Business Continuity Planning

Getting Our Customers Back to Business

Man-made and natural disasters are a fact of life for many businesses. These events, which can range from fires and weather-related disasters to terrorism and cyber attacks, may cause extensive disruption to an organisation. In today’s competitive global economy, it’s critical for any business to have processes and plans in place to identify the impacts of these events, so they can anticipate and reduce potential losses, and develop recovery strategies to help the business resume services without delay.

An effective business continuity plan requires a solid foundation, starting with a commitment from senior management to drive accountability and ensure successful execution of the plan. Each business should look to establish a planning committee to develop the scope, goals and objectives of the business continuity plan. This group will guide the administration of the business continuity programme and determine the need for insurance with the help of a professional insurance representative.

Once a management-supported planning committee is in place and ready to begin business continuity planning activities, there are four major steps it should consider:

1. Assess the threats or risks that could lead to a significant business interruption. Some disasters, such as weather-related hazards, may be easier to identify because of the location of the business or trends in the region. Other less predictable risks, such as an extensive power grid outage, vandalism, an attack on data networks, or even an event that disrupts shipments from a major supplier, may be more difficult to assess. The committee should assume these events are possible and could impact operations.
2. Conduct a Business Impact Analysis to help identify and prioritise the most critical business functions necessary to keep your operations running.
   What functions or processes are most important for the business to survive? The committee should list critical business functions, activities or assets (such as data) that, if interrupted, could make it difficult to provide goods and/or services. By focusing on the most important needs of the business, the committee can ensure critical functions of the business are restored quickly.
3. Establish controls for preventing and/or mitigating the potential impact of an adverse event.  The committee should take steps to prevent and reduce the severity of an event (such as relocating critical equipment to a higher elevation in areas susceptible to flooding). Plans should include physical controls such as sprinkler protection, firewalls and flood barriers, as well as loss prevention programmes, policies and procedures including emergency response, employee communications and public relations.  Of course, there is a human cost in a disaster too. The committee should identify resources like employee-assistance programmes or community-based resources to help employees cope with the event.
4. Test, exercise and improve the plan routinely.  How effective is the plan? It’s difficult to know without exercising and testing it. Regular programme review, training, education and practice exercises are critical to validating the plan. A business continuity plan is not a one-shot project but an integral part of a business strategy. The completed plan must be reviewed, tested and updated regularly if it is to be effective when put into action.

For more information, sign up to our Risk Academy, log in to the Risk Control Customer Portal, or email RCEUROPE@travelers.com