FOREWORD
The Civil Contingencies Act 2004 introduced a responsibility on all local authorities to raise the awareness of their local business community to the importance of Business Continuity Management (BCM). The district of Basildon is the commercial and business hub of South Essex, accounting for almost a quarter of the manufacturing output for Essex. There are approximately 3,800 businesses in Basildon employing nearly 70,000 people. Basildon District Council has prepared this booklet to provide general information about BCM. It has been distributed to all registered businesses in the district and is also available on the Council’s website at www.basildon.gov.uk.
May 2006
WHAT IS BUSINESS CONTINUITY MANAGEMENT ALL ABOUT?
To safeguard your employees and your business interests it is important to consider how you would continue to operate if faced with a disruption. The main objective of Business Continuity Management is to provide a planned approach to the recovery of a business which has been affected by a business interruption and help minimise the impact on your employees, customers and reputation. Business interruption can take many forms and can happen to any business irrespective of size, from a large enterprise employing a number of staff, to a family-run corner shop. The effects would largely be the same, potentially threatening the survival of your business. Poignant examples include the adverse impact on the local business community which resulted from the oil tank fires at Buncefield, the Manchester bombings and the Boscastle floods. A basic part of BCM is the preparation of a Business Continuity Plan. Although developing a plan requires careful preparation, it is not difficult and need not be expensive. The time spent however, is a worthwhile investment that will ensure the safety and protection of your staff and increase the likelihood of your business surviving a crisis or business interruption.
HOW DO I GO ABOUT IT?
The development of a BCM plan can be explained in six progressive stages:
STAGE 1 Define the most likely causes that could disrupt your business. Define the likely crises which could affect your business and assess the likelihood of each crisis occurring. It would of course be a major undertaking to have a separate plan for each and every potential crisis that your business could face, but a carefully written
general plan can usually be adapted to suit most circumstances. Common small business crises could include: • Fire/Flood • Explosion/Terrorism threat • Denial of access to your premises • Legal/regulatory action • Utilities failure • Burglary/Vandalism • Staff sickness or absence • Key supplier failure Understanding the disruptions and the type of crisis that could have a detrimental affect on the running of your business is vital when developing your plan. Take time to identify them and rank them in order of likelihood and importance. identify them and rank them in order of likelihood and importance.
STAGE 2 Prioritise your business functions To be able to develop an effective plan it is essential that you clearly understand all aspects of your business, their inter-relationships and, if appropriate, the respective priority you would place on each in terms of recovery if you were faced with limited choices or resources. These are usually the areas your business relies on most and which are exposed to the greatest degree of risk. Systematically go through each priority function and take a practical approach to dealing with each of the previously identified threats that your business may face. Follow the same procedure for each: • Assign ownership of the function • Identify threats and resources available • Develop contingency plans and procedures to deal with them
Premises and equipment Your normal working premises are likely to be critical to your business and are often taken for granted. Consider the impact that major damage to, or the destruction of, your premises would have. The same applies to critical machinery and equipment. If an essential piece of equipment or machinery were stolen how would it affect your business? You should think about the following issues: • Would you be able to easily and quickly inform your employees and customers of the disruption to your business? • Would you be able to operate during the time that your premises were out of action? • Would you be able to make alternative arrangements to ensure that your regular customers are kept happy? • How long would your customers be prepared to wait for you to resume your operation before they look elsewhere ? Remember your customers and clients are key to business success, if you don’t or can’t look after them, your competitors will. Some situations are relatively easy to deal with. Regularly maintained fire and security systems, maintaining a data backup system off site and a spare mobile phone (with credit) are just a few simple steps that go a long way to safeguarding your business and assist in recovery following a crisis. The scope and level of your insurance arrangements should be regularly checked, reviewed and up-dated. Indeed your insurance company could be a good source of advice. Staff Losing key people or injury to staff are risks that are often overlooked. The success of any business is often heavily dependent on the skill and availability of its workforce.
