Planning for medium-sized business
This is a basic five-step guide to get you started on business continuity planning for a medium to large sized organisation. Use the links below to go to each section, or you can download and print a more detailed strategy for medium-sized businesses.
- Step one: Analyse your business
- Step two: Assess the risks
- Step three: Develop your strategy
- Step four: Review your plan
- Step five: Train your staff
Step one: Analyse your business
The first step of a business continuity plan is to think about the parts of your business that are crucial in keeping it going.
You might find it helpful to approach this stage by asking two questions:
- Where is your business most vulnerable?
- What would be worst for your business?
Answer both of these questions in relation to the following:
- Staff
- Customers
- Suppliers
- Systems and processes
- Partnerships
- Buildings
- Timescales
Then try categorising the information into business critical activities. You should end up with an overview of your business operations and a categorisation of all the processes/areas, highlighting those aspects that are essential to running your organisation.
Before proceeding to the next step, ensure a senior member of staff/ board member agrees with the initial analysis.
Step two: Assess the risks
Your next steps are to look at the most likely and greatest risks to your business. This stage should involve a senior member of staff and co-ordinators. When running through these hazards, ask yourself the following four questions:
- What might happen?
- How likely is it to happen?
- What preventative measures do we have in place?
- How long would the negative impact last?
Before you look at risks in the individual parts of your business, think about what overall factors would mean a disaster.
Any incident can become a disaster if it is not managed properly. If a business is correctly prepared for a disaster, then a lesser incident should be easily managed.
Use the table below as an example to create a similar checklist for your company. You are looking at the likeliness of something happening and your preparedness. This will show your current strengths and weaknesses in disaster management.
| Grade 1-5 most/ least prepared | Scenarios | Grade 1-5 least/most likely |
|---|---|---|
| Power failure | ||
| Building fire | ||
| Loss of telecommunications | ||
| Flood/building cordoned off | ||
| Suppliers' delivery or service problems | ||
| Your customers cannot pay you | ||
| Your employees cannot get to work for a few days in a row |
What will the impact be on your business?
Now you need to think about how different elements of your business will be affected by different risks. Again, use the table below as an example and create your own to suit your organisation.
| How will your customers be affected? | Impact |
|---|---|
| If there are delays in delivering the goods/ services? | |
| If they see the incident on the news? (Do you have PR response ready?) | |
| How will other stakeholders be affected? | |
| Staff? | |
| Suppliers? | |
| Shareholders? | |
| Local community? | |
| Business neighbours? | |
| If you share your premises with other companies: | |
| What will happen if you are denied access to the building due to another company's accident? | |
| Does your landlord have a business continuity plan? | |
| How will your financial systems be affected? | |
| Do you have company financial details off-site? | |
| Do you have back ups of recent transactions? | |
| Will you be able to pay your staff/ suppliers? | |
| Other issues to consider | |
| Do you have insurance cover details off-site? | |
| Do you keep a contact list of staff off-site? | |
How long can your business last during/after an incident?
Some companies can function for a long time during a crisis; others are more at risk and can suffer from the smallest of incidents.
You need to establish how long your business could function at a reduced level and what that level is: consider how much you can afford to lose if you are unable to run your business for days/ weeks/ months. I.e. should your business be forced to run at only 50% its normal activities, 20%, 80% etc? Make sure you know your break-even point!
For more help in assessing your risks, use our quick interactive risk assessment tool and download the risk assessment checklist.
Step three: Develop your strategy
You have established what is important to the survival of your business and what the risks are. Now you can write the plan. Be sure to use non-technical language, making it accessible and easy to understand by everyone. Include:
- Statement of purpose
- The structure of the crisis team(s)
- Business recovery
- Work area recovery
- Technology recovery
- PR
- Staff focus
- A description of the premises
A. Statement of clear purpose of the plan
The statement should outline the direction the plan will take in case of an incident and include a clear statement on how risk averse you are. At this point you should also include a statement of support by senior management to install confidence amongst employees.
You might find it helpful to classify what you consider to be a disaster within your statement, for example a standard definition may be: "any unwanted significant incident which threatens personnel, buildings, or the operational structure of an organisation which requires special measures to be taken to restore things back to normal". (Definition taken from part 2, ‘How Resilient is Your Business to Disaster’, Home Office publication, 1997.
B. The structure of the crisis team(s)
Everyone in your business should know when emergency plans should be implemented and who has the authority to implement it. Your crisis team should take account of staff being on holiday or sick, so make sure at least two people understand the same role.
Make sure that all levels of staff involved in business recovery understand the nature of threats and the importance of planning. Allocate a list of suitable locations where your business continuity team should meet, if an incident occurs. This should consist of a room on-site, or a place in a public building, e.g. local hall, someone's house or a meeting room at your alternative fall-back site.
