How do you set up a business continuity plan?

No company, regardless of its size or field of activity, is safe from a crisis. To overcome a disaster, regardless of its nature (financial, economic, ecological, ecological, political, health, etc.), and continue to operate despite the unprecedented situation, a company must have an business continuity plan (or PCA).

This strategic document allows a company to deal with a major crisis situation, to identify risks in order to better manage them and thus to minimize their impact on its business. The PCA is essential to avoid bankruptcy and guarantee the survival of your business from any type of disaster or disaster, such as the Coronavirus (COVID-19) pandemic that we are currently going through.

Learn how to build your PCA by following these 9 steps.

1. Define context and goals

This step is essential to ensure the effectiveness of the PCA. You must define the context taking into account the external elements (the demands of shareholders and authorities, the political, social, cultural, legal, economic and financial environment, etc.) as well as the internal context (the corporate culture, the type of governance, the type of governance, the type of governance, the resource management policy, the organization, the processes, etc.).

This analysis is essential to assess the level of risk acceptable to the company.

You should also analyze the goals and obligations of the business in order to determine what are the essential activities that must be maintained at all costs to achieve these goals.

2. Identify continuity needs

What are the minimum resources (human, financial and material) that the company needs to be able to ensure the continuity of its activity? So, for each essential activity, you need to determine:

• The minimum level of service : how many products do you have to manufacture per day or how many services do you have to provide per day in order for the business to continue to operate?
• The minimum level of unavailability : how long can production be interrupted without it being harmful to the company?
• Essential resources : what resources are needed to maintain this minimum service?

During this stage, you must also identify the possible consequences of the interruption of the activity at the human, financial, environmental level, as well as on the image of the company, the morale of the employees or the criminal liability of the manager.

Finally, note that the company may go into degraded mode, i.e. try to provide the service considered essential, despite the lack of resources. It is then necessary to define the modalities.

3. Identify and manage priority risks

What is the risk of this or that disaster happening? If this disaster occurs, what will be the impacts on the business? What actions will have to be put in place to deal with it? This step therefore consists in identifying the risks that the company could face, in analyzing them, then in evaluating their impacts and finally in planning actions and measures to eliminate them or limit their effects.

For more efficiency, surround yourself with competent people such as those responsible for business lines and processes.

So you have objective criteria that allow you to make rational decisions (and not based on emotions such as fear) according to your priorities.

4. Formalize resources and procedures

In order for your business to resume its activities after the disaster, you must make sure to make up for the loss of resources (also called critical resources) by using other resources. What is the minimum level of resources that the company needs for business continuity?

There are 5 categories of critical resources:

• infrastructure (premises, transport, etc.);
• information systems (computer systems, servers, local area network, email, Internet access, etc.);
• human resources (available teams, reinforcements, qualifications, etc.);
• intellectual and intangible resources (internal data, strategic information, etc.);
• external services (water, energy, subcontractors, etc.) or critical products (rare raw materials).

Prepare for disaster recovery by identifying redundant resources, drawing on external resources, backing up your data, and planning the organization and procedures that will allow your business to function after a disaster.

5. Define the continuity strategy

It is important to estimate the cost of the continuity plan (using the elements identified above) so that business leaders can make an informed decision about whether and to what extent it makes sense to adopt the BCP.

6. Specify crisis management and communication procedures

Crisis management makes it possible to alert, to anticipate, to implement useful actions and to decide to activate certain devices in the business continuity plan.

Crisis management has three key functions:

• Monitoring that makes it possible to detect warning signs and thus prepare the people concerned.
• The alert of the crisis management team and the PCA managers who, in turn, are responsible for alerting the hierarchy and activating the crisis unit.
• Decision support and the recommendation of an optimal action plan in this uncertain context.

7. Write the continuity plan

Once you have completed all of the previous steps, you can start writing the business continuity plan. It should describe the approach followed, the strategy chosen and the means and procedures necessary for its implementation. Finally, it is necessary to identify those responsible for the PCA, their role and the actions for which they are responsible.

8. Ensuring the capacity to implement the plan

Now that the business continuity plan is ready, it is necessary to ensure that it can be triggered at any time, in particular by verifying the availability of the resources necessary to activate it as well as the knowledge and understanding of the various procedures.

9. Evaluate and develop the PCA

Finally, it is necessary to verify the effectiveness of the PCA, in particular by testing that the procedures and arrangements are well understood and can be put in place within the time indicated through exercises.

For more information, consult the Guide to creating a business continuity plan of the General Secretariat for Defence and National Security (SGDSN).