Business continuity planning: a guide to developing your plan
The following is guidance for developing your business continuity plan. It includes the basic components of a plan and outlines the steps in developing and implementing the plan.
The executive summary gives management a brief overview of: the purpose of the plan; the facility's emergency management policy; authorities and responsibilities of key personnel; the types of emergencies that could occur; and where response operations will be managed.
Emergency management elements
This section of the plan briefly describes your approach to the core elements of emergency management, which are:
- direction and control
- life safety
- property protection
- community outreach
- recovery and restoration
- administration and logistics.
These elements are the foundation for the emergency procedures that your facility will follow to protect personnel and equipment, and resume operations.
Emergency response procedures
The procedures spell out how the facility will respond to emergencies. Whenever possible, develop them as a series of checklists that can be quickly accessed by senior management, department heads, response personnel and employees.
Determine what actions would be necessary to:
- assess the situation
- protect employees, customers, visitors, equipment, vital records and other assets, particularly during the first three days and
- get the business back up and running.
Specific procedures might be needed for any number of situations such as bomb threats or tornadoes, and for such functions as:
- warning employees and customers
- communicating with personnel and community responders
- conducting an evacuation and accounting for all persons in the facility
- managing response activities
- activating and operating an emergency operations centre
- fighting fires
- shutting down operations
- protecting vital records
- restoring operations.
Documents that could be needed in an emergency include:
Emergency call lists
Lists (wallet size if possible) of all persons on and off site who would be involved in responding to an emergency, their responsibilities and their 24-hour telephone numbers
Building and site maps
- utility shutoffs
- water hydrants
- water main valves
- water lines
- gas main valves
- gas lines
- electrical cut-offs
- electrical substations
- storm drains
- sewer lines
- location of each building (include name of building, street name and number)
- floor plans
- alarm and enunciators
- fire extinguishers
- fire suppression systems
- designated escape routes
- restricted areas
- hazardous substances (including cleaning supplies and chemicals)
- high-value items.
Lists of major resources (equipment, supplies, services) that could be needed in an emergency; mutual aid agreements with other companies and government agencies.
The development process
Identify challenges and prioritise activities
Determine specific goals. Make a list of tasks to be performed, by whom and when. Determine how you will address problem areas and resource shortfalls.
Write the plan
Assign each member of the planning group a section to write. Determine the most appropriate format for each section.
Establish an aggressive timeline with specific goals
Provide enough time for completion of work, but not so much as to allow assignments to linger. Establish a schedule for:
- first draft
- second draft
- conduct table top exercise (see step 7)
- final draft
Establish a training schedule
Have one person or department responsible for developing a training schedule for your facility.
Coordinate with outside organisations
Meet periodically with local government agencies and community organisations. Inform appropriate government agencies that you are creating an emergency management plan. While their official approval may not be required, they will likely have valuable insights and information to offer.
Determine requirements for reporting emergencies, and incorporate them into your procedures.
Determine protocols for turning control of a response over to outside agencies. Some details that may need to be worked out are:
- Which gate or entrance will responding units use?
- Where and to whom will they report?
- How will they be identified?
- How will facility personnel communicate with outside responders?
- Who will be in charge of response activities?
Determine what kind of identification authorities will require to allow your key personnel into your facility during an emergency.
Maintain contact with other corporate offices
Communicate with other offices and divisions in your company to learn:
- their emergency notification requirements
- the conditions where mutual assistance would be necessary
- how offices will support each other in an emergency
- names, telephone numbers and pager numbers of key personnel.
Incorporate this information into your procedures.
Review, conduct training and revise
Distribute the first draft to group members for review. Revise as needed. For a second review, conduct a table top exercise with management and personnel who have a key emergency management responsibility. In a conference room setting, describe an emergency scenario and have participants discuss their responsibilities and how they would react to the situation. Based on this discussion, identify areas of confusion and overlap, and modify the plan accordingly.
Seek final approval
Arrange a briefing for the chief executive officer and senior management and obtain written approval.
Distribute the plan
Place the final plan in three-ring binders and number all copies and pages. Each individual who receives a copy should be required to sign for it and be responsible for posting subsequent changes.
Determine which sections of the plan would be appropriate to show to government agencies (some sections may refer to corporate secrets or include private listings of names, telephone numbers or radio frequencies). Distribute the final plan to:
- chief executive and senior managers
- key members of the company's emergency response organisation
- company headquarters
- community emergency response agencies (appropriate sections).
Have key personnel keep a copy of the plan in their homes. Inform employees about the plan and training schedule.
The materials presented herein are for general reference only. It does not address all potential compliance issues within the United Kingdom or any regulatory agency standards. Individual circumstances may require the addition of policies, amendment of individual policies and/or the entire plan to meet specific situations. These materials are intended to be used only as guides and should not be used, adopted, or modified without competent legal advice or legal opinion. These materials are presented, therefore, with the understanding that the company is not engaged in rendering legal, accounting, or other professional service. If legal advice or other expert assistance is required, the services of a competent professional should be sought.