Preparing your business

1 What is business continuity?

Business continuity is about identifying, understanding and managing risks to the everyday running of a business or organisation. It helps you to prepare for an emergency or disruption, by planning different ways of working so that you can continue to deliver the key functions of your business during times of unexpected events.

Business disruptions can present themselves in many ways, such as:

utility outages
weather related incidents
cyber-attacks
fire
equipment failure
sickness outbreak
loss of suppliers.

All of which can disrupt your business process; they can either slow down your operation or stop it altogether.

Understanding how to get your organisation up and running after an incident means that you are more likely to safeguard your staff and reputation, continue providing employment, meet customer needs and, ultimately, survive the incident.

2 Business continuity planning advice

Did you know:

about 20% of businesses suffer a significant disruption each year
80% of businesses affected by a major incident do not re-open or close within 18 months
90% of businesses that lose data from a disaster are forced to shut within two years?

Experience shows that developing a business continuity plan can help to reduce the impact and costs of an emergency. It means your organisation is much more likely to continue trading if an incident or emergency were to happen.

Although major emergencies are rare, smaller scale disruptive incidents affect us much more frequently and highlight the need for us to be prepared.

To develop an effective business continuity plan, good practice recommends an ongoing planning process to refine and improve arrangements over time.

3 Understanding your organisation

The first stage of business continuity planning is known as a ‘Business Impact Analysis’. This is a tool to understand your most time critical activities and the resources you need to carry out these urgent activities. It helps you to evaluate recovery priorities and assess the risks that could lead to a business disruption or emergency.

Key questions to consider as part of the Business Impact Analysis include:

What does your organisation do and deliver?
What are your most urgent activities?
What do you need to deliver your most critical activities?
What would be the impact over time if certain activities were disrupted or interrupted?
What are the risks to service delivery, for example, do you rely on a single supplier?

It is also good to consider any local risks as part of business continuity planning.

The Sussex community risk register highlights risks that have the highest likelihood and potential to have significant impact, causing disruption to your local area.

The Environment Agency also provide advice and tools to help manage flood risks and can tell you if your premises are located in a known flood zone.

4 Developing your business continuity plan

A business continuity plan (BCP) should record how you will respond to an emergency or a disruption.
Although you need to be aware of specific risks and deal with any serious ones, your planning should focus on the outcomes of disruption not its causes.

Regardless of the cause, a business continuity incident generally means you have lost one or more of the following:

loss of staff or skills, for example, through sickness or severe weather events
loss of critical systems, for example, ICT failure
loss of utilities, for example, water, gas or electricity
denial of access, or damage to, facilities/premises, for example, loss of a building, flooding, fire
loss of key resources, for example, specialist supplies you depend on to deliver your business.

The free, Government Business Continuity Management toolkit provides details on what your business continuity arrangements should contain and further advice on how to develop your plan.

As an overview, business continuity plans should generally contain the following details:

plan purpose and scope
document management information, such as a document owner, version control or distribution list
roles and responsibilities
how the plan will be activated - when, by whom and how?
key contact details - internal and external
critical functions/activities to be recovered, timescales and recovery levels needed
resources available to deliver critical activities during the first 24 hours and up to two weeks from the event and processes for mobilising resources
actions to be carried out, in what timescale and who will do these
clear communication processes - who reports to whom or cascades information
process for standing down and returning to normal business.

A business continuity plan template is available below.

Business continuity plan template (Word, 41KB)

5 Training and exercise

A business continuity plan (BCP) is not considered valid until it has been tested. Does the plan actually work? Does it give the intended outcome? Are there any gaps in arrangements? Are staff prepared?

There are many different ways to test or exercise your plan, so it is important to choose the type of approach that works best for your organisation, for example, a table-top event, using a fictitious scenario for a full ‘walk through’ of the plan, or a ‘live’ exercise where people take on specific roles and simulate your response.

There may be occasions when you want to just test specific elements of your plan, such as checking your key contacts list is up-to-date.

The most crucial element of exercising BCP’s is to identify the lessons learnt. This should help inform improvements to the plan as well and identifying any training needs for those with specific responsibilities within the plan.

Business continuity training and awareness is a core part of embedding a culture of resilience within your business. It is pointless to invest time and energy in writing a plan and developing response arrangements if nobody knows about it.

It is important that all staff who are responsible for either activating the plan or delivering any element of the plan, are fully aware of their roles and responsibilities.

6 Maintaining and reviewing

Once you have invested time and energy in developing your plan and response arrangements, it would be a shame to let all that hard work go to waste.

To prevent this happening, identify someone to take ownership of the plan and maintenance programme. This person should arrange for a comprehensive review of the plan to take place periodically, at least once a year.

Organisations change all the time, so it’s important that your plan reflects these changes. It is good practice to quickly review your plans and other documents frequently, so that it is always up-to-date, especially key contact details.

7 Useful resources

For further advice and guidance in developing your business continuity arrangements, please visit the following resources: