Strategies to continue critical business functions by understanding business impacts, time objectives, and resource needs.
Supply chain failure, computer application failures, voice and data communications outages, machinery and equipment breakdown, building damage, loss of power, and pandemic disease are just a few of the potential causes for business interruption. In today’s business world of high efficiency and minimal tolerance for downtime, businesses have to prepare. Customers are demanding it. More and more regulations require it.
Business continuity planning begins with management commitment and a clear understanding of the business. A steering committee comprised of managers from major business functions should be organized. A business impact analysis should be conducted to identify business priorities and identify the resource requirements to support mission critical processes. Continuity strategies and manual workarounds should be developed and documented in a business continuity plan. The business continuity program including plans and capabilities should be implemented and evaluated through a process of training, testing, and exercising.
We begin by asking questions to learn about your business. We help organize a business continuity team bringing together administrative, operations, and technology staff. We conduct a risk assessment to identify hazards and scenarios where facilities, systems, or equipment may be damaged or operations may be interrupted. We identify opportunities for loss prevention and hazard mitigation.
Using customized questionnaires and interviews, we identify critical business functions and the potential impacts that the interruption of critical functions could cause over time. Our goal is to determine the maximum allowable downtime—the “recovery time objective”(RTO)—before the impact of the interruption becomes unacceptable.
During the business impact analysis we help you prioritize the recovery of time critical functions. We also identify the minimum resources—personnel, facility, technology, supply chain, and vital records—needed to support critical business processes at minimally accepted levels. Our facilitated discussions also help to identify manual processes—“workarounds”—to overcome the loss of systems and equipment.
We facilitate discussions and present options for development of business continuity strategies to sustain critical business functions. These include reviewing alternate office, computing, operations, and communications facilities. We explore options that may include use of alternate company facilities, contracted facilities and services, and reciprocal agreements.
We help to compile planning documentation into a cohesive plan that will be immediately accessible. We help organize the business continuity team, compile business continuity requirements, develop continuity strategies, write damage assessment guidance, and document incident management procedures.
A business continuity plan is only as good as the capabilities of personnel to respond during an emergency. We conduct classroom training to familiarize personnel with the business continuity plan, plan activation, and team roles and responsibilities. We design and facilitate tabletop exercises with scenarios that are specific to your facility, operations, and plans. Exercises enable members to better execute the plan, and they can identify gaps or weaknesses.
We have attained DRI International’s lead auditor certification and teach their four-day certification course for auditors of emergency management and business continuity programs. We have developed a comprehensive audit tool and prepare detailed reports with recommendations prioritized for program enhancement. Evaluation criteria are based on regulatory requirements, our National Preparedness Standard, and best practices. Our evaluations provide a clear picture of program strengths and weaknesses within an easy to use report.
Our preparedness bulletins provide guidance for program development, implementation, and evaluation.
Conduct a risk assessment to identify the threats and hazards that could cause unacceptable impacts to the assets of your organization. Potential impacts are determined by the location and magnitude of the hazard, and vulnerabilities of the infrastructure, site, buildings, operations, systems, equipment, and people. A comprehensive risk assessment will provide a picture of risk that can be used to prioritize hazard mitigation and build other preparedness programs.
A BIA is a management-level analysis that identifies the potential impacts of business interruption and their escalation over time. Loss of revenue, loss of market share, deferred revenue (cash flow), increased expenses, regulatory fines, and contractual penalties (or loss of incentive bonuses) can be estimated. Impacts on relationships with customers, regulators, and other stakeholders are also considered.
There are many potential causes for supplier failure, and the impact to business operations can be significant. Analysis of supplier risk should begin by identifying the products that generate the most value to the organization. Next, identify the suppliers for those product lines. Survey all suppliers that are sole or single source then others that are considered highly valued. Construct a risk survey to help you understand the resiliency of your critical suppliers.
Emergency plans should include actions to protect life safety from foreseeable hazards identified during the risk assessment. Protective actions include evacuation, lockdown, and shelter-in-place. If an armed perpetrator is inside a building threatening or actively using a weapon to harm people, occupants must know whether to “run” from the building; “hide” from the perpetrator(s) (also known as “lockdown”), or “fight” (counter) the perpetrator.
Before the heavy snow warnings are broadcast and the frigid blasts of arctic weather arrive, it’s important to prepare your facility and your employees. Preparations before the severe weather can save costly damage to equipment and facilities and maintain important fire and life safety systems. Plans should also include actions to be taken if power or other utilities are interrupted.
Melting snow can combine with rain in the winter and early spring; severe thunderstorms can bring heavy rain in the spring and summer; or tropical cyclones can bring intense rainfall to the coastal and inland states in the summer and fall. Flash floods occur within six hours of a rain event, after a dam or levee failure, or following a sudden release of water held by an ice or debris jam.
Hurricane season begins each year on June 1. No matter the forecast for number of storms, major hurricanes, and land-falling hurricanes, it only takes one storm to cause many deaths and billions in damages. “Superstorm” Sandy was not technically a hurricane when it made landfall, but it caused billions in damages. Recovery efforts continue years later.
Summer is thunderstorm season, and thunderstorms bring lightning, heavy rainfall, hail, and tornadoes. Resulting fatalities, property damage, and losses from business interruption are significant. Natural hazards can’t be prevented, but emergency management can protect life, mitigation can reduce property damage, and business continuity planning can speed recovery and reduce operational impacts.
Since 2009 the world has not faced a significant pandemic, but experts warn it is just a matter of time. The Center for Infectious Disease Research and Policy (CIDRAP) reports that pandemics occur on average roughly three times per century. However, “scientists wouldn’t be all that shocked if pandemics started coming more frequently.” Now is the time to review, update, and exercise a pandemic preparedness program.
Will your preparedness program safeguard lives if there is a fire or active shooter? Will business continuity strategies enable you to continue priority operations when your building can’t be reoccupied? Will your communications plan enable you to quickly and effectively communicate with your customers and stakeholders as news is tweeted and blogged soon after emergency vehicles arrive? Auditing your program will answer these questions and identify opportunities for program improvement.