Structuring your plan
This page describes the essential structure of any business continuity plan. There are six sections you will need to include in your emergency strategy. Click on the links below for a description of what to cover in each area.
Introduction
The introduction to your plan should include:
- the purpose of the plan (eg to ensure employee safety and resume normal business as soon as possible)
- a clear statement of support by senior management
- a description of the premises, facilities and operations covered by the plan
- the main risks faced by your organisation and the impact these could have on your business
- links to other plans and policy documents (eg fire evacuation procedures).
Incident management processes
This sections should outline your procedures for managing an incident or business disruption. You should include:
- who would manage the response to a business continuity incident – depending on the size of your business this may be one person, or a group of people
- where you would manage the response from (eg an off-site location, such as a hotel, with appropriate communication facilities where the response and recovery effort can be coordinated).
Activation and implementation
Your plan should outline when emergency procedures should be implemented and who has the authority to activate them. Key points you may want to include are:
- when and how to activate the plan
- who is responsible for starting emergency procedures, if there is no alarm
- notification process for key members of the response team, senior managers and staff
- special roles for individuals eg removal of valuables somewhere safe, calling out external experts or permission to spend up to an increased financial limit
- up-to-date call out lists of staff, with their names, position and contact details
- check-off cards for recovery team, describing their tasks in an emergency.
Key procedures
Generally, you should plan for the impacts of incidents, rather than specific risks. Outlined below are some of the key impacts you may want to plan for and some tips on how to do this and what to include in your plan.
Evacuation
You may already have an evacuation plan for if the fie alarm goes off, however evacuation of premises may be required in other situations, for example if your business is in an area cordoned off by the police. You may want to consider:
Sheltering (containment)
In certain situations it may be safer to stay and ‘shelter’ in the building rather than evacuate. This may be the case if there is an airborne risk (eg from a chemical spill) or an external bomb threat. Depending on the nature and size of your premises you may want to consider:
Loss of premises (relocation)
This part of the plan should cover the arrangements which may be needed if the business has to be relocated to other premises. There are several ways the requirement for alternative accommodation can be met:
Loss of utilities
Consider the impact on your business of the loss of one or more of your utilities, such as gas, electricity, water or telecommunications.
Loss of your computer and IT systems, either due to a power cut or more permanent fault could have a significant impact on your business. If you have IT contracts in place, talk to your supplier about ways of increasing your resilience. You may also want to consider:
Loss of staff
Your staff are one of your most important assets – when identifying your business’s critical functions consider what your minimum staffing requirement is to keep these functions going in an emergency.
Loss of supplier
If you are reliant on key suppliers to deliver your critical business functions, you may want to consider alternative companies that could supply resources should your primary supplier fail. Check out our information on supply chain resilience for more information.
Communication
Your plan should cover how you will communicate to key stakeholders in the event of an incident. This may include staff, customers and clients, suppliers and shareholders. This will rely on you having the correct technology and procedures in place – you may want to consider the following in your planning and include relevant details in your business continuity plan:
- diverting phone calls to a new location
- being able to update your website remotely, away from the premises
- have an alternative plan if the mobile-phone system is restricted or goes down (eg due to overload)
- how to get information to all staff if the disaster occurs outside normal working hours (eg call cascade through managers)
- plan for handling calls from relatives if an incident occurs in business hours or when staff are travelling to and from work.
Media
Skillful handling of the media can prevent potentially negative comments and ensure that if stakeholders or staff members do find out about the incident via the media, you will be a little more in control of what they hear. Your plan should cover:
- who in your business would act as a spokesperson for the media
- who is responsible for signing off and issuing media messages
- how you would coordinate your media messages with the emergency services and other affected businesses i.e. everyone should "sing from the same hymn-sheet"
- generic messages which may be given out to the media initially
- guidelines for staff who may be approached by the media.
Other things to consider
- Version control – as you make revisions to your plan, you will need a system of recording these amendments to make sure everyone has the latest version of the plan – this may be using a numbering or date system
- Distribution – record who should have copies of your plan
- Protective marking – if your plan contains information which should not be made public, such as important contact numbers, you may want to mark it to ensure it is stored appropriately
- Log keeping - assign diary/log keepers to ensure proper recording of messages and decisions, particularly if you may be involved in any form of future inquiry.
