Skip to site navigation

Accessibility Options

Font size

Colour scheme

A short guide to business continuity management (BCM) planning

 
This is a quick step-by-step guide to business continuity management planning. For more detail, please see our useful websites.

1. Business impact analysis

First you need to get to know your own business better. 

  • Look at how your processes and procedures work.
  • Identify the critical functions and activities of the business – in an emergency you need to concentrate on the areas that MUST be done to continue the business.
  • Understand the key resources for the business – the staff, premises, equipment, data, systems, suppliers and communications.

2. Hazard analysis

The second stage of the BCM process is to assess the risks and hazards to the business, and the likelihood of them happening.

Potential risks (which may not be solely affecting your business) could include:

  • Data loss
  • Flooding
  • Loss of power, telephones or water supply
  • Civil disorder
  • Chemical spill
  • Terrorist action.
A useful source of this information for South East London can be found in the Community Risk Register.

You should consider if these risks could affect your business. Then decide on one of the following actions:

  • Remove the risk entirely, for example, by ceasing the activity or changing a business process.
  • Reduce the risk by taking mitigating actions, for example, by ensuring that data is backed up.
  • Accept the risk and plan accordingly.

3. Prepare a recovery strategy

Using the business impact analysis and the hazard analysis, you need to work out a recovery strategy.

You should consider:

  • How do you identify the scale of the disruption to the critical activities of the business?
  • What would trigger the start of your recovery plan?
  • How you would maintain communications with your staff, customers, suppliers, regulators and investors?
  • What resources would you need to recover the business? Where would these resources come from?

4. Write an action plan

You can now write a timetabled action plan for use in an emergency.

This should concentrate on the 'must do' rather than 'nice to do' activities. It should cover at least the following:

  • The procedures for triggering the business continuity management plan. Who decides to use the BCM plan and in what circumstances? Ensure that there is a deputy for this role.
  • The decision making process. Who makes the difficult decisions? Ensure that this process is clear and understood, and that there are nominated deputies.
  • Communications procedures. Who should be contacted and by whom? Make sure that the plan includes a list of key contacts, including staff, suppliers, building firms (for repairs), and customers.
  • A time-driven recovery process. When should specified processes be complete?
  • Ensure that the plan shows:
    • how the business will continue to operate
    • which members of staff and external contractors will be required, and
    • what other resources (IT, premises, transport, etc) will be needed.
  • Stand down procedures – who will decide that a 'return to normal' is appropriate, and how will this be communicated to staff, customers and suppliers? There may be a need for staff to receive additional support following an emergency, so decide how to plan for this need. 
You can download an example of a plan here along with guidance notes, this is intended as a guide only. There are many different methods for BCM planning, and other formats may be more appropriate to your business.

You can also use our suggested starting list for an emergency pack. Such a pack should be stored away from the usual business or organisation premises.

In addition, you can download a site plan document. This gives details of the location of key items on your business premises. It could be used by the London Fire Brigade to aid them in dealing with an incident on your premises, eg. the location of utility supply shut-off switches or hazardous materials.

5. Test your plan

An untested emergency plan is a recipe for disaster.

You need to treat the plan as a living document, that changes with circumstances and the needs of the business.

It is important to test the plan regularly to ensure that it is still relevant and adequate.

There are a number of ways to do this, including:

  • Reading through and reviewing the plan. Perhaps you could ask someone else to read the plan.
  • Desk-top walkthroughs: setting staff the task of reviewing the plan against a set scenario (for example, the reaction to a loss of an important piece of equipment).
  • Staff awareness training: ensuring that everyone in the business knows their role should an emergency occurs. This could be combined with fire evacuation training.
  • Component testing – checking a part of the plan to ensure that it works. For example, you could test the recovery of your IT and communications systems.
  • 'Live' testing – a full recovery exercise.

A to Z of Services

Emergency Planning Unit