Headlines about natural disasters have captured national attention over the past few years as storms, floods, and wildfires wreaked havoc from California to Texas to Puerto Rico. With natural disasters increasing in both magnitude and frequency, and the rise of man-made threats such as active-shooter incidents, companies everywhere must prepare for the worst; today, having a business continuity plan has moved from optional to essential.
While no single off-the-shelf plan will work for every company, there are specific elements that should go into the creation of every plan. Read on to learn how to create your business continuity plan—and feel prepared to meet any disaster head on.
1. Create your team.
Consider who needs to be on the planning team to make the plan most effective. The success of your plan will depend on getting buy-in and support from senior leadership—make sure they’re involved (to the extent that they feel necessary) and give them plenty of time to provide feedback to the plan. Finally, every team needs a captain. Appoint a project manager whose responsibility will be moving the project forward, assigning tasks, and writing and updating the draft.
2. Identify risks.
At your first team meeting, your task will be to highlight risks, along with their likelihood. When considering risks, business leaders often think about disasters that are common in their regions, like theft, hurricanes, wildfires, and storm surges. Rarer workplace risks, such as mudslides, terrorism, hailstorms, and workplace violence, are frequently ignored. While those events might be less likely, they are scenarios that businesses are least prepared for and can be the most catastrophic and costly. Working with your insurance provider at this step can help you identify these less-common risks—a critical step to avoiding business closure.
3. Analyze impacts.
With your list of risks in hand, you can now plan for the impacts of those perils. Your list of risks might be quite lengthy, but the impacts will differ significantly from risk to risk. Assigning an impact level to each peril will help you determine which risks to prioritize when it comes to prevention or recovery efforts.
You’ll also need to consider the impact of the perils across all business operations, including departments, employees, customers, and property. Don’t forget to include critical vendors—suppliers whose loss would severely impact your business—in your analysis. Again, leveraging the expertise of your insurance provider can frequently make this step easier and more effective; after all, this is what they do every day!
4. Determine critical business functions.
Where is your business most vulnerable, and which functions are critical to your company’s survival? The next step is analyzing weaknesses and identifying the core business operations that must continue for your company to continue on and recover. For instance, perhaps you realize that you can do without R&D for a period of time, but you know that you cannot go without a certain material supplied by a specific supplier. If disaster strikes, your resources would then shift to protecting that asset—while letting R&D go for a while. Make sure that you also factor regulatory requirements around safety and disaster preparedness into your assessment.
5. Draft a five-part plan.
Now comes the fun part: drafting your plan. Your plan should be thorough, covering five critical areas: strategy, emergency response, communication, mitigation, and recovery. Let’s take a look at all five:
- Strategy: This section will define the plan’s overall goals, scope, and the roles of various employees. The training of employees in critical roles is a key element of this part.
- Emergency response: This part offers a detailed explanation of how to respond to the various impacts identified in steps 3 and 4, including defining the chain of command and safety steps.
- Communication: How will you or your team get in touch with employees, customers, vendors, and the public? This section goes beyond emergency response to address communication in both the short and long term.
- Mitigation: This section focuses on prevention: a guide for minimizing hazards, ensuring vendor continuity, safeguarding personnel, and to provide guidance on site security and business resumption including communicating with customers.
- Recovery: The recovery section will focus on getting back to normal: identifying priorities, vital resources, and setting timelines for restoration of various operations.
6. Test the plan.
You’ve created your plan, but will it really work? The next step is testing its efficacy. Schedule a drill, and test every part of your plan. Afterwards, bring the team together to grade the effectiveness of each part. What worked? What did not? You might need to conduct a second or even third test before you get the plan to where it should be.
7. Implement and create training.
Once you have your plan working well, you’ll need to implement it. Decide how you will publish and communicate the plan to staff. Will you need to conduct a training workshop? Will everyone watch a video? Make sure to schedule annual refreshers, as well as periodic surprise drills. Lastly, store your plan in a safe place where all stakeholders have easy access to it—even if there is no power.
The success of your plan will depend on getting buy-in and support from senior leadership—make sure they’re involved.
The job that’s never done
You’ve developed a rock-solid plan, but you can never rest! Some jobs are never really done, and that’s true of business continuity planning. Don’t forget to schedule time every year to take a fresh look at the plan, identifying any changes that have occurred in the interim. Have your vendors changed? What about key personnel? You’ll need to make necessary adjustments—and then re-test to ensure effectiveness.
Planning for business interruptions is not quick-and-easy, but it’s the best way to ensure that your company will survive in the wake of a disaster. Want more information on preparing for natural catastrophes? Check out our article, Natural Catastrophes: Three Ways to Mitigate Business Risk.
This website is general in nature, and is provided as a courtesy to you. Information is accurate to the best of Liberty Mutual’s knowledge, but companies and individuals should not rely on it to prevent and mitigate all risks as an explanation of coverage or benefits under an insurance policy. Consult your professional advisor regarding your particular facts and circumstance. By citing external authorities or linking to other websites, Liberty Mutual is not endorsing them.