Skip to main content

Emergency Planning

Guidance on Business Continuity Management

It’s Your Business

A picture of a stack of dominos and a padlock‘Remember – in an uncertain world, you owe it to yourself, to be an organisation that is confident of being ‘back to business’ in the quickest possible time’

(Source: National Counter Terrorism Office)

  • 80% of businesses affected by a major incident close within a month.
  • 90% of businesses that lose data from a disaster are forced to shut within 2 years.
  • 58% of UK organisations were disrupted by September 11th. Of those disrupted 12 % were seriously affected.
  • Nearly 1 in 5 businesses suffer a major disruption every year.

(Source: Chartered Management Institute Business Continuity Survey)

Are you one step from disaster? Business Continuity planning from Shetland Islands Council:

Business Continuity for Local Businesses and Voluntary Organisations

This is a link to a dedicated website created to provide you with help in developing Business Continuity Plans for your organsation.

 

Further Business Continuity Information:

 

A picture of business crisis block letters wrapped in dynamite

Statement of aim

The aim of this guidance it to provide a general overview of the subject and help you to develop a solid business continuity infrastructure that will allow you to be resilient and carry on if you ever face an incident.

Back to top

What is the role of Shetland Islands Council in Business Continuity Management?

The Civil Contingencies Act 2004 requires local authorities to provide general advice and assistance to businesses and voluntary organisations in relation to Business Continuity Management. This duty is an integral part of the Act’s contribution to building the UK’s resilience to disruptive challenges.

Back to top

Would your business survive a crisis?

How would you cope if your offices were flooded? Would important work be lost if you experienced a lengthy power cut? What would happen if half of your workforce went down with flu over several weeks? Following any serious accident or disruption could your business be up and running quickly? Could you do your job and meet the needs of your clients and customers or would your business be seriously damaged?

If you don’t know the answers you should be thinking about Business Continuity Management (BCM) because experience has shown that organisations with business continuity arrangements in place are more likely to stay in business and recover quickly in the event of an emergency than those who do not.

Back to top

What is Business Continuity Management?

A picture of a puzzle piece

Business Continuity Management (BCM) is a planning process that helps manage risks to the smooth running of an organisation or delivery of a service, ensuring continuity of its critical functions in the event of an incident, and effective recovery afterwards.

BCM is about thinking ahead and planning for any crisis, and making sure that your business can recover quickly and survive. The purpose of Business Continuity is to ensure that you can respond sensibly, as a company and as individuals, and a crisis does not become a disaster.

Good business continuity requires a clearly defined and documented Business Continuity Plan (BCP) for use at the time of an incident.  The Plan should identity all the requirements, which are essential to keeping your business running, and should include processes to keep disruption to customers and employees to a minimum.

Business Continuity is something every organisation, large or small should aspire to. Plans should be clear, simple (but not simplistic) and tailored to the needs of the business.

Business Continuity should become part of the way you perform business.  It is better to plan for incidents that may affect your organisation rather than having to catch up when they actually happen.

Back to top

What are the benefits of Business Continuity Planning?

There is a multiplicity of benefits to be gained from the implementation of BCM within your organization. A carefully thought Business Continuity Plan can significantly reduce your losses if ever you are hit by a disaster. It will also prove to your customers, investors and insurers that you take business seriously and consider the provision of service a high priority. Moreover, it will help your organization to identify ways of strengthening any shortcomings, create awareness of useful ways to improve your business and possibly give an edge over your competitors.

In 2008:

  • 43% of organisations were disrupted by loss of IT;
  • over 1 in 3 experienced loss of staff;
  • 30% experienced loss of telecommunications;
  • 94% of those who had used their business continuity plans agreed that they had reduced disruption;

See Chartered Management Institute 2008 Business Continuity Survey Report for further information.

Back to top

Why should I use Business Continuity Management?

 

A picture of a domino effect

  • 'It won't happen to us'
  • 'We're too big to fail'
  • 'We will cope - we always do'
  • 'Our insurers will pay for everything'
  • 'We've got enough to do already, we haven't got time to prepare for something that might never happen'

Above are frequent responses by businesses when asked about their lack of business continuity, some of these you may be thinking yourself. However, a number of businesses that have failed following an incident suggest that such responses are based on false assumptions.

