Continuity Planning
You don’t expect your home to burn down. However, you buy insurance to be prepared for the worst.
Similarly, you don’t expect uncontrollable events to disrupt the operation of your business. But if they do, a Business Continuity Plan (BCP) can be the insurance you need to stay afloat during dire circumstances.
This BMO Bank of Montreal® guide is designed to provide you with general information about creating a customized BCP. This guide will illustrate examples of what businesses typically consider in trying to determine the kind of unexpected events that can impact a business and how they plan to minimize potential disruption and damage.
It can happen
As anyone who reads the newspaper or watches news on TV knows, catastrophic events occur continually throughout Canada.While most of us are only touched by them from time to time—an ice storm or electrical blackout—some are struck by the full force of unexpected events with devastating consequences.
The goal is not to panic; simply be prepared.
For example, H1N1 Virus has been in the headlines with many experts predicting a pandemic. If this occurs, you may need to operate your business with 30% to 50% fewer employees for a long period of time.Management may be disrupted. Your suppliers and customers may be affected. There may be restrictions on travel.
If your business is caught off guard, operating at close to normal may be difficult. However, with a BCP, your staff may be well prepared to carry on effectively in a difficult situation.
For example, should a disaster such as an H1N1 Virus pandemic strike, with a thorough BCP in place:
- priority services and operations will have been established
- staff will have been trained to handle the jobs of co-workers out sick
- guidelines will exist to minimize face-to-face contact and maintain hygiene i.e., hand shaking, seating in meetings, providing masks
- policies for flexible hours and alternative compensation will have been established
- a list of alternate suppliers will be available
- countless other contingencies that apply specifically to your company will have been considered and planned for
- your employees will have read your BCP and will be ready to take appropriate action.
Continuity Planning
Step 1: Identifying potential threats
Your BCP starts by recognizing the potential threats that could impact your business. Some threats such as floods and earthquakes are likely to be of greater risk to some areas more than others. In the sample list below, check off the potential threats that could realistically affect your business. Add any threats that could affect your specific business.
- Disease outbreak
- Essential services failure (power, telecommunications)
- Transportation accident
- Flooding
- Water shortage or contamination
- Severe weather conditions (blizzards, tornadoes)
- Fire
- Labour walkout or strike
- Supply chain interruption
- Earthquake (Central Canada is in an earthquake zone too)
- Technology collapse
- Terrorism/sabotage/cyber terrorism
- Bioterrorism
- Environmental disaster (hazardous materials spill)
Continuity Planning
Step 2: Assess the risks
Risk, in this case, is defined as the sumof probability of occurrence plus the impact on your business. Impact is determined by analyzing the effect on your revenues, customers, employees and property.
One simple way to assess risk is to create a scale of 1 (lowest) to 10 (highest). For each potential threat, use the scale for both probability and impact.
For instance, the probability in your area for a flood might be low (2) while a computer hacker attack may be high (8).
The impact of a flood might be medium (5) while the impact of a hacker attacked may be very high (10).
In this example, the flood risk is 7 (2 + 5) and the hacker risk is 18 (8 + 10). The priorities of the BCP should be focused on those threats with the highest total.
You will need to determine the best way to assess the risks associated with your specific business, seeking professional advice if necessary.
Continuity Planning
Step 4: Analyze the impact of a business disruption
To be prepared for a crisis, it’s important to recognize the likely impact on your business. Here are some examples you may want to consider:
- If a critical service or business product is disrupted, how long could your firm function? For how long would your clients tolerate such a disruption? Determine the amount of time you have to get back up to speed before your business is severely affected.
- Determine your potential loss of revenue. Consider which services and products produce revenue and the effect if they are lost for various time periods. Will your clients go elsewhere resulting in further revenue losses?
- What will your expenses be if a business function is not operating. Will you have to hire extra personnel? Will you have to make higher-cost purchases from alternate suppliers? If you can’t meet deadlines, will you be in breach of your contractual responsibilities and have to pay penalties?
- Will you be able to deal with additional expenses through cash flow and lines of credit? Establishing a good relationship with your banker allows them to understand your business and provide options when your business experiences unforeseen financial challenges.
- How much of your potential revenue loss will be covered by insurance? How quickly will your policy pay claims in an emergency?
Continuity Planning
Step 5: Create an Action Strategy
As part of your company’s BCP an Action Strategy should clearly outline the steps that need to be taken to maintain your services /functions in the event that a potential threat becomes reality.
For each service/function, starting from most critical, you may want to develop an Action Strategy for:
1. People
- Develop a decision-making chain of command.
- Ensure alternate staff are trained for critical functions.
- Create work-at-home policies.
- Reduce hours of service.
- Expand shifts for employees.
- Create car pools for employees who depend on public transit.
- In the case of communicable disease threat, set policies for hygiene and minimizing contact between people.
2. Operations
- Equip home offices.
- Establish conference calls and schedule regular contact with remote employees.
- Identify alternate suppliers.
- Develop alternate and simplified processes.
3. Facilities
- Consider other sites for your business.
- Identify those spaces that need priority repair.
4. Information
- Ensure all data is backed up and stored off site.
- Maintain hard copies of essential documents.
- Develop priorities for restoring IT infrastructure.
Continuity Planning
Step 6: Implement your Action Strategy
If you’ve gone to the effort of protecting your business with a BCP, ensure your Action Strategy will work through training and testing.
- Employees should be briefed on the contents of your Action Strategy and understand their individual responsibilities.
- Employees should be trained for the additional tasks they will have to assume in an emergency.
- Develop simulations to ensure employees can handle their responsibilities competently.
- The parts of your Action Strategy that can be tested should be – such as handling a new function, car pooling, working from home.
| 
