Please note that this article is intended for educational purposes only and should not be deemed to be or used as legal, employment, or health & safety advice. For guidance or advice specific to your business, consult with a qualified professional.

An effective business continuity plan helps to ensure that your business keeps on functioning in the face of disruptions. Even small disruptions can pose major issues, especially to small businesses. Fortunately, a bit of advance planning and strategy can go a long way to protecting you against them.

What is a business continuity plan?

A business continuity plan (BCP) looks at how your business could continue to operate as normal under adverse circumstances. Your business as usual (BAU) operations are set out in your business plan. This is often the springboard for creating your business continuity plan.

Your business continuity plan and your business plan may feed into and off each other. This typically happens when your business continuity planning exercise identifies a potential roadblock to your current business operations. In this situation, update your business plan to address this.

For example, in the real world, some businesses (especially SMEs) hit a major roadblock when their physical premises were closed due to Covid-19. They might well have had business continuity plans in place. Those plans were, however, predicated on the assumption that they would have access to a physical location, if not their usual one.

Many businesses have learned from this experience and are now actively trying to incorporate flexibility into their business plans. This needs to be reflected in their business continuity plans.

Business continuity versus disaster recovery

The basic aim of business continuity is to prevent you from needing to implement disaster recovery (DR) plans or crisis management (CM) plans. Ideally, you should just move seamlessly from BAU operations to the alternatives set out in your business continuity plan. But still have both a DR plan and a CM plan in place, just in case you do need them.

What should a business continuity plan address?

In basic terms, a business continuity plan addresses how key assets will be protected or replicated in the event of a disruption. Business assets can be divided into three categories:

1. People
2. Tangible assets
3. Intangible assets

Occasionally, the same asset needs to be put into more than one category.

For example, your location holds your business premises. This is a physical asset. It may also provide intangible benefits, such as high visibility leading to the potential for drop-in custom. If it does, look for a way to access or replicate these benefits in your business continuity plan. For example, effective search engine optimisation (SEO) or the use of social media can help to give you the same level of visibility online.

How to create a business continuity plan

First, create a complete list of relevant people and assets (both tangible and intangible). Once you have this list, undertake a risk assessment on them. In the context of business continuity planning, this is often called a business impact analysis (BIA), because its aim is to assess the potential impact on the business if this resource becomes unavailable.

People

In business continuity planning, the definition of people includes anybody who interacts with your business in any way. This is more than just your key staff. It definitely includes your customers, and also probably includes suppliers.

When assessing potential risks, think about the risks on both sides, not just the risks on your side. For example, how will you cope if one of your employees has a personal emergency and needs time off work at short notice? How would you deal with your customers being targeted by a competitor? What would happen if one of your suppliers went out of business?

Addressing business continuity issues with suppliers generally boils down to a combination of contracts and due diligence. Your contracts specify what needs to be done. Your due diligence ensures that any potential supplier is up to the task. For any significant contract, ensure that the supplier has a business continuity plan in place. You might even wish to see it and assess it.

Your relationship with employees, by contrast, is very much within your control. Similarly, your relationship with your customers is very much within your sphere of influence. Therefore assess the risks to both and determine how to address them.

Business continuity and remote work

Currently, many businesses are still in the process of working out where they stand on supporting remote work in general. It can be very practical to have the option to do so. This is often a straightforward and economical way of ensuring business continuity.

What’s more, putting the relevant infrastructure in place can improve your regular business operations. For example, if you are still reliant on regular telephones on the public switched telephone network (PSTN), you are missing out on the huge opportunities offered by voice over internet protocol (VoIP).

Tangible assets

With current assets, you need to know the following points:

• What they are

• Where they are

• Who uses them, why and for what

• How much they are worth

• How easy they are to move

• How easy they are to replace like for like

• What alternatives there are

The answers to these questions will largely determine your business continuity strategy.

Intangible assets

With intangible assets, the key challenge is generally the need to maintain security while also ensuring continued accessibility. Meeting this challenge typically requires investing in relevant infrastructure such as secure cloud storage. Roll this out over time, hence the importance of undertaking business continuity planning well in advance of any disruptions.

Commit to reviewing your plan regularly

Risks change over time as do the options available for addressing them. Business continuity should therefore be seen as an ongoing exercise. In fact, maybe create a business continuity team with explicit responsibility for ensuring that business continuity is integrated into everything the business does. At a minimum, commit to reviewing and updating your plan regularly in light of new developments.

Useful resources

• Learn about GDPR here.

• Get advice on cybersecurity here.