What is a BCP? What does it include and how can it be effectively implemented?
COS recently spoke with Danny Shields, vice president of industry relations with Avetta, about what business continuity planning, and what businesses – especially small and medium-sized operations – can do to effectively create and implement such as plan. Shields is a Certified Safety Professional (CSP) with more than 18 years of both field and management level experience across multiple industry verticals.
The current pandemic has highlighted the need for businesses of all sizes to invest time and resources into making sure that they have a successful business continuity plan (BCP) in place.
Many businesses, small and large, have suffered as a result of the economic and financial ramifications of the current COVID-19 crisis. Now, as businesses are starting to open again, they are taking a look at how they can implement continuity planning in the long-term to be better equipped to face future challenges.
1. What is a business continuity plan?
Shields says that a BCP is both a “playbook” and a “policy” for companies. On one hand, there’s business continuity policy, he says, and on the other “there’s a program that is a kind of playbook that represents what that policy is for any company.”
The current pandemic has shone a light on how essential these are for businesses, and how the lack of a BCP may have had a negative impact of small and medium-sized businesses – and indeed, any business.
“I don't think anybody was really prepared for this regardless of the sophistication or the size of the organization,” says Shields, “but certainly the medium to small businesses were heavily impacted and are continuing to be because they're being asked to do things that they've never been asked to do in the past.”
He explains that historically, BCPs really depended on business impact analysis or risk assessments that were done for supply chain efforts, and critical vendor types or suppliers within your value chain. Whereas more sophisticated companies have the resources for this, smaller and medium-sized businesses have not necessarily been able to invest in this, “but they certainly are taking a hard look at it now,” says Shields.
2. What does a business continuity plan (BCP) typically include?
What would you typically find in a business planning program? A policy statement to start off with, says Shields. Planning the program, the process should include a business impact assessment (BIA). The policy statement defines who you are as an organization, and how you are going to operate your business continuity strategy.
A business continuity plan will look very different around the world, says Shields, because one of the things that you are always going to consider are things like climate impacts (e.g. hurricanes, flooding) and you are going to want to put together a plan to mitigate that. In your BIA, you would also look into historical events and risks posed to a business. A pandemic was always on that list, says Shields, but given how rarely it occurs it was not something that was necessarily considered to the extent that we would consider it amid COVID-19 recovery.
After defining your policy, you need to start planning your program, or “playbook”. Based on your BIA and risk assessment, you can start to define “what strategies, plans and procedures you would put in place to ensure that you had the right people, the right subject matter expertise and the right leadership involved.” Says Shields.
A BCP also helps to understand what actions need to be taken after an event occurs: “All these things would typically be either simulated or drilled at some frequency, so you know how to prepare yourself for an event.” Explains Shields.
Finally, he says, you would have to include a performance evaluation or auditor review of the processes included in the BCP. This is a constant cycle of improvement to make sure that the plan is up to date, effectively addresses the risks posed to the business and involves the appropriate employees.
3. What about the supply chain?
A critical part of a BCP is identifying essential roles and putting into place an alternative if that employee or those employees are unable to fulfill those roles. This is also something to address with regards to business’ supply chain. One main issue many businesses have faced during the current pandemic is “defining critical vendors and finding potentially alternate sources,” says Shields. By this, he means vendors and sources that are essential in order to continue running their business.
One way to remedy this is by clear, effective and continuous communication with those in your supply chain and those within your organization.
Shields says that after reflection, some businesses may find that they need to expand their supply chain network. For example, those with international supply chains who had critical vendors in parts of the world that were heavily impacted. These businesses may now want to look into shortening the supply chain and including this new outlook in their BCP.
“How do you get your suppliers that are critical and paramount to your business closer,” asks Shields. This, he says, could be a closer provider, or building a closer relationship with them.
Shields says that “more and more of our clients are looking to build in what they call supply chain resiliency, which is really rethinking where, how and when they receive.” Many businesses have been rethinking their supply chain, and whereas before were focused on cost savings, they are now looking to focus on continuity of supply.
4. What are the basic elements that can be implemented?
For small and medium-sized businesses, this plan does not necessarily need to be the most sophisticated, says Shields, “it just needs to make sense for your business.”
A BCP needs to be actionable and, when communicating with employees, needs to provide assurances. Especially in this current climate, a continuity plan should be able to effectively demonstrate to employees that businesses will be able to operate at an appropriate level and provide a safe return to work.
For example, currently this could partly mean respecting federal or provincial guidelines with regards to adequate hygiene practices and PPE.
A few questions businesses of any size can ask themselves are: How are you going to communicate with employees, vendors? Who are the critical people who can ensure that minimal operations can occur? Who is going to be accountable for those things? What are the triggers to go back to normal post-event? What actions need to be taken after an event occurs?
Ultimately, a BCP boils down to “having the right resources available in a timely manner,” says Shields.
Avetta, a supply chain risk management company, has created a number of Safety Moment slides for companies to use to educate their management and staff on how make sure their workforce is safe when the timing is right to return to work. View and download them here: https://www.avetta.com/resources/covid.
