Business Continuity Planning
Your crisis plan should address some components of a comprehensive business continuity plan. However, implementing a business continuity program is a good next step to help ensure that business processes can continue during an emergency or disaster.
There are four components of a solid business continuity program:
1. Conduct a Complete Business Impact Analysis
Complete a review of all the business processes within the organization, and the technology, services and vendors required to support them. Next, analyze the list to identify which are most critical for the business’s survival.
Depending on the size and complexity of your business, identifying all of these might be challenging, but administering a questionnaire that all business leaders are required to complete is one way to help you identify any gaps in the list.
Once all business processes have been identified, prioritizing them is the next step. In the event of a disaster, you’ll want to have already identified what processes are most critical to keep your business running. Of course you want to save everything, but if you can’t you must have the systems in place to save what you absolutely need.
2. Conduct A Risk Assessment
Create as comprehensive a list as possible of the specific types of risks that could impact each business site or location. For example, a business site on the Florida coast may be at risk of hurricanes, while a business site in Wisconsin needs to prepare for a crippling blizzard. Both may be at equal risk from a non-weather crisis, however. Each risk should be considered in terms of likelihood and possible impact on the business.
3. Business Continuity Plan
In creating the plan itself, the two previous items are considered in concert with each other to create a step-by-step strategy for the business to recover from whatever the crisis may be.
As part of your gap analysis, determine the gaps between recovery requirements and current capabilities. Then explore recovery options, and take the proper steps to implement them. Also consider what equipment or other supplies are needed that may be required by various processes.
From the first realization a crisis is occurring to resuming operations as normal afterward, a business continuity plan should identify the following for each of the events your business is most to prone:
- Relocation/alternate site plans
- Recovery teams and decision-makers, and directives for what they do when a crisis begins, designating a clear chain of command
- The critical processes that are most impacted, and disaster recovery procedures for IT and business continuity teams
- Applicable work-arounds for systems that can’t be recovered immediately
- Communication plans (see to Communications Planning for more)
- Long-term implications and plans should the disaster have an ongoing or longer-than-expected impact
- Post-crisis plans for returning processes to normal, reconstructing systems if needed, filing reports with insurance carriers and the appropriate regulatory agencies
The plan isn’t complete until it’s been tested. This means role-playing through the crisis and including both physical tests and technical — or IT — tests. In a technical test, you’ll want to consider: Can the information be relocated to a safe site? In a physical test, you’ll want to consider: Can a building be evacuated and a remote office set up in another site? Don’t neglect user acceptance testing after systems are moved; if your recovery system is implemented, the people who use the systems every day need to be able to resume their work with a minimum of adjustment.
Your crisis team, including executive management, should review and approve the initial plan, and revisit it annually after testing.
No matter what kind of crisis your business faces, it doesn’t come alone — whether it’s a natural disaster, pending litigation or security compromise — it often comes with a communications crisis attached at the hip. Poor handling of communications during a crisis can shake confidence, erode employee morale or impact your public reputation, compounding issues and worsening the crisis.
For each type of risk you identify, your crisis communications plan should:
1. Identify Relevant Audiences
Revisit and expand your audience list for each type of crisis. Consider whether each audience has different segments that need to be communicated to uniquely for each scenario. For example, do you need to communicate something additional to your customer-facing employees than other employees?
2. Identify Communication Channels
Identify which communication channels are available and effective for each audience segment in various crisis scenarios.
3. Document Procedures for Approval and Deployment
Intended communication may require approval from different individuals or groups within the organization. Make sure those processes are outlined in your final plan, and detail the proper steps and key players before issuing any communication.
4. Develop Communication Templates
Though you can’t predict the future, by creating communication templates and ensuring they are preapproved by the proper parties in advance, you’ll be much more nimble when every minute counts. Another advantage to creating communication templates is you can weigh messages when you’re in a clear frame of mind versus being in a reactionary mode during a crisis.
5. Identify & Train Spokespeople
Carefully select individuals who can represent your organization in the event of a crisis, then provide media training for those spokespeople. It’s essential that each of them understands the basics of how to effectively interface with the media in critical times.
You should also make sure that your crisis and recovery teams know who the identified spokespeople are, so that unauthorized individuals do not speak on behalf of your company.
Your crisis team and executive management should review and approve the final plan, and revisit it annually after testing.
After A Crisis
No doubt about it, handling a crisis is exhausting. But when it’s over your work isn’t done. It’s important to conduct a review session with every response team participant. Then revisit your plan, evaluate your actual response and adjust your plan accordingly. Don’t let the experience you just had in crisis management go unused.