Business Continuity

Planning

For Small to Medium Sized Businesses

Page 1
 Plan Template Guide

Follow the guidance below to help you complete the plan template. (the plan template can be
found on page 12.)

1. Know your business

2. Assess the Risks

3. Formulate the plan

4. Test the Plan

In the plan template, complete the information on the front page and in the
introduction section
Front Cover Add your logo, company name and the
date the plan was last amended
Distribution List List who has a copy of the plan and
where each copy is held. This will
ensure that when you update the plan
you know who will need a copy
‘Any suggested changes’ statement Add in the name of the person who is
responsible for updating the plan
References List any other plans, legislation, policy
or guidance that may be relevant to
your BCP e.g. fire evacuation plan
Aim and Objectives A generic Aim and Objective have
been inserted here which can be
amended if appropriate

The following guidance will help you to fill in the rest of the template……….

1. KNOW YOUR BUSINESS

Page 2
In order to develop a Business Continuity Plan, you need to have a thorough
understanding of your business. This involves knowing the critical functions 1
being disrupted and the priority for recovery of those functions. This process is
known as a ‘Business Impact Analysis’

To complete a Business Impact Analysis for each critical function, follow the
guidance below:

Critical Functions:
You need to consider what the critical functions / activities are for your business-
without which it would cease to operate?

Examples of Critical Functions, using a small manufacturing company as an

example are:
 Staff wages
 Call centre
 IT department
 Sales
 Goods in
 Distribution
 Manufacture

NB- you will need to complete a Business Impact Analysis for each of your
critical functions/teams. The plan template has 2 blank Business impact analysis
tables in it. For additional Critical Functions for your business you will need to
‘copy and paste’ the table into the plan again.

1.
”Critical Function” is a term used to describe a function of your business without which, your
business cannot perform. The criticality of a function may change with time, e.g. performing the
role of examination moderator in a school would be more critical just before exam time than after it.

Effect on Service:

Page 3
You should consider the importance of the function upon the survival of your
business (percentage of income or work load, how critical the function is to other
functions, etc) and how quickly each function must be re-established.

For each of the time spans detailed, identify what the effect of the loss of the
critical function would be (see Illustration below)

For example, disruption to the Goods-In function could have the following effect
on the business:

First 24 hours
 Lack of stock causing orders not to be completed on time
 Storage space for part processed goods, causing concern
24-48 hrs
 Manufacturing hours cut due to lack of stock
 Company reputation damaged

Up to one week
 Financial implications of missed deadlines
 Need to outsource work to maintain market share

Up to 2 weeks
 Loss of customers to competitors
 Temporary or permanent reduction in staff numbers

Resources required for recovery:

Page 4
This section will help you identify what resources you need and when you need
them. When completing this section you need to consider the effects of loss of
function/service, per time span, as detailed in the illustration

Number of Staff:
You will probably not need all your staff to be present immediately after an
emergency.

For each time span, detail how many staff you would need.

For example, if you had a problem with a key supplier and no stock was
available, you may not need your fork lift truck driver, stock controllers, and
quality checkers etc to be all working to full capacity within the first 24 hours.

Relocation:
Could the function be carried out by your staff anywhere else?

For example, working from home, in another branch office, mutual aid with
another organisation etc.

Equipment Required:
For each time span, list what resources are required e.g.
 Computers (hardware and software)
 Vehicles
 Machinery
 Communication equipment (landlines/mobiles)

Data required

List what data is essential to the delivery of the service/ critical function eg:
 Customer contact details
 Supplier contact details
 Service/maintenance contracts and contract numbers
 Insurance details
 Costing
 Work in progress
 The completed Business Impact Analysis will assist you to prioritise what
function or service you need to reinstate first during an emergency.

Using your Business Impact Analyses, complete the Critical Function Priority List
in the plan template.

2. Assess the Risks

Page 5
Risk is a statement of the chance of something happening that will impact on
your business objective. Risk is normally considered in terms of impact and
likelihood of a hazard affecting your business. By assessing your risks, you will
be able to prioritise your risk reduction activities

There are many hazards that may disrupt your business these may include:

 Flooding
 It failure/loss of data/loss of key documentation
 Utility failure (water, electricity, gas, telephone)
 Fire or explosion
 Transport accident
 Extreme weather (wind, rain, snow, ice, heat)
 Loss of premises (temporary or permanent?)
 Staffing issues

These hazards will affect different businesses differently, and the critical
functions within them, to varying degrees.

