Perhaps you’ve heard the fable about the ant and the grasshopper. In summer, the carefree grasshopper hops and chirps happily, while the ant stoically collects food for the winter. How will this story end, and what does it have to do with business continuity?
1. What is a business continuity plan?
A business continuity plan (BCP) serves to keep people safe, and provides guidelines on how to prevent, respond to and recover operations quickly in a disaster and its aftermath. Or, more formally, a business continuity plan definition is that a company has an established set of procedures to ensure that core operations will continue during emergencies or other disruption. When sudden or unexpected events strike, the importance of a business continuity plan becomes clear.
So let’s look at how our story illustrates this. The ant toils in the hot sun every day, gathering food. But the grasshopper continues to play without a care in the world. When winter comes, the ant feasts on the kernels of corn he has gathered one by one, while the grasshopper is starving. Then the grasshopper understands, “It is best to prepare for the days of necessity.”
Of course, the arrival of winter is not an unexpected event for anybody – except grasshoppers, apparently – but being prepared for the worst is the focus of business continuity planning.
2. Why is a business continuity plan important?
It should be clear by now who needs a business continuity plan. Basically, everyone. Companies, of course, but also organizations including Deutsche Bank, World Health Organization, and the US Federal Emergency Management Agency (FEMA), as well as many professional sports teams. Sports teams? With millions of dollars at stake, their business continuity planning includes having a talented second string in case a star player is injured. And think about other groups that have back-ups for key staff. Theater actors have understudies, and schools have substitute teachers, for example.
These examples show that for organizations who provide services, as well as those that manufacture products, the purpose of a business continuity plan is to ensure that operations continue despite disruption. It enables companies to deliver critical products and services safely and smoothly, while meeting their legal, regulatory, and other obligations. And, for enterprises that rely on a supply network, your business continuity plan must include supply chain risk management. And, in turn, business continuity planning should be included when managing your supply chain risks.
This requires integration of an SCRM program that does more than assess your key suppliers, because disaster can strike during transit, in the entire country, or even at your own facility. And your SCRM should do more than just monitor risk. You also need to be able to assess and mitigate risk, in other words, your SCRM should include these business continuity planning aspects. The Sphera Solution™ monitors your entire supply network in real time, and sends out early warnings at the first sign of distress, so you can take corrective action quickly to keep core operations running.
3. What does a business continuity plan typically include?
One common approach breaks down business continuity management in four simple stages: Plan – Do – Check – Act. Even complex international requirements, notably the ISO 22301 business continuity management standard, base their structure on this cycling approach.
- Plan Identify what you want to protect. Develop action plans for response and recovery. Establish and assign necessary duties in advance.
- Do Perform business impact analysis and risk assessment. Identify risk mitigation and response options. Test your response policies and procedures.
- Check Monitor and review program effectiveness. Communicate performance.
- Act Improve the program where needed. Standardize and institutionalize validated procedures and processes. Repeat the cycle.
Each stage of this clear, concise model houses many complex business continuity plan components. When getting started, you can use a business continuity plan template, and divide these four main categories down further into subject areas including leadership, operations, support, for example. Once established, your business continuity planning process includes performance evaluation and continual improvement for each sub-area as well, because you must assess each part of your plan and, if necessary, make changes to make sure it is effective.
Depending on your type of business, you might want to use a business continuity plan from industry-specific or government sites such as FEMA. Such resources often include a business continuity plan checklist of what to include in your plan, provide guidelines for your industry and specific activities during an emergency. Another useful resource for the coronavirus pandemic aftermath is our Sphera Supply Chain Recovery Bundle, which can help you move from crisis mode to tactical recovery to long-term supply chain resilience.
4. How to write a business continuity plan – 5 main elements
Using a business continuity plan questionnaire, you can begin by listing your business objectives, and detail which company assets you absolutely must save. Your business continuity strategy will include the four stages of planning mentioned above, and the sub-areas should include details of people, property, policy, processes, partners. Here are a few examples of what or who this includes:
- People: key program administrators, or experts to contact
- Property: essential assets, equipment, facilities
- Policy: understanding and setting priorities
- Processes: what to do to maintain continuous operations
- Partners: businesses to notify immediately
5. What is business continuity management?
Business continuity management (BCM) is the umbrella strategy that is executed through the use of business continuity plans. It is the holistic approach to making sure companies have the required resources, information, and capabilities to deal with emergencies and similar unexpected events. And as mentioned, business continuity management goes hand-in-hand with supply chain risk management.
Not surprisingly, business continuity planning and supply chain risk management contribute to resilience. Dr. Arash Azadegan, Associate Professor of Supply Chain Risk Management at Rutgers University, uses a comparison with insurance to illustrate their fundamental value. The benefits from insurance only show themselves when there is an adverse event, whereas business continuity planning and risk management positively affect organizations even if nothing bad happens. Some benefits for organization when implementing a business continuity plan are reputational: trust, public perception, stability, and employee loyalty.
Azadegan has studied the ripple effects of supply chain disruption, and how business continuity management combined with risk management capabilities serve to maintain stability during a crisis. And although companies may never have to activate their business continuity plan, by creating it, their communication processes become better aligned. They are more risk aware, which gives them a better chance of surviving in a wide range of circumstances. In other words, greater supply chain resilience positively affects the company’s financial strength.
6. When should a business continuity plan be updated and maintained?
To be effective, a business continuity plan must be a living document. In other words, the BCP should be regularly reviewed and kept up to date to reflect any changing conditions. You never know when adverse events will strike – and you don’t want to be surprised by them when they do.
Maintenance is often managed by a business continuity planning owner, a designated person who decides when to activate and to deactivate the business continuity plan based on clear criteria and procedures. This owner will also decide whether to activate all or part of the plan.
To manage and maintain the program, larger companies will most likely use business continuity planning software, which may integrate with vendor management software, or support the company’s disaster recovery plan (DRP) for its IT-infrastructure and data.
7. What is the difference between a BCP and DRP?
Similar to a business continuity plan, a disaster recovery plan outlines an organization’s response to a natural or man-made disaster. The difference is that business continuity planning includes comprehensive measures, and the disaster recovery plan is basically a subset of these activities. In most companies, these are primarily related to recovery of critical data and IT-infrastructures, because cyber risk is an ever-present threat. At its simplest, disaster recovery planning is continuously maintaining back-ups of your data. This safeguards against cyberattacks, and also ensures business continuity despite any computer bugs that could destroy or corrupt data.
Speaking of bugs, in conclusion, let’s come back to the ants, and consider a simple business continuity plan example from the insect perspective. In a colony, worker ants toil to feed and protect the queen ant. So, they have determined their key business objective. Each ant performs specific duties to guard against different kinds of risk. Some build a warm nest to protect against the cold, and others collect and store food to hedge against scarcity. In this way, the purposeful ant colony is an example of an enterprise that thrives thanks to good risk awareness and business continuity planning.
So, don’t be a grasshopper! Prepare for the future and become risk aware.
riskmethods was acquired by Sphera in October 2022. This content originally appeared on the riskmethods website and was slightly modified for sphera.com.
