Companies rarely get warning as to when a crisis will hit. This has never been more salient than in 2020, with Australia-wide bushfires and the unprecedented impact of a global pandemic disrupting business operations across the country.

We have found that many organisations are ill-equipped to manage business disruptions due to a lack of business continuity planning, outdated plans or a lack of training and testing.

Business Continuity management identifies an organisation’s priorities and prepares solutions to address disruptive threats (BCI Good Practice Guidelines 2018), allowing organisations to minimise the negative impacts from a disruption, and return to ‘business as usual’ as soon as possible.

Business Continuity requires a holistic approach that identifies potential events which may threaten an organisation’s ability to operate and provides a framework for building business resilience that will see an organisation through any disruption.

The ideal business continuity program will incorporate the following:

Business Continuity Policy and Framework

Sets out the purpose, context, scope, and governance of the business continuity program.

Threat assessment

Identifies potential events that may cause a business disruption, assesses those events, identifies controls, risk ratings and the impact to the business.

Business Impact Analysis (BIA)

Process of reviewing the organisational activities to determine the urgency of each activity by assessing the impact over time should that activity be disrupted. This process identifies the recovery timeframes, resource requirements, dependencies, and impact to the organisation.

Established team structures

The types of teams that may be required will depend on the organisational needs, and should integrate with other plans and teams:

  • Crisis Management Team – strategic level team responsible for leading the organisation through the crisis
  • Critical Incident Management Team – operational level leadership team responsible for managing the operational aspects of an incident, mainly focused on people, asset, and business operation impacts
  • Business Continuity Team – responsible for the recovery of the critical business functions, as identified through the BIA process.

Business Continuity Plan (BCP)

The BCP should be customised to the unique requirements of the organisation. Following completion of the BIA, disruption scenarios should be identified, which will guide the development of key recovery checklists to be incorporated into the BCP.

The BCP will contain all information and tools to enable the organisation and relevant business areas to recover their critical business functions, and may include a range of strategic, operational, and tactical recovery processes.

Finally, the BCP should integrate with other resilience plans such as emergency response plans, critical incident management plans, disaster recovery plans, cyber plans, and crisis management plans.

Training

No program is complete without those responsible for implementing them being aware of what they need to do. Customised training should be conducted (ideally annually) for those responsible for overseeing the business recovery process, for those implementing the BCP(s), and for all staff to ensure they are aware of the program and expectations of them during a business disruption.

Testing

Testing and exercises build capacity within management teams to respond to incidents and disruptions, ensuring processes will work effectively during an incident or business disruption, and to provide staff with competence and confident in their role during these times.

The business continuity testing, ideally conducted annually, may be conducted in conjunction with disaster recover and incident / crisis management exercises to identify any further enhancements required in the program.

Maintenance and monitoring

Once established, the program should be reviewed at least annually or when there have been changes in the organisation business processes. Ongoing maintenance may include review and update of the BIA’s and plan, training, and testing, as well as monitoring of any program performance measures outlined in the Policy.

At Bounce, we specialise in helping businesses prepare for emergencies, incidents, and business disruptions through a consultative approach to resilience planning and preparedness. For assistance creating a business continuity plan tailored to your organisation contact us today.