What is a business continuity plan?

A business continuity plan (BCP) is a vital document that holds all the critical information you need to preserve your business and its reputation in the event of an incident.

It should detail the essential functions of your business and how to maintain them. Creating a BCP is a key aspect of business risk management, just like purchasing business insurance.

A BCP covers any kind of interruption or risk including natural disasters, a cyber attack or data breach, human error, power outage, financial crisis, and even – dare we say it – a pandemic. It's also very useful if a client doesn’t pay, a supplier doesn’t deliver, or if a key person from your organisation becomes unwell or resigns.

Why is business continuity planning important?

It pays to be prepared. There’s always going to be risk in the world of business and enterprise, but if you plan now to manage those risks rather than waiting for a major event to happen, you’ll be able to get back on your feet faster, and with your reputation intact. This is the one time it pays to be a bit pessimistic and think, "what’s the worst that could happen?".

Being proactive and having a plan for how to adapt and respond to potential risks to your business is hugely important – and a key part of leadership. If you have a ‘to the letter’ response for unplanned events, you and your staff will know exactly what to do in an emergency. Saving time, money, and protecting profits in the process.

Here are some key things to consider when writing a BCP plan

Creating a BCP isn’t as complex as you might think. Before you get going, it's worth considering these things:

• What are your organisation’s key products and services?
• What are the critical activities, resources, relationships, and dependencies required to deliver these products and services (for example could your organisation function without laptops or WiFi?)
• What are the possible risks and impacts to these critical activities?
• How can you and your staff maintain these critical activities in the event of an incident (such as loss of access to premises, or loss of power)?
• What single points of failure exist? Including people, suppliers, systems, premises and resources.
• What’s the minimum number of staff needed to run key operations, and what actions do they need to perform?
• What alternatives are there for processes and internal functions?
• What skills, knowledge, and expertise are needed to recover from a specific issue?
• What's your internal and external communications plan?

How do you create a business continuity plan?

Take a look at our checklist below. It’ll guide you through what to consider when creating a BCP – including some helpful examples.

1. Complete a risk and business impact assessment

The first thing on your list is to make a risk and business impact assessment.

A risk assessment looks at the likelihood (and impact) of a variety of risks that could cause harm to your business. Knowledge is power – if you know what you’re most at risk from, you can prioritise those areas. Risks could include big external events like extreme weather such as flooding, a cyber attack, terrorism or a pandemic. This is in addition to internal challenges like lost or damaged premises, systems failure such as IT or telecoms, losing utilities, or the absence of key staff members.

It’s important to judge how likely each risk is, and how it would affect your operations and processes. Take your time with your risk assessment as every organisation is different. If you want to, you can even ‘score’ your potential risks on a likelihood scale. The government’s Business Continuity Management Toolkit shows you how.

2. Identify business critical functions

Businesses critical functions are exactly that – the main things your organisation has to do to keep the company functional and trading. Knowing what they are is essential for continuity planning. Businesses critical functions can include, but aren’t limited to:

• Basic emergency management: for example, do your staff have a plan in the event of a fire or lockdown?
• Disaster recovery: is company data backed up regularly, and will your critical IT systems survive an outage or attack?
• Supply chain management: do you have a backup supplier for a worse case scenario?
• Knowledge management: do your employees have access to trade secrets, passwords, and other intel if any key employees are suddenly absent?
• Crisis communications: do you have a communications plan for employees, customers, or the public if your business faces a big upheaval?

3. Create an emergency response checklist

For each of the critical functions you’ve identified, it's a good idea to create an emergency response checklist. This is your plan of action for the immediate aftermath of an emergency event.

Sorting out a communications plan ahead of time is one of the easiest things you can do, and it can save you valuable time in a crisis. For example letting customers know if orders will be delayed, or having template press releases and social posts for anything public facing.

4. Assign roles and responsibilities

Your BCP should have clearly defined roles and responsibilities for it to work smoothly – and if you’re a bigger business, the full support of senior management.

It needs to list all the key people involved in its implementation, as well as a person or team in charge of managing and coordinating the whole plan. Plus – if you’re a larger business – their contact details. But even if you’re a sole trader, including a list of key contacts like utility companies and suppliers is a smart move.

5. Test and communicate

Your final step is to make sure your team members and stakeholders know the plan exists. And to make sure it works. This could include training staff, running a live test, or reviewing the plan regularly. Much like business insurance, you should see your BCP as an important safety net.

The four main types of BCP review are:

• Testing: Testing your back-up power, communications equipment, and information management arrangements is a good start.
• Discussion: Cheap and easy to run, discussions bring staff together to inform them about the plan, talk about responsibilities, and book in any training.
• Table-top: This is a round table rehearsal of a specific scenario, in preparation for a real event.
• Live exercises: This could be a small scale test of one thing, like an evacuation – or a full scale test of everything!

Protect your business from the unexpected

‘By failing to prepare, you are preparing to fail’

It’s always a good idea to expect the unexpected, especially in business. And nothing is more useful in a crisis than being prepared. It ensures as much safety as possible for you and your employees.

A combination of a thorough BCP, and business insurance gives your organisation the best chance of recovering quickly from a crisis. And having a BCP proves to insurers that you’re taking safety seriously. In the event of system outages or cyber attacks, there’s also specific cyber insurance to protect you too.

You may also like:

• What is SWOT analysis, and how do you do one?
• How to write a business plan
• 4 growth strategies for your business
• What is business turnover, and how do you calculate it?