PRA: What is the business recovery plan?

In a situation of confinement since March 16, the majority of businesses, regardless of their size or sector of activity, have had to completely stop their activity or maintain a minimum of activity. This exceptional situation has an impact on their turnover, and the way they manage this situation will have an impact on their image.

To know how to deal with a disaster or a major crisis, businesses must put in place a business recovery plan (PRA). This strategic document generally exists for the computer system, which is likely to suffer multiple disasters: hardware or software failure, backup problem, cyber attack, human error or natural disaster, etc. The PRA allows the company to resume its activity as quickly as possible.

Unfortunately, the majority of businesses, and especially SMEs, do not see the point of having a PRA or a PCA (business continuity plan) as long as they are not confronted with a disaster situation. It's a bit like insurance, you feel like it's useless until an accident happens.

What is the PRA?

The business resumption plan, or Disaster Recovery Plan in English, provides a set of procedures to follow for the company to quickly resume its activities following a major disaster (loss or destruction of vital data, fire, power outage, flood, etc.). The objective of the PRA is to ensure the rapid resumption of the company's activities to avoid a loss of turnover and/or a negative impact on its image.

According to the standard ISO 22301:2019, section 8.4.5: the company “should have documented processes in place to restore and return to business activities based on temporary measures adopted during and after a disruption.”

A disaster recovery plan is a structured document that describes step-by-step the precautions to be taken to limit the effects of a disaster so that the organization can continue to operate or quickly resume essential functions to fulfill its mission.

Difference between PRA and PCA

But what is the difference between PCA and PRA? In the case of Business Continuity Plan (BCP), the aim is to ensure that the company's activity continues or stops as little as possible during a major crisis situation. The PCA provides procedures to be put in place to maintain essential business activities. It is a short-term solution, to respond immediately to a critical situation.

The business recovery plan (PRA) consists in managing risks and quickly restarting all company activities in the event of a major disaster. To do this, it describes the necessary procedures and the actions to be put in place to restart and regain operation as before the disaster. It is a long-term response.

Why set up a PRA?

When a company is confronted with a disaster or an unexpected major crisis causing the slowdown or stopping of its activity, the consequences can follow one another and be more serious than the other: loss of visibility, decrease in sales, decrease in turnover, loss of turnover, loss of customers, suppliers and partners, loss of customers, suppliers and partners, loss of market shares, economic dismissal, bankruptcy.

According to companies, every minute that business is interrupted can cause a loss of revenue and endanger its sustainability. To avoid bankruptcy, business recovery is an absolute priority.

The drafting of the business recovery plan takes into account all the disaster scenarios that can cause a stoppage of the company's activities (a natural disaster, a cyber attack, a failure, an economic, financial or health crisis, etc.) and thus makes it possible to anticipate and mitigate their devastating effects.

The objectives of the PRA are as follows:

• minimize the impact of a crisis situation on the company;
• reduce the time the business is interrupted;
• raise awareness and train all employees;
• recover from this situation;
• ensure the return of the company to a normal level of operation as quickly as possible.

What does the PRA contain?

Be aware that there is no standard business recovery plan because the approaches and processes described must be in line with the specificities of the company and its sector of activity. However, to ensure its effectiveness, you have to think of everything: no gray area should remain to successfully deal with any type of situation.

The business recovery plan should include:

• the solutions to be put in place to ensure the rapid resumption of activities,
• the procedures to be followed,
• the people in charge of this recovery,
• the deadlines.

Thus, the PRA must contain:

• Risk analysis and their impact on the company : identify all the risks that the company may face, their impacts, their plausibility as well as the company's vulnerabilities.
• Past claims and their management : list the crises that the company has already gone through and analyze how they have been managed.
• Identifying critical activities : define the activities that are essential for the company, with priority given to activities that provide it with income.
• Identifying resources : determine which human resources (employees, but also service providers and suppliers), hardware and software are essential for carrying out critical activities.
• Business Continuity and Recovery Solutions : identify solutions that will allow the company to restart and ensure the continuity of critical activities, such as teleworking, the establishment of a fallback site or even the transfer of activity.

Conclusion

The PRA is an essential document for a company, regardless of its size and sector of activity. It allows it to face an urgent and unexpected situation through the implementation of measures aimed at a rapid resumption of activity.