‘Research has shown that following a catastrophe organisations that have successfully dealt with a crisis have seen their share value increase in the long-term. In contrast to those who have been perceived not to have managed the crisis well whose share price declined and after a year had still not recovered.’ (BCI, 2005)

No business is immune to the effects of disruption so it makes sense to take some basic steps to protect the key parts of your business in advance.

Without business continuity, a natural or man-made disaster could result in:

  • Loss of work to competitors;
  • Loss or damage to property or premises;
  • Damage to reputation/brand;
  • Loss of staff;
  • Health and safety liabilities;
  • Increased insurance premiums;

Back to top

Does a small company or voluntary organisation need a Business Continuity Plan?

Yes, every organisation (even a sole trader) is advised to have systems in place to be able to continue to work in case of matters such as fraud, theft, sabotage, flooding, fire, technological and utility failures and terrorist attacks.

Back to top

Does the Council have a Business Continuity Plan?

Yes. The Business Conitnuity Plans have been developed and are maintained by all the Council's services. This ensures that, should a disruption occur, critical services can continue to be delivered to a pre-determined level.

Back to top

But I'm insured, aren't I?

The likelihood is, you will recover 30% to 50% of the total cost of an insured interruption, and you still have to keep the business going while your losses are assessed.

Back to top

What type of incidents should I plan for?

“Whilst bombs, fires and floods capture the headlines, almost 90% of business-threatening incidents are quiet catastrophes that go unreported in the media but can have a devastating impact on an organisation’s ability to function." (Business Continuity Good Practice Guidelines 2008)

Disruptions vary and could come from a number of sources:

  • Severe weather – e.g. hurricane, flood, etc.;
  • Theft or vandalism;
  • Fire;
  • Loss of utility – loss of power or water for an extended period of time;
  • IT system failure – e.g. computer viruses, accidental loss of files, computer failure;
  • Disruption to fuel supplies;
  • Restricted access to premises;
  • Illness of key staff;
  • Outbreak of diseases or infection;
  • Malicious attack;
  • Disasters affecting suppliers – how would you source alternative supplies?
  • Disasters affecting customers – will insurance or customer guarantees offset a client’s ability to take your goods or services?

Although you may feel that some of these situations would not affect your business, it is sensible to give them consideration.

Community Risk Registers can provide businesses with useful information on the risks in the local area. Community Risk Registers are available online. http://www.handiprepared.gov.uk/shetland-isles.asp

Back to top

What does Business Continuity Management involve?

The Business Continuity Management (BCM) lifecycle is a simple and structured process consisting of five stages:

A picture of a Business Continuity lifecycle(Source: the lifecycle diagram, BSI British Standards BS 25999-1)

 

1. Understanding the organisation

The first stage of the Business Continuity lifecycle involves carrying out Business Impact Analysis (BIA) and Risk Assessment (RA). They will help you to understand your business and identify its recovery requirements.

The purpose of a BIA is to assess the quantitative (financial) and qualitative (non-financial) impacts, effects and loss that might result if your business was to suffer a disruption.

RA is used to identify internal threats to the organization e.g. damage or denial of access to premises; loss of utilities, including electricity, gas and water; failure of business partners or service providers; unavailability of key staff; infiltration of IT systems by viruses and other forms of malicious software.

At this stage you may consider asking the following questions:

  • What are the objectives of the organisation?
  • What are the products / services of the organisation?
  • Who is involved? (both internally & externally)
  • What deadline do you work to?

2. Determining BCM strategy

The information gathered from undertaking the BIA and RA will enable you to develop an appropriate business continuity strategy. The strategy should define how the continuity of business processes would be maintained in the event of a disaster and it also should cover both risk reduction and recovery.

