Business Continuity Planning (or what happens to your business during Armageddon…..)

The Business Continuity Plan. Oh dear.

We arrived at work fresh on Monday morning, booted up the ol’ PC’s and undiverted the phones. Just a regular Monday morning until………. zaaaapppppp.  The office was overcome by darkness.  Something about water pouring out of the electrical switch board – now THAT can’t be good!

Luckily for us, our neighbours Bold Design Kitchens came to the blackout party with extension leads and a wall socket to get us going again quickly, with very little down time.

This got me thinking about Business Continuity Plans and how despite having thought out a gazillion different potential ‘disasters’ (and having done the appropriate testing), you simply can’t foresee everything. So, I figured while I’m updating our plan with this new scenario, I’d share some thoughts around the process -juuuuust in case yours needs a little refresh.

So, what is a Business Continuity Plan and why is it important?

A Business Continuity Plan (BCP) is a document that steps out how your business will operate during a power outage (ahem), a natural disaster, machinery or equipment breakdown, tech issues, Armageddon………

The document answers the questions that need to be answered when time is critical and business just needs to happen.

The starting point of a BCP is a thorough analysis of each department within the business and the role each person plays in keeping your business operational.

You can find a number of BCP templates during a quick Google of the glorious World Wide Web, in particular the QLD Government has a brilliant model called PPRR (Prevention, Preparedness, Response, Recovery)  – but I’ve popped a few thoughts below to get you started in thinking about your own business needs should the world end.

What is the issue?

Hitting hard for the big first point. What’s actually happened that’s caused your business to stop?

Has a bus hit the power pole out the front knocking out your power and telephone? Has a nasty flu virus spread through the office rendering the team out of action for 2 weeks? Have you been evacuated due to bushfire? All three of these events have happened to us. They aren’t outside the realm of possibility.

The following categories of events can give you something to think about:

Who needs to be advised?

Who are the key people in your business who need to be advised of the issue? These are the people who will disseminate information down to the team and keep everything moving along. It is important that the right people know the right information and, through testing of the BCP, understand the role that they and their team play in getting the business up and running again.

Who is impacted?

A business impact doesn’t necessarily impact all of your business, maybe it only impacts one team or department. It’s important to be really clear about who is/could be impacted. Think about any flow-on effects for the greater team and what processes could be implemented to segment off teams/department during an incident.

Do you have a physical book that contains your procedures and, what manual workarounds are in place?

This is a game changer for all businesses. Back in the day I worked for a Big 4 bank. If the power went out and you had someone in your branch who had been around prior to 2006 (everything went digital in 2006, including the manuals) you were considered absolutely blessed. What happens to online manuals when the power goes out? They can’t be accessed and no one knows what to do. Imagine how that impacts a bank branch on pension day……

How would something like that impact your business?

What system/process is impacted?

If, like a good portion of Australian businesses, you use a SAAS program to run say, your ordering system, what happens to your business when that system goes down?

Say there was a DDOS attack, as we have seen over the last few years, that meant you were not able to complete that function of your business for what could be days, or weeks. How will you cope? How will you continue with a manual version of that system or process? Do you even have a manual version of that system or process?

These are the things you need to figure out.

Who will make the decisions?

Ahhhh, a very key point in times of a crisis. Too many chefs, too many chiefs, too many alpha’s in the room.

Emotions are running high, there is tension in the air. The BCP needs to step out specifically who is in charge overall, who is assumed in charge if that person is not around and what are the responsibilities of the key people in the business during a time of crisis.

Don’t make people think about it, spell it out clearly and let people get on with the job.

How will people be contacted to advise of the issue and that the BCP is in play?

Clear and concise communication is paramount during an incident. Your BCP needs to step out who needs to be contacted and how that contact will occur. This can include clients, suppliers, delivery providers etc.

If company phones and email are down? Ask staff to call from their personal mobiles (and, of course, reimburse any costs incurred). Need to let clients know you are out of action, a funny Facebook post can let that happen and can help to keep communication open between yourself and your customers, don’t forget to post again to let people know you are back up and running.

What IT requirements do we need our team to be able to access remotely?

IT are an interesting beast. They speak in a language we mere mortals don’t understand and are capable of making things happen with the literal press of a few buttons.

If your IT are in-house, it’s likely they will have their own special BCP in place. If you outsource this function it’s really important that your provider can provide a copy of their BCP to you so that you know what impact might occur to your business and how your IT provider is going to manage that.

I’d be ensuring that my contract steps out very clearly what will happen when your business has a tech issue that your outsourced provider is in a position to support your business during that time and what the process is when your provider has an internal tech issue.

If they can’t provide that information, consider doing a little more research into other firms.

Will your team need a workspace to operate out of or can they work remotely?

What resources will your team require while working offsite? Telecommunications, vital records, tech. If you are in manufacturing what options do you have to outsource your production for a short period of time if needed?

There are companies around that can provide emergency office workspaces for your team should the need arise.

Does your insurance cover lost time due to natural disaster, tech disruption, other business disturbance?

Check with your insurance provider to see what assistance is available to you should you need to engage your BCP. They may be able to assist with emergency premises, helping to arrange replacement tech or a payout for lost time/goods.

Your BCP should be regularly reviewed, say every 12 months or so or any time there are significant staffing changes that warrant an update. The BCP needs to be housed in an easily accessible place both online and in multiple hardcopies. Included within the file/folder should be an up to date contact list (including, all staff and emergency services, along with key contacts for clients and suppliers), evacuation plan, incident management plan and recovery plan.

The whole point is to keep your business as operational as possible during an incident while maintaining employee safety and security of your site, IP and assets.

If you find yourself in a pickle during a crisis or disturbance within your business, our short-term loans can be turned around quickly to help you to ride the wave of disruption. Contact us here to find out how we can help.

If you want to know how we rolled into the office on Tuesday, safe in the knowledge that our BCP now accomodated power outage, check the video below ;)