In the hazard analysis table list the hazards to your business, the impact of each
hazard, any mitigation in place or possible and the risk matrix score.

Hazard: In this column, list the hazards faced by your

organisation.
Hazard Impact List the physical disruption that may be caused
List the financial implications of this disruption
List people affected by the disruption (staff,
clients, partners) e.g flooding event
 Loss of access and utilities
 Water damage to equipment and stock
 Cost of damage and or fines for
pollution teams working on ground floor
 Customers and suppliers
Mitigation in place List what you currently do that prevents or
reduces the likelihood or the impact of the
hazard. E.g. flooding event:
 Relocate premises to higher ground
 Floodgates/sandbags stored ready for
use
 What could you do that you don’t do
now that would reduce the risk of such
an incident?
Risk matrix score: As described below

Page 6
The risk matrix, shown below, helps you to identify the higher priority risks for
your business. When considering the score, you should think about any
mitigation currently in place or possible

By determining the likelihood of the hazard occurring (either high or low), then
determining the impact that hazards has on your business, it is possible to rate
the risk as A, B, C or D.

For example:
The likelihood of a chemical spill at your business: LOW (B or D)
The Impact a chemical spill would have on your business: HIGH (A or B)
The risk matrix score would be B

When completed, the Hazard Analysis table shows which the highest risks to
your business are. You can now make an informed decision as to whether to
accept or treat the risk.

ACCEPT: you may decide that you are happy to ‘live with’ the risk as the cost of
implementing any risk strategies may outweigh the benefits.

TREAT: you want to treat the risk i.e. take steps to reduce the impact or reduce
the likelihood (possible mitigation) because the risk is too high for your business
to accept.

It is not possible to mitigate against all risks, this is why a plan is required.

Page 7
3. FORMULATE THE PLAN TO RESPOND TO AN EMERGENCY

Having completed the Business Impact Analysis and Hazard analysis table, you
now need to develop a generic checklist of actions that may be appropriate when
an emergency occurs. The checklist in the plan template is designed for you to
adapt to suit your business. You may wish to add text into the plan to outline any
arrangements you already have in place, including any specific actions you
would take for specific hazards.

The checklist can be used during an emergency to ensure that no major tasks
are forgotten.

Start a log of actions taken It is essential to keep a log of the actions you have
taken and the decisions you have made.
Include a time with each entry.

This information will be vital if you have to defend

in court any actions you have taken.

A blank copy of a log sheet is located at the end of

the plan template for use during an emergency.
Liaise with Emergency If the Emergency Services are involved in the
Services incident, you will need to appoint somebody from
your organisation to act as a liaison officer. This
person needs to pass information between the
Emergency Services and your internal response
team.
Identify any damage As soon as possible, but only if safe to do so, an
assessment must be made as to the extent of what
damage has been caused by the emergency.

Consider and document the following:

 Injury to staff, contractors or the public
 Damage to buildings
 Damage to equipment/vehicles
 Damage to stock
 Damage to reputation
Identify Functions Document which functions or areas have been
Disrupted disrupted and the extent of the disruption.
Convene your Business You need to pre-identify who, within your
Recovery Team organisation will make up the team that will
manage the response and recovery from the
emergency.
If the emergency is such that you need to call the
team together, you will need to do so as soon as
possible

Page 8
 In the contact sheet at the back of the Plan
Template, identify and list the members of your
response and recovery team
Provide information to staff It is essential to keep your staff informed regarding
the emergency, and the response actions being
taken.
Staff may be concerned about:
 Colleagues who may be injured
 What is expected of them today
 Should they turn up for work tomorrow
 Will there still be a job for them if the
building has gone up in smoke etc
Issue a number for staff to call in on or, depending
on the scale and the type of the emergency, tannoy
announcement, e-mail and intranet, poster in a
reception area, local radio or phone call to all staff.

Remember- providing information quickly will stop

rumours!
Decide on course of action Decide what you need to do and produce an action
plan. Use the Critical Function Priority List and the
Business Impact analysis to assist you
Communicate decision to Let staff and business partners know what you
staff and business partners have decided to do
Provide public information Appoint a member of staff to act as your media
to maintain reputation and representative. This person should be trained in
business media response techniques and be able to answer
questions regarding the emergency and the
business in general.