• If a key member of staff went to work for your biggest competitor, how much of an affect would that have on your business? • If your employees lottery syndicate came up and most of your staff left immediately, would you be able to survive? Regularly assess workplace risks and ensure that all employees are aware of workplace hazards and your related risk assessments and control measures. Make sure that specialist skills are not just held by one person and arrange training to ensure other staff can provide cover. Telecommunications and Information Technology (IT) Most businesses rely on computers to some extent, but while some will only use them for processes such as accounting or email communication, others will base their whole business on them. Telephones are equally important. What would happen if your computer or telephone system failed and you did not have a plan in place to deal with it? • Would your business still be able to operate? • Would you be able to contact your customers or suppliers? • Would you still have access to important data stored electronically? • What alternatives could you arrange and how long would it take? • What can you do to make sure that you can access vital information even if your computer is stolen or destroyed? Your working environment Incidents in recent years have illustrated all too clearly the affect that natural disasters can have on a business. For example localised flooding has affected thousands of businesses some of which never recover. • Are your business premises in an area, which could be liable
to flooding? • Is there an alternative location from which you could operate temporarily? • How long would it take you to recover from a serious flood? • How would you continue to provide a service to your customers and continue to pay your employees at the same time? • Are you up to date with new and proposed legislation that could affect your business and increase your costs?
STAGE 3 Writing your plan To assist you in writing your Business Continuity Plan, a template has been included with this guide. It can be tailored to suit individual businesses by removing or adding parts as necessary. Use it as a starting point. Your plan, if carefully written, will ensure that you are prepared for the worst identified situations that could keep your business from operating. It does not need to be a complex document. It need only include the most critical business processes. The important thing is to safeguard those processes that will keep you in business while things get back to normal. You may wish to consider meeting with other businesses to discuss a system where each can provide mutual assistance to the other in the event of a crisis.
STAGE 4 Communication and availability of your plan Once you have written your plan: • Ensure that all those involved in responding are aware of their responsibilities and what is expected of them. • Ensure that those who have specific tasks have the resources to carry them out.
• Make sure that all those involved understand the plan and the part that others play in implementing it. • Ensure that copies of your plan are held off-site and that those with specific responsibilities have their own copy.
STAGE 5 Put your plan to the test Once the plan has been agreed and written, carry out a simulated test to ensure that it works. This will also expose any flaws and ensure that those involved understand their roles and responsibilities. Do not wait for a crisis to see if your plan works.
STAGE 6 Update the plan regularly Carry out periodic reviews of the plan to ensure that only relevant and accurate information is contained in it and ensure that your key staff are aware of the changes. Emergency Pack You may wish to consider putting an emergency pack together, which could contain such items as a copy of the plan, a spare mobile phone and charger, torch etc. Some businesses have found it invaluable in the early stages of any disruption.
WHAT ELSE SHOULD I KNOW?
Business Continuity Plan – Start Now You never know what tomorrow can bring, so take steps now to ensure that your business survives in a crisis. Take the time to assess the risks and design a recovery procedure. Remember - fail to plan and you plan to fail. Suppliers Do your suppliers have a Business Continuity Plan? Can they continue to supply in a crisis? What happens to your customers in this case? Think about alternative suppliers. Your customers buy from you not your suppliers. Consider the implications events similar to those below could have had on your business.
Buncefield Oil Tank Fire Disaster 2005 In all, over 400 businesses were unable to use their business premises, leaving 25,000 employees either unable to work or working from alternative locations. The local Chamber of Commerce warned that the explosion could eventually cost business and local authorities £1 billion. Manchester Bombing 1996 Following the Manchester bombing in 1996, 80% of those businesses affected by it that did not have a Business Continuity Plan in place, either failed to reopen or ceased trading within 18 months of re-opening.
EXAMPLE - BUSINESS CONTINUITY PLAN
Immediate Action This business plan is based on a major incident such as the destruction of the building. It can be easily adapted for less severe situations, in which case it may not be necessary to complete all the initial tasks below: 1 2 3 4 5 6 7 8 9 Alert key members of staff Agree with key staff the activities needed and implement recovery plan Advise other staff of when and where to report Notify key contacts (suppliers/customers) Establish the immediate business needs Maintain a log of all decisions /events / action taken Consider working arrangements for staff Notify your insurers Alert IT contact (if necessary)
COMPANY DETAILS
Staff Contact Numbers
NAME HOME MOBILE OTHER
Plan Distribution List
COPY NUMBER NAME LOCATION
Business Contact List This list contains details of important business contacts. Where it is necessary for personal contact to be made, it will include key customers and key suppliers.
