19 pandemic is a picture postcard of all four types of disruption. It has disrupted workforces by preventing staff coming into work, disrupted workplaces through mandatory closures and social distancing restrictions, and disrupted the supply of goods and services worldwide. Many businesses have also been under technological stress as workforces have shifted to working from home. Together, these disruptions have changed day-to-day behaviours for virtually every company.

Those with well thought-through business continuity and operational risk processes have been able to respond much quicker than those who haven’t. The latter will experience much deeper and more sustained business impacts, from lost revenues and profits to long-term brand damage.

Playing ‘What if?’

There are two aspects to every business risk: how likely is it to happen, and what effect will it have on the business. Your assessment can be supported through three key lines of enquiry:

1.    Ask ‘what if?’ questions

2.    Ask what is the worst-case scenario

3.    Ask what functions and people are essential, and when.

‘What if?’ scenarios are a useful tool for teasing out details you might not usually consider. Remember that a good continuity plan deals with any incident, no matter what caused it – you don’t need to be the target of terrorism for it to disrupt you, and an electrical fault caused by someone else on the grid will produce the same result as causing one yourself.

Useful ‘what if?’ questions include:

·         What if our electricity supply failed?

·         What if our IT networks went down? For a day? For a week?

·         What if our telephones went down?

·         What if our key documents were destroyed in a fire?

·         What if our staff could not gain access to the building for days, weeks or months?

·         What if we had casualties?

It is also useful to ask ‘what if?’ questions about your business relationships:

·         What if our customers could not contact us?

·         What if our suppliers could not supply us?

·         What if our customers could not pay us?

·         What if we could not pay our suppliers?

The worst-case scenario

Your worst-case scenario reflects the worst possible outcome for each top-level risk. Generally, the worst case will be something that completely stops you carrying out your business. If your plan enables you to cope with this scenario, it will also help you deal more easily with lower-impact incidents.

It’s important to consider cause and effect when establishing a scenario – a chain reaction of a comparatively minor event might be far worse than just one major incident. For example, a terrorist incident might prevent access to your building for an extended period; could that prevent you accessing your IT system? If so, customers might be unable to pay you, meaning you might be unable to pay your suppliers, leading to a damaged business reputation that could be exploited by your competitors and put you out of business.

Essential people and functions

Effective BCP requires details for who needs to do what, when and where in the immediate aftermath of an incident. For example, in the event of an accident who is responsible for recording who has been injured, where they have been taken and who is missing? Who will communicate with whom after the incident? Who will deal with enquiries from relatives? Does your entire team – including temporary staff and contractors – know these details?

Best practice templates

A fast, easily followed plan can be the difference between survival and failure in the aftermath of a disaster. Insurance firm Aviva have produced an excellent BCP and self-assessment guide that’s available to download. It covers all of the key issues discussed above and includes an easy-to-follow colour coded matrix that you can use to prioritise risk mitigation and improvement measures.

When it comes to producing a Disaster Recovery Plan as part of your BCP process, New York based XSolutions have created a simple excel template that can be tailored to your circumstances. It includes a threat matrix tab to help you consider different potential scenarios.

Need to talk?

If you are looking at bringing in external support to guide you through the BCP process and identify or mitigate risks to your business, get in touch with our Manufacturing Team today to see if there you are eligible to apply for funding towards this.