All companies, however large or small, should have a continuity plan. The plan is vital to assist business to continue when affected by a natural or man-made disaster.
The plan should consider the risks to your business, i.e. people, physical assets or systems and the negative impact on the business if any or all of them are affected.
The following information is Crown copyright from the Centre for the Protection of National Infrastructure.
Business Continuity Planning
Business continuity planning is obviously not just driven by terrorism, but it would be critical to your business's survival if it was affected by a terrorist incident. And the benefits have an even wider impact. Every year nearly one in five businesses suffers a major disruption, and planning to deal with those disruptions is widely regarded as good business sense.
Effective business continuity planning is critical to ensuring that the essential functions of your business can carry on despite an emergency.
Many businesses will already have plans to deal with sudden commercial risk. These may include events such as the failure of critical suppliers, an unexpected bad debt, industrial action or the discovery of a serious fault in a product or process. Planning for the aftermath of terrorist incidents is very similar. Emergencies can jeopardise your organisation.
Consequences for your organisation
A major terrorist incident could have the following consequences:
- Damage to your buildings
- Loss of IT systems, records, communications and other facilities
- Unavailability of staff because of disruption to transport or their unwillingness to travel
- Loss of staff through death or injury
- Adverse psychological effects on staff, including stress and demoralisation
- Disruption to other organisations and businesses on which you may depend
- Damage to reputation
- Changes in the business demands placed on your organisation.
You will need the right resources to maintain your critical business functions following a disruptive event. These are likely to include:
- Sufficient people with the necessary expertise and motivation to lead and manage the organisation
- Access to key records and IT systems
- Reliable means of communication, especially with your staff
- The ability to carry on paying staff, to ensure their safety and to provide them with welfare and accommodation
- The ability to procure goods and services
- The ability to respond to demands from the media.
Develop a business continuity plan in a systematic way
The booklet 'Expecting the Unexpected', jointly published by the police, National Counter Terrorism Security Office, London First and the Business Continuity Institute, outlines five steps that you can follow to develop a business continuity plan:
- Analyse your business. Working with the full support of senior management, you need to understand your business and the way it works, including which functions are essential and where vulnerabilities lie.
- Assess the risks. You need to understand what emergencies might affect your business and what impact they would have. By focusing on impacts rather than causes, you will make sure your plan allows you to deal effectively with an incident, no matter what the source.
- Develop your strategy. You will need to agree with senior management the organisation's appetite for risk. You can then decide which risks can be accepted, which risks can be reduced and which risks should be managed using business continuity planning.
- Develop your plan. You should then develop a business continuity plan covering the agreed areas. All plans look different, but they should be clear about roles and responsibilities, easy to understand and open for consultation and review around your organisation.
- Rehearse your plan. Rehearsal helps you to confirm that your plan will be connected and robust if ever you need it. Rehearsals are also a good way to train staff who have business continuity management responsibilities. Lessons from exercises can be used to refine your decisions in steps one to four.
What you can do immediately
If you do not have a business continuity plan in place then consider how best to make your organisation more resilient while the plan is being developed. Designate a crisis management team led by senior staff, incorporate succession planning for key personnel and organise a robust telephone and/or e-mail cascade system for contacting staff outside working hours.
Make sure copies of essential data or records are stored off-site and that IT systems can be accessed from other sites. Staff may continue to work from home if they have remote access to your IT systems.
Ensure that you have robust banking and financial arrangements so that you can continue to make payments and sustain your business.
A wide range of advice on business continuity is available, much of it free.
The Government's Preparing for Emergencies website provides extensive information for business (including 'Expecting the Unexpected') and links to key organisations. More detailed advice for business continuity professionals can be found at UK Resilence and www.mi5.gov.uk.