1 What is business continuity?
Business continuity is about ensuring your business can continue to trade in the event of some kind of disruption.
Disruption can come from the external environment, such as flood or snow, or from within your business, such as an IT failure or loss of power.
Business Continuity Management (BCM) is a process that anticipates these risks. By putting in place contingency plans, you can ensure that your business can continue to trade in the event of a disruption.
Types of disruption that could impact your business
- Extreme weather or a burst water main floods the ground floor of your office - Staff have been sent home and property, documents and equipment are damaged beyond repair. You are reliant on your insurance.
- A virus attack corrupts your databases and disrupts access to your email or website. You are reliant on backups and hard copy information.
- Your supply chain is disrupted. Any one of a number of issues, including fuel shortages, industrial action, illness impacting staff, financial difficulties or even international emergencies, such as volcano eruptions or tsunami could impact you.
- A key member of staff resigns tomorrow.
Whether you are a small market trader, voluntary organisation, multinational or international company, the ability to respond quickly to disruptive incidents is vital.
Having a business continuity plan could make the difference to the survival of your organisation in the long term.
2 The importance of business continuity
- Assists in minimising impacts if disruption happens.
- Helps protect reputation and meet customer requirements.
- Enables return to normal operations more quickly than otherwise possible.
- Helps to cope with the immediate effects of an incident on employees.
- Improves the understanding of risks to the organisation.
- Ensures compliance with legal requirements.
- Provides a competitive advantage.
3 Understanding the threats to your business
Identify your critical activities
What would have the biggest impact on your customers, reputation or bottom line if your business were not functioning as normal? Create a list of the activities which enable you to run your business, and consider the risks to each of them.
Once you have identified and prioritised each activity, and considered the component parts that make them happen, think about what could occur to disrupt them.
The component parts and resources that make each activity run smoothly and the potential risks are outlined below.
- People - Staff shortages, such as pandemic flu, illness or strike action
- Equipment - Loss, damage or breakdown of key equipment
- Raw materials - Loss of access, supply or damage to raw materials
- Technology - Loss of IT or telecoms systems (servers, email or internet access)
- Information - Loss, theft, damage or compromise to key information (electronic or hard copy)
- Suppliers or service providers - Transport disruption, perhaps due to a fuel dispute, severe weather or supplier/contractor difficulty
- Utilities - Loss of power, water, gas, telecoms or fuel
Community Risk Register
A Community Risk Register has been compiled for Sussex and is available on the Sussex Resilience Forum website. It looks at risks on a national level and then applies them on a local level. For example, an outbreak of pandemic 'flu or severe weather.
Risk is a combination of likelihood multiplied by impact. Once you have identified the risks to your business, consider what you can do to manage them with your existing resources and what further actions are reasonable to put in place to reduce these risks.
4 Develop a business continuity plan
Take time to reflect on and then plan for the consequences of the risks identified to your critical activities. Focus on the most likely risks to your business.
Not all businesses will need a full continuity plan, due to their size, however all businesses should consider the quick wins they can adopt to provide increased resilience for very little cost.
The following sections contain key questions you may wish to consider.
- Do you hold a list of contact details for all employees that can be accessed without entering your premises?
- Can you contact essential staff outside normal working hours?
- Do you hold a list of important contacts, such as insurance company, landlord, suppliers, customers, emergency services, utilities and local authorities?
- Who are the people that make your critical activities happen?
- What skills or qualifications do they hold?
- Are other staff within the organisation capable of back filling?
- Do you have a flexible working policy, including the option of home working and flexible working hours?
- Where do your critical activities happen?
- Do you have alternate premises you could use in an emergency? Can you buddy up with another local business to provide mutual support if either of you lose access to your premises?
- Have you considered the implications to your land and asset values from extreme weather or climate change?
- Can essential equipment (computers, vehicles, tools) easily be replaced if lost or destroyed?
- Do you hold older equipment for emergency use or spares?
- Is essential equipment stored at different locations in order to spread the risk?
- Have you established delivery timescales for replacing critical assets in the event of suffering a major loss of plant or equipment?
