What Are the Steps in a Business Continuity Plan

5 Steps to Building a Business Continuity Plan

The Resilient Enterprise | The riskmethods Blog

"Business continuity" is a pretty broad phrase that's thrown around a lot these days. But what does it mean, and what can you be doing to ensure your own business continuity? As always, the number one rule is: Be prepared. How do you do it? By making a business continuity plan. It might sound intimidating, but there are some core steps you can take to get started. Here's what they are.

Identifying Critical Business Processes for Business Continuity

The first step to creating a business continuity plan is understanding what business processes you need to be worried about. Critical business processes are those that are necessary for the survival of the company due to—for example—loss of revenue, customer service interruption or brand damage (just to name a few). Ask yourself: What business processes are absolutely crucial to keeping your company running in order to avoid a severe negative impact?

If you're a manufacturing company, any business processes that make you unable to continue producing an important share of your product portfolio should be labeled as critical business processes. Identify what these are, and then describe the exact process, including the location where it occurs and who the parties involved are. For example: If you require a specific type of raw material to keep your production line going, detail the processes involved in making sure that material gets to your plant.

My pro tip for this step (and all of the steps): Make sure you're involving the relevant people in your business continuity planning. Business continuity is a joint effort, and must be understood by everyone who is part of maintaining it!

Business Continuity Plan: Defining the RTO

Even critical business processes can sometimes be stopped for a few minutes without serious repercussions. So the next step in creating your business continuity plan is to understand the RTO (recovery time objective), which is the time period in which the critical business process must be restored before the impact of the interruption becomes intolerable. For each critical business process you outlined in step 1, define what the RTO for that process is.

3rd Step of Your Business Continuity Plan is describing specific resources

Critical business processes require resources. This word is broad, and can mean anything from specific skills to a concrete object like access to a printer. Most business processes are going to require multiple resources, and the lists of resources can usually be divided into external and internal resources. Internal resources might include key people, office space, a computer, a VPN connection, etc. External resources might include supplies, vendors, logistics or transportation providers, etc. For each of your critical business processes, describe exactly what resources are required, both internally and externally, including how many hours you need them for (on a weekly basis), and how many of each resource you need.

Step 4: Describe the strategy for restoring each process within the RTO.

Now that you have your critical business processes defined, know how quickly you need to restore them and know what resources are required to make them work, you have the information you need to get to the important part: Describing the strategy for restoring each process within the defined RTO. This strategy will be different for every process and every company—take the time to think it through and decide what the best approach would be. If, for example, the supplier for your raw material suddenly declares force majeure, do you have an alternative supplier in place that you can switch to? This is the kind of information that should be detailed in step 4 of your business continuity plans.

Step 5: Put all the information together—and keep it updated!

Steps 1-4 were the hard parts. By comparison, the last step is easy—just gather this information together in one place, so that you have a single repository where stakeholders in your company can view your critical business processes and the plans you have in place to restore them in the case of business interruption. The most rudimentary business continuity plans might just be stored in an Excel document—but there is also software available for making the process more seamless and automated. (Of course, it's essential to also inform and then train relevant people on these processes! When it comes to business continuity, capability is more important than detailed documentation.)

Once your business continuity plan is established, make sure that you also have a schedule in place to review it and update it accordingly!

Subscribe now to the riskmethods newsletter and never miss out on new, interesting insights!

Dr. Otto Kocsis

Principal, Business Interruption & Resilience, Zurich Insurance Group

Otto is an expert in business continuity from his work at Zurich Insurance Group, a riskmethods partner. For more information about how riskmethods and Zurich work together to reduce supply chain risk, drop us a line at om@riskmethods.net.