Typically, the recovery options should cover:

  • People and accommodation;
  • IT systems, networks and data;
  • Critical services such as power, telecommunications and post;
  • Critical assets such as records, reference material and post;

3. Developing and implementing BCM response

The third stage of the lifecycle is concerned with the development and implementation of appropriate plans and arrangements to ensure continuity of the business’s critical activities and the management of an incident.

Your BCP should include:

  • Details of who would manage an incident;
  • How this team would be activated and where they would go;
  • A prioritised list of your key activities;
  • The minimum resources you need to carry out these activities;
  • What your backup for each resource would be if they were unavailable;
  • Specific procedures such as details of where you could operate from if you could not access your normal buildings, how you would access your data backups in this instance and how you would communicate with people;
  • Contact lists of staff, key suppliers and customers;

Business Continuity Plan will ensure that the key personnel know their roles and responsibilities during an incident and the actions they should take. It will also identify which activities need to be brought up and running to ensure that the most critical functions of your business are up and running in the shortest possible time.

Your business continuity plan should become a living document that is reviewed regularly in light of the changes that occur within your organisation ensuring that it remains up to date and effective.

4. Exercising, maintaining and reviewing

Once the plans are documented and implemented they should be regularly exercised. You need to remember that Business Continuity Management is not a ‘one-off’ process. As your business changes, then your plans must also change to reflect that. Therefore, it is important that you review your business continuity arrangements on the regular basis and that these changes are reflected in your business continuity plans.

Exercising your plan can take place in a variety of ways, from walking-through aspects of the plan or a tabletop exercise to a full-blown simulation. Testing elements of your plan at a time tends to be less disruptive and allows you to focus on gaining as many valuable lessons learned as possible.

Once you’ve carried out testing and exercising of your plans you will have identified areas where you can improve things - at this point you should make changes to your plan to ensure it reflects these improvements and remains up to date.

5. Embedding BCM in the organisation's culture

Having a plan that sits on a shelf will not be sufficient to ensure your organisation survives an incident. People must be aware of its contents, their roles and responsibilities, and be taught how to use it.

It is important that a continuity culture is embedded in your organisation by raising awareness throughout the organisation, and offering training to key staff on business continuity issues.

Embedding business continuity and having a structured, well developed and rehearsed plan helps your business to recover and return to ‘business as usual.’

Back to top

Top tips for business survival

A picture of a laptop on a lifebuoy ring

  • Plan for the effects of an incident, not the cause.
  • Prevention is better than cure.
  • Test your Business Continuity Plan at least once a year.
  • Ensure data is effectively backed up and store copies off-site in a secure place.
  • Ensure that important paper documents, such as contracts and employee information are protected. Make copies and use fire resistant and water proof storage.
  • Keep a list of contact details for your staff, customers and suppliers off-site.
  • Be clear about what your insurances cover and what they don’t.
  • Have an emergency pack, which will include your Business Continuity Plan as well as first aid kit, key telephone numbers, mobile phone with credit available, spare keys, money, stationery, torch etc.
  • Make arrangements for an alternative location that is easily accessible to your staff in the event of invocation – you may not be able to operate out of your existing premises for weeks or even months.
  • Make an inventory of equipment, materials, products and any other assets to give you an overview of your business.

Back to top

Are you ready?

A picture of a 3D puppet with a lifebuoy ring

Can you answer 'yes' to the following questions?

  • Does your business have a Continuity Plan?
  • Have you identified someone responsible for leading a crisis response?
  • Do you know what processes are critical to continuing in business?
  • Do you have arrangements to communicate with staff, or their relatives, in a crisis?
  • Could you cope if a large number of staff were absent?
  • Are your business computer records protected and backed up off-site?
  • Are your suppliers (including utilities) resilient with their own Business Continuity Plans?
  • Can you access essential equipment at short notice?
  • Have you tested your assumptions about recovering from a business crisis or range of emergencies that might affect your business?

If you can't answer these questions, take action before it's too late...

It's your business

Back to top

Further information

A wide range of advice on BC is available. Please see the links to relevant websites below. More Business Continuity Information will be added to this web page so please check again in the future.

Useful websites

Back to top

Downloads