When developing your tasks for the crisis team, it’s worth dividing it into two parts:
C. Business Recovery
Develop practices and procedures to mitigate risk and preserve your reputation if business operations have been affected. Include the priority tasks that must be addressed if the business has to relocate, including communication with clients and service providers during the period of disruption.
Make sure that at this stage you have the answers for the following:
| Things to consider when developing your strategy: | Answer |
| What are the three most vital things to your business? | |
| What is the weakest link in your business? | |
| What are the three worst-case scenarios for your business? | |
| What effect will they have on your business? | |
| What preventative measures can you take to minimise the possibility of the worst happening? | |
| What measures can you take to minimise the effect it will have on your business? | e.g. prepare an off-site location to work from etc. |
Make a copy of this list and update it regularly (at least quarterly), and preferably monthly.
The members of the crisis team should be supplied with simple check lists of the actions to take during and after an incident. Using brightly coloured cards or paper is a cheap way of ensuring that people know they are using the most up-to-date version The lists should be accessible at all times and in several locations, electronically and in hard copy.
D. Work area recovery
This could be the key aspect of your plan. If you intend to work from another site, there are several options to consider:
- You might decide some staff can work from home temporarily.
- You might have made arrangements to use another company's facilities.
- A 'cold site' agreement, usually provided by a business continuity supplier, involves erecting a temporary building. You will usually be able to move in after about 12 days.
- Or a 'hot site', also usually provided by a specialist continuity company, makes desks available within about 4 hours. This option is easy to rehearse, but relatively expensive.
E. Technology recovery
Most businesses nowadays have complex IT, telecommunications and utilities' structures in place and your emergency strategy should take this into account.
- IT: It is imperative to keep inventory lists of software and hardware, as well as suppliers so that you can replace equipment immediately if needed. Download a PDF of software and hardware inventory lists. Customise inventory lists according to your needs. It is worth checking in advance if your insurance covers the replacement of damaged items immediately, or whether you need the insurance company's consent.
- Telecommunications: Make a list of all the access numbers and keep them safely on and off-site. Check whether you can access your telephone system remotely or set up re-directs to other lines.
- Utilities: Have a list of all of your utilities' providers, their contact details and your account numbers.
F. Public relations
The PR process can make or break a company's reputation. PR will influence how existing and potential customers, suppliers and all other stakeholders will react to the incident.
Nominate a company spokesperson, and ensure that all staff know who it is. For resilience, make sure more than one staff member is nominated and that they have some training in media handling. Key points to remember are:
- Make certain that the story is the same from all sources: if the emergency services are involved, co-ordinate your information with them.
- Possibly hire a PR consultant.
- If you cannot keep all your staff on site during recovery, it is essential to keep them well informed about progress.
G. Staff focus
Consult your staff when drawing up the plan. This will ensure that they feel part of the plan and will be willing to participate fully when something does happen. Be sensitive how you communicate your plan: the phrasing 'essential staff' or 'vital departments' suggests that some of your staff are not as important as others. Make sure that you have plans in place to take care of your employees once an incident does occur.
H. A description of the premises
This is important for evacuation purposes. Clearly mark where the emergency exits are on plans of your premises. Also, include lists of the contents of your premises for insurance purposes.
Step four: Review your plan
It is worth discussing your plan with other groups and reviewing it based on their feedback. Key people/organisations to consider are:
- Find out what emergency services need to know in case of an incident. They also offer security and evacuation advice.
- Find out from your local authority emergency planning officer what they would do in response to a major incident or terrorist attack.
- Keep in touch with neighbouring businesses. How can you help each other?
- Find out what information utility companies will need in case of an incident.
- What information will your insurer need from you?
- Ask key customers and suppliers how they would like information communicated to them if an incident occurs.
Cost
Make an early assessment of the likely costs involved in creating and maintaining your plan, and budget for it. It does not need to be expensive, and many insurers will drop insurance premiums if you have a business continuity plan.
External help tools
Our suggestions and templates for plan development should be sufficient, but there are off-the-shelf plans available from bookstores or on the Internet.
Step five: Train your staff
Once the plan has been developed, it needs to be tested to make sure your ideas will work in practice. For successful training you should:
- Make sure all your staff have a copy of the plan.
- Ensure that key staff have read through the plan and understand their own role and particular responsibilities.
- Give staff an opportunity to ask questions and clarify issues as they might highlight some aspects that need to be changed.
- Remember to incorporate any learnings from the testing into your plan.
For more details on this aspect of perfecting your strategy, read our section on practising your plan and communicating your strategy.
To see how other UK businesses have coped with real emergency situations, take a look at these case studies.
