Consider this scenario. Your business is located in a hurricane zone. A strong hurricane is approaching and is expected to make landfall on Monday. Do you expect your employees to secure your business over the weekend? Or will they be doing what they need to do to safeguard their families and personal property? What if you can’t reach key employees after the hurricane?
Or consider this. You conduct the majority of your business online. The regional power grid fails and isn’t expected to be fixed for 72 hours—if all goes well. How will you process orders or provide service? How will you communicate with your clients? How will you protect your building from looting after dark?
According to the Insurance Institute for Business & Home Safety, 25 percent of businesses that close due to a disaster never reopen. Small businesses are even more vulnerable, according to the Federal Emergency Management Agency (FEMA), with 40 to 60 percent failing. While you can’t always prevent catastrophes, you can plan for them. And if you plan, your chances of business survival increase.
What Is Business Continuity Planning?
Business continuity planning, also called business interruption planning, is the process of preparing your business to operate with as little downtime as possible before, during and after a natural or man-made disaster. Those disasters could include things such as catastrophic weather events, cyberattacks, civil unrest, acts of terrorism and active shooters, pandemics and other disruptive events. Losses could occur from both direct and indirect impacts.
Having a plan in place before you need it can be the difference between business recovery and business failure. And there is a second benefit to having a plan in place: Any controls you have in place to show proactive readiness related to emergency needs is a plus from a business insurance underwriting perspective and can have a positive impact on coverage costs. The first step? Involving the right people.
Assemble the Planning Team
The creation of a realistic, effective business continuity plan requires the input of key people throughout your enterprise. Having multiple perspectives gives you the most complete picture of how your organization truly works during a normal operating environment and will help you understand what adjustments will need to be made in an emergency.
Your team may consist of some or all of the following:
• Senior executives
• IT personnel
• HR personnel
• Sales personnel
• Facilities managers
• Operations managers
• Supply chain and procurement managers
• Employees who work daily with your customers, suppliers, business partners and others
You also may find it helpful to consult with key service providers, contractors, local government agencies and other resources as you assess your business vulnerabilities and develop and test your plan.
Assess Risks and Impacts on Critical Business Functions
Begin your planning with a risk assessment. Consider all the hazards your business could face, how likely they are to occur and the potential severity of their financial and operational impact. The following information from the U.S. government could be helpful in guiding this conversation:
Next, identify and prioritize your critical business functions, the essential operations for staying in business. While everyone’s daily activities are important to the functioning of your business, remember that not all activities are critical to business survival during a crisis.
Timing is a key component of defining what is truly critical. Consider how long each function can be nonoperational before it negatively—and possibly irreversibly—impacts your customers, your contractual obligations, your legal obligations, your employees or your reputation. Seasonality is another consideration in setting priorities. If disaster strikes during your busiest season rather than a slower season, how would that impact your ability to continue doing business?
Armed with an understanding of what your business priorities need be during an event, it’s time to plan how to address them.
Mitigate Risks and Plan for Business Continuity
Understanding where, how and to what extent your business is most vulnerable, the next steps are to:
• Mitigate risks, where possible
• Plan recovery steps for prioritized business operations
Mitigation is taking action to prevent whatever foreseeable losses you can ahead of a disruptive event. For example, in a location where fire is a known threat, a business could remove trees from around its facilities and regularly perform tests to ensure that its sprinkler systems function correctly. Where strong windstorms are a substantial risk, an annual roof inspection and maintenance could help prevent catastrophic damage.
For risks that can’t be mitigated, preparation is the key. Your business recovery plan should include the people, actions and resources necessary to resume critical business functions within the timelines identified as part of your risk assessment. Also consider the following:
• What will trigger the need to implement the business continuity plan?
• Who will make the decision to implement the plan?
• How will that decision be communicated throughout the organization, when and to whom?
• Who will be part of the recovery team, and what are their specific assignments?
• How will ongoing emergency communications take place?
Consultants and technologies exist specifically to help companies with this planning process. But it also can be helpful to network and learn how other companies approach the business continuity planning task, as well as to search online for templates (such as FEMA’s business continuity plan template), plan examples and other resources.
Once your team has created a workable, fiscally responsible plan, two steps remain: making sure the plan works, and making sure the plan continues to work.
Test and Refresh the Plan
Create a test scenario—a worst-case scenario—that would disrupt your business. Then gather the team. It’s time to see if your plan holds up under pressure, before you face the situation in real life.
You can test your plan several ways. First, you may want to gather the planning team and anyone with plan responsibilities into a room and have them work their way through it. Look for weaknesses and gaps; they are much easier to plan for now than during a real emergency. Answer the following questions:
• Do team members know where to find the plan and how to access it?
• Is the plan information complete?
• Is the plan information accurate, especially contact information?
• Are the necessary steps in place?
• Are the steps in the right order, given your priorities, and especially if there are interdependencies? Are there any questions about them?
• Have the right people been included and trained how to respond?
• Does the business have the right materials, supplies, people, etc. on hand (or standing by) to sustain the business in this scenario?
A second test type is a literal walkthrough of your business. Managers or department leaders and their teams walk through the plan steps, looking for issues while also internalizing the process. The more knowledgeable and comfortable people become with the plan, the more unlikely they are to panic if they have to implement it later.
A third test type is simulation, where teams work with the resources available to them to address the issues presented by the test scenario. Pay special attention to how well the plan works when it depends on multiple people and teams working together or handing off actions at certain stages. Also consider whether you have developed manual workarounds for anything reliant on power or types of technology that may not be available to you during a disaster scenario.
After testing, the response team should refresh the plan to fix any flaws or gaps. To ensure the plan can be implemented and is up to date when needed, it should be tested and refreshed at least annually—more frequently if there is large personnel turnover or business changes. According to FEMA, “20% of larger companies spend over 10 days per month on their continuity plans.” In contrast, another 20% spend no time maintaining their plan. During a crisis, which business plan would you rather rely on?
Business continuity planning takes work. Keeping the plan fresh and effective takes commitment. And putting the necessary materials, systems and people in place before a catastrophe can take time and money. However, it’s easier and less costly to protect your business if you mitigate risk and plan thoroughly before you are faced with disaster.
Every business is different, so every business continuity plan will be different. But there is one constant: people, your most critical business asset. During your planning, don’t forget to consider what your employees’ professional and personal needs will be during a catastrophic event.
Your Hylant risk advisor can assist you in identifying and mitigating risk. Contact us if you would like to discuss your business.