Your media representative should work in

collaboration with the Emergency Services Media
Officer if possible

A holding statement could be pre-prepared for your

business so that you just have to fill in the blanks at
the time.
Arrange a de-brief After every emergency it is important to hold a de-
brief so that you can learn from the experience.

Disseminate the lessons learnt to all concerned

Review Business Following an emergency, you should review and
Continuity Plan amend your plan as necessary

The next page of the plan template has a Key contacts list

Page 9
The list should be adapted to be relevant for your business. Consider including
details of key employees, utilities, insurance company, suppliers, customers, key
holder, security company, partner organisations members of your response team
etc.

In line with the Data Protection Act, you will need to ensure that you have the
permission to hold personal information such as home contact numbers of your
staff.

The final page of the plan template is a sample “Log Sheet” for you to use during
an emergency.

4. TEST THE PLAN

It is important that, once your plan is written, you test the procedures you have
put in place.

Before a plan can be tested, employers and employees need to be familiar with
the content of the plan and their role in the response and recovery. This can be
done by reading through the plan together and discussing how you would apply it
to a fictional scenario.

When you are confident that your members of staff understand the plan, and
their part within it, you should test the plan by acting out a scenario.

The Business Continuity Management Process is an ongoing one; it is vital that

the planning process does not end once the plan has been written. The plan,
BIA, and risk matrix should be reviewed and tested regularly to ensure that they
remain up to date and effective.

Page 10
[Insert name of company/
logo]

Business Continuity Plan

Page 11
 Date: ____________________

Introduction

Aims of this Plan

To prepare the business to cope with the effects of an emergency

Objectives
 To define and prioritise the Critical Functions of the business
 To analyse the risks and threats to the business
 To detail the agreed response to an emergency
 To identify Key Contacts during an emergency

Distribution List
Copy Number Name Location
001
002
003
004
005
006

Page 12
Vital references and related documents
Document Name Location

Page 13
 Business Impact Analysis

Critical Function:

Effect on Service:
TIME Effect on Service:
First 24 hours

24-48 Hours

Up to 1 week

Up to 2
weeks

Resource Requirements for Recovery:

Time No. Staff Relocation Resources Data required
Y/N & Required
location
First 24 hours
24-48 hours
Up to 1 week
Up to 2 weeks

Page 14
 Business Impact Analysis

Critical Function:

Effect on Service:
TIME Effect on Service:
First 24 hours

24-48 Hours

Up to 1 week

Up to 2
weeks

Resource Requirements for Recovery:

Time No. Staff Relocation? Resources Data required
Required
First 24 hours
24-48 hours
Up to 1 week
Up to 2 weeks

Page 15
 Business Impact Analysis

Critical Function:

Effect on Service:
TIME Effect on Service:
First 24 hours

24-48 Hours

Up to 1 week

Up to 2
weeks

Resource Requirements for Recovery:

Time No. Staff Relocation? Resources Data required
Required
First 24 hours
24-48 hours
Up to 1 week
Up to 2 weeks

Page 16
 Critical Function Priority List

Priority Critical Function

1
2
3
4
5
6
7
8
9
10

This list can be used during an emergency to assist your decision making when
compiling an Action Plan as to which functions need to be re-instated first.

Page 17
 Hazard Analysis Table

Risk Matrix Score

A = HIGH Likelihood and HIGH Impact
B = LOW Likelihood and HIGH Impact
C = HIGH Likelihood and LOW Impact
D = LOW Likelihood and LOW Impact

Hazard Impact Mitigation in Mitigation Risk Matrix

Place Possible Score
Flooding

IT failure
Loss of
Electricity

Fire

Loss of staff

Loss of key
information

Page 18
 Emergency Response Checklist

For use during an emergency

 Start a log of actions taken

 Liaise with Emergency Services

 Identify any Damage

 Identify functions disrupted

 Convene your Response/Recovery Team

 Provide information for staff

 Decide on course of action

 Communicate decisions to staff and business partner

 Provide public information to maintain reputation and business

 Arrange a de-brief

 Review Business Continuity plan

Key Contact Sheet

Page 19
Contact Office Number Mobile Number Useful
Information

Date Time Information/Decisions/Actions Initials

Page 20
Page 21