COMPANY CONTACT NAME TELEPHONE NUMBERS
Action Plan This plan contains a list of tasks that are essential to the successful recovery of the business.
TASK DETAIL INSTRUCTIONS/CONTACT NUMBERS COMPLETED
Alternative Suppliers
COMPANY CONTACT CONTACT NUMBERS
Key Business Functions (In order of priority)
1. 2. 3. 4. 5. 6.
Offsite Recovery Location
LOCATION CONTACT NAME CONTACT NUMBERS
Back Up Information / Equiptment
BACK UP COMPUTER RECORDS / DATA LOCATION:
CRITICAL PAPER RECORDS / INFORMATION LOCATION:
EMERGENCY PACK LOCATION:
Cascade This list ensures that all key members of staff are contacted and made aware of the incident, make sure that a record of all those contacted and those not contacted is kept. will contact:
NAME NUMBERS
will contact:
NAME NUMBERS
Initial Recovery Log Maintaining this log will provide a record of all events, actions/decisions taken, it should include the names of those instructed, timings and actions taken.
DATE TIME INFORMATION / DECISIONS / INSTRUCTIONS / ACTIONS INITIALS
TOP TEN TIPS 1. Back up data regularly and store copies off site in a secure place. Low cost back up options include CD writers or DAT tape recorders. Practise restoring the data in an IT system other than your own to ensure it works. 2. Ensure that important paper documents, such as contracts and employee information, are protected. Make copies and use fire resistant and waterproof storage containers. 3. Keep a list of contact details for your staff, customers and suppliers off site so that you can contact them in the event of an incident. Also keep a list of emergency contacts for staff. 4. Be clear about what your insurance policies cover and what they don't so that there are no nasty surprises when you subsequently make a claim. Keep copies of the relevant policies off site so that you know immediately what to do in the event of an incident. 5. Review your insurance cover regularly to ensure it keeps pace with any changes in the business. 6. Identify your business critical activities and set out the tasks needed to restore them and resume trading off site. Identify the core resources that support your critical activities and consider how you would source replacements. 7. Have an emergency pack which will include your business recovery plan, as well as a first aid kit, mobile telephone, and masks to protect against fumes and dust. 8. Make an inventory of equipment, materials, products and any other assets to give you an overview of the business. This will make it easier to work out losses and identify gaps in core resources after an incident. 9. Make arrangements for a temporary base - you may not be able to operate from your existing premises for weeks or even months, depending on the type of disaster. Remember any site must comply with health and safety rules. 10. Test the feasibility of your plan and review it once a year to keep it current. Tasks in the plan should be assigned to designated people. Being organised is a vital part of incident recovery.
FURTHER ADVICE / INFORMATION This leaflet is designed to raise your awareness and provide some basic information to help you start thinking about BCM. You can find extensive additional information on this subject from the following sources: Business Continuity Institute www.thebci.org Business Continuity (City of London website) www.cityoflondon.gov.uk/Corporation Business Link for London - Independent advice and information for small businesses www.businesslink4london.com Business Link - Prepare your Business for Disaster www.businesslink.gov.uk DTI - Information for Business www.fco.gov.uk London Chamber of Commerce and Industry www.londonchamber.co.uk London First - Business membership organisation involved in promoting and improving London www.london-first.co.uk MI 5 - Security Advice for Businesses www.mi5.gov.uk Small Business Service www.sbs.gov.uk UK Resilience - Communicating Risk, a toolkit You can also try contacting your insurance company who may be able to provide additional information, support or guidance.
For issues arising from this brochure please contact: Barry Rowswell Principal Emergency Planning & Business Continuity Advisor Basildon District Council Audit, Risk & Business Continuity Service, Basildon Centre, St Martins Square, Basildon, Essex, SS14 1DL E: barry.rowswell@basildon.gov.uk T: 01268 294649
BUSINESS CONTINUITY PLAN – START NOW
You never know what tomorrow can bring, so take steps now to ensure that your business survives in a crisis. Take the time to assess the risks and design a recovery procedure. Remember - fail to plan and you plan to fail.
Acknowledgements Thanks to Chelmsford B.C. and Maldon D.C.for making earlier versions of a similar leaflet available, and to Tony Thompson, British Red Cross, for the cover photograph.
PRODUCED BY BASILDON COUNCIL MAY 2006