- Do you have accounts in place for alternative suppliers in the event of transportation delays or main supplier problems?
- Have you asked suppliers if they have contingency plans?
- Can you spread the risk by storing essential supplies at different locations?
- Have you recorded what contractual obligations are in place in terms of deadlines and penalties with customers?
- Have you experienced fluctuations in raw material prices as a result of externalities, such as weather, transportation, conflict or world events?
- Do you have sufficient ‘buffer’ stock to ensure you can maintain operations if your supply chain breaks down?
- Is your essential information available even if you cannot get to your place of work or if the power is out?
- Do staff have remote access to emails or electronic information?
- Is hard copy information stored securely, for example in fireproof safes?
- Is your insurance up to date and are the documents stored securely on and off site?
- Have you recorded and archived serial numbers, product keys and software licences of company software?
- Do you regularly check backup data to ensure it is complete?
- Do you scan in important documents and archive paper records off site?
- In a crisis who would you need to communicate with (staff, customers, suppliers, stakeholders)? How can you get hold of them all and what would you need to tell them?
- Are all company mobile phones on the same network?
- Have you prepared an emergency communications plan? Is key customer liaison covered?
Your plan should also detail other aspects such as where an incident will be managed from and who will be in charge. Train and test your staff in the plan and keep it up to date as the business develops and changes occur.
5 Tips to develop staff awareness
- Include business continuity in your induction processes, including updating contact information.
- Set business continuity as a standing agenda item at your team meeting:
- Check that key contact details are up-to-date and staff and managers can access them outside of the office.
- Set expectations of staff during disruptive events. Seek to answer, "If I can't get to the office what should I do and where would I work?".
- Run a quick exercise:
- After the next fire alarm test, run a 15 minute "What if this had been real?" discussion with your team.
- Reassure staff and suppliers by testing their phone numbers.
- Consider the impacts of a loss of a key staff member or supplier.
- Download the business continuity game and test your plan - Business Continuity Scenario Generation Game (PDF, 121KB)
6 Business continuity tips
Here are a few things you can do now which might make all the difference to your business continuity.
Back up essential information
- Make sure essential information is backed up and stored securely off site – this includes paper records and electronic information. For a small business, this could be regularly backing documents up to a secure USB stick that is kept off-site, storing documents in the 'Cloud' or emailing documents to a remote computer or cloud email account.
Update your anti-virus protection
- The impacts of malware or virus attacks can be disruptive and time consuming, and may potentially destroy your business. Keep your virus protection up to date.
- Consider whether computer-based staff can access emails and other work-related documents remotely. Giving staff remote access allows them to continue working if they cannot get to the office (due to fuel problems, bad weather or denial of access to premises).
- If you can’t get into your office, can you divert your main customer-facing number to a mobile or other landline? Can you dial into your voicemail remotely? Many providers offer teleconferencing, an excellent tool to help manage a crisis.
Access to staff information out of working hours
- Emergencies do not respect working hours and you may need to get hold of key staff members on a Sunday or the middle of the night. Having access to this information will cost nothing but could prove essential.
Buddy up with another business
- Can you formally or informally arrange to provide mutual assistance with another business should either of you suffer a crisis? This may include use of premises, phone lines or internet access.
Remote website access
- If your business suffers a large disruption, many of your customers, suppliers, staff and even local media will look to your website to get the latest information. Having the ability to edit your website remotely will allow you to keep them informed.
Detailed guidance about the business continuity process is available to download in the Toolkit below. A resilience 'health check' is also available to complete to see how your business would manage in an emergency.
- Business continuity management advice (PDF, 171KB)
- Business continuity checklist (PDF, 431KB)
- Business continuity resource information (PDF, 80KB)
- Advice to businesses following an emergency (PDF, 307KB)
- Fire safety training for businesses
- Extreme weather advice
- Sussex Police - Business crime
- Environment Agency - Prepare a flood plan for your business
8 Contact details
For further help or information use the details below.
Or your local district or borough council's emergency planning officer.