Business Continuity Planning
What happens when business is disrupted? It has lost revenues plus extra expenses which means reduced profits and business insurance doesn’t cover all the costs. Businesses may lose customers when the customers defect to the competition because disrupted businesses can’t provide customers with what the customers are wanting in the schedule that they are wanting. All because there was an extended disruption in business operations.
To ensure the business can continue to operate with minimal interruptions, a business continuity plan needs developed which consists of assessing for potential disruptions, determining the business impact of the disruption, and develop a plan to minimize disruption. The basic process is to conduct a risk assessment, a business impact analysis, and then identify and document the resources and assets that will be needed to continue to conduct critical business functions and processes. This endeavor will take a team of executives, managers, and workers working together.
To conduct a risk assessment, it is necessary to identify potential causes of business disruption assessing the risk associated with the potential causes for disruptions. It is necessary to then perform a vulnerability assessment. Some examples of potential causes for business disruptions include a declared pandemic emergency, fire/explosion, natural disasters, hazardous materials spill or release, a workplace violence incident, utility outage, severe mechanical breakdown, supplier failure, or cyber-attack. Once the various causes of potential business disruption are identified, each one needs to have the risk assessed which is a product of determining the probability that the potential disruption is to occur along with the magnitude of the consequences of the disruption if one occurs. Individual companies will need to determine the specific definitions of each of the probabilities such as “improbable”, “unlikely”, “likely”, or “highly likely”. Individual companies will need to define the magnitude of the consequences as well such as “moderate”, “serious”, “critical”, or “catastrophic”. Once the probability and magnitude are determined the priorities can be determined as to which potential causes of disruption will be addressed first in the planning process.
The next step is to conduct a vulnerability assessment to determine resources and assets that are vulnerable to the potential causes of business disruption. Some examples of resources and assets include people, property/buildings, critical infrastructure, supply chain, equipment, information technology, reputation, customer confidence, and regulatory or contractual obligations.
The process continues with conducting a business impact analysis for each of the potential causes of disruption to predict the consequences of the potential business disruptions and how it may affect resources and assets. It is necessary to identify the time-sensitive or critical business functions, processes, and resources needed to recover from the disruption and develop strategies to recover. Some examples of impacts to business include injuries or fatalities, property damage, business interruptions, losing customers or their confidence, losing money, or fines from regulatory inspections or contractual penalties.
When developing strategies to become operational, it is important to determine the resources and assets that will be needed. To do this, use a simple table listing the resource or asset that is used during normal operations then the quantity utilized or used during normal operations. In subsequent columns identify quantities of the asset or resource that will be needed after a specific potential business disruption event to get back into operation within 24 hours, 72 hours, one week, and one month of the potential disruption event. For example, a resource that is used during normal operations is staff such as workers, supervisors, managers in each business department. Quantify the number and type of each utilized during normal operations. Then identify the staff that will be needed to become operational within 24-hours, 72-hours, one week, and one month after the disruption event. Another example is the asset/resource of a building and processing equipment identifying current building space used and equipment used during normal operations. Determine and quantify the building space and equipment needs to become operational within 24-hours, 72-hours, one week, and one month after the disruption event.
Now that the resources and assets are quantified per a specific time period, determine how and where the resources the assets will be acquired to become operational asking questions such as “how will those resources/assets be acquired”, “where will they come from”, what is the schedule on which to acquire them”.
A very important step in the business continuity planning process is to provide training to the workers on the business continuity plan. This training will provide assurance that the employer is planning how to continue business operations after potential business disruption events. The training will also provide knowledge to the workers as to their specific responsibilities within the business continuity plan along with the projected schedule for recovery. It is important to conduct table-top exercises with employees and the business continuity planning team to show how the plan will work with all of the many moving parts. The exercises will identify opportunities for improvement that will need to be addressed so that the business continuity plan is always up to date and most effective It must be understood that even with the best planning, situations will arise that are not exactly addressed within a plan. However, using the existing plan, the unaddressed situation can be managed using other elements within the plan as an example and basis for making decisions and developing a recovery strategy.
Consider the current situation with the declared public health emergency of COVID-19. Has your business been disrupted due to the pandemic? What are you doing right now to continue operations? Take the time to write down what you are doing now to continue business operations including the modifications and changes that were made to date. Once it is written down, this is your current business continuity plan, though it may not be perfect. The plan can be reviewed and improved considering what is working now and what opportunities for improvement exist.
This business continuity plan should be reviewed periodically to determine any changes that may be needed to the plan resulting from personnel changes, responsibility changes, addition of new equipment, suppliers, or a new plant or a building.
There are many references that can be used for developing a business continuity plan including Ready.gov supported by the Department of Homeland Security and Federal Emergency Management Agency.
This posting is a summary of a presentation presented by the author at the Marcellus to Manufacturing conference earlier this month hosted by the Pennsylvania Independent Oil and Gas Association (PIOGA).
For more information, contact:
Wayne Vanderhoof CSP
RJR Safety Inc.