By Veronica Baxter:
These are unprecedented times. Severe weather is causing extended power outages. Fires force evacuation. The pandemic defines who can go out and work, and expands the possibilities of remote work. Political unrest causes damage to individual businesses and infrastructure. All of this is happening right now in addition to the everyday calamities that plague businesses, such as electrical fire, plumbing failure and flood, and theft.
Does your business have a continuity plan? There are so many threats to business operations that, simply put, you must. Here are five steps to take to ensure that you can quickly get back up and running if business operations are interrupted.
Step #1: Form a Planning Committee and Determine the Purpose and Goals of the Continuity Plan
Depending upon the size of your business, that planning committee maybe just you, or it may be the handful of employees who work for you, or it may be a member of the board of directors heading a team of managers from every department. Regardless of the size of your business, make sure every aspect of your business is adequately represented.
Why have a formal committee? So that you sit down and formally establish the purpose of your continuity plan and its goals, conduct and then discuss a business impact analysis, take steps to mitigate risk, research, and implement alternative business locations, suppliers, sources of power, and conduct a test of your plan.
Hearing from all departments, including maintenance, will ensure that your plan is realistic and that you provide for every aspect of your business.
The goals of the continuity plan should be set forth first by leadership, and the feasibility of attaining those goals explored by the committee, who will prepare a report. Your goal may be just to restart operations as quickly as possible, but what if the disruption is caused by something that affects the marketability of your product or service? The committee must get creative to develop ways the business might pivot and survive the calamity.
For example, a small distillery closed during the early months of the pandemic due to the stay-at-home order and social distancing mandates. To keep their brand in public view, they switched to making hand sanitizer with byproducts from their distilling process. Four months later, outside dining is permitted and they are open and thriving.
Could your business switch gears like that? If not, in the alternative, could your business survive closing its doors for four months? These are among the questions your committee will explore.
Step #2: Conduct a Business Impact Analysis (BIA)
Your committee must identify, quantify, and qualify the impact of various forms of business interruption, then set a time frame in which alternative means are found to restart. You might think of the many moving parts of your business as “mission-critical” and brainstorm ways in which a substitute or alternative might be found and implemented, and how long that would take.
Start by making a list of all of the risks your business faces. What sort of disruptions are possible? Every business’ list will be different, but here is a basic list to start with:
- Loss of power
- Death or loss of a key employee
- Destruction of or severe damage to a business location
- Failure of machinery
- Loss of a supplier
- Data breach or theft of intellectual property
- Environmental hazard
- Government fines or fees
Step #3: Identify Steps to Mitigate Risk, and Take Those Steps
Once you’ve conducted your business impact analysis, you can identify and take steps to mitigate those risks. Those steps may include, among others:
- Installing security and fire protection systems
- Installing a back-up energy source, such as a generator
- Minimizing or eliminating the dependency on a key employee or supplier
- Identifying secondary suppliers
- Cross-training employees so that there is redundancy
- Installing IT back-up and security
- Establishing protocols to protect the secrecy of IP
- Pre-purchasing critical equipment or components for repair or replacement
- Preventative maintenance and testing programs
- Purchasing professional liability insurance, property insurance, workers’ compensation insurance, product liability insurance, vehicle insurance, and business interruption insurance, as applicable.
Step #4: Establish Business Continuity Procedures
If and when a crisis arises that interrupts business operations, you must have a plan in place and implement that plan. A small business may just have a phone chain, with duties assigned to each of the handful of employees. But a large corporation must provide for contacting and instructing all employees on how to proceed.
Establish responsibility for contacting employees. Duties should be pre-assigned. Protocols that the committee has created can be triggered when needed, such as:
- Start the generator and minimize operations until power is restored
- Work remotely
- Trigger a mutual aid agreement with a competitor
- Shift unmet responsibilities to available employees
- Use secondary suppliers
- Prioritize customers or clients whose needs must be met first
- Refer customers or clients to a pre-identified alternative
- Work from a mobile office
- Use manual and alternate procedures if computer systems are down
Step #5: Implement Your Plan and Train Employees
Once you’ve recorded everything the committee has researched and discussed, and your plan has been approved by leadership, you should have something in writing that includes:
- Goals of the plan
- Key roles and responsibilities
- Business impact analysis (BIA) results
- Steps were taken to mitigate risk
- Offsite data and storage requirements
- Protocols for IT and IP security
- All business recovery and continuity strategies, including alternate operating plan(s), secondary supplier readiness, and plan activation and response procedures.
- How employees will be trained
- How the plan will be maintained and updated
Conduct training for employees with key roles and assignments in the business continuity, disaster recovery, and incident response processes. Also, train the employees who must operate under the plan. Training is best done by periodically conducting rehearsals based on simulated emergencies. Assess whether your plan functions as intended, and if not, adjust your plan accordingly.
Following these five steps, you can prepare your business for the worst.
About the Author: Veronica Baxter is a legal assistant and blogger living and working in the great city of Philadelphia. She frequently works with Larry Pitt, a workers’ compensation lawyer in Philadelphia.