RESILIENCE

34 | QUALITY WORLD | SPRING 2021

RESILIENCE

How to write aneffective business
continuity plan
The Covid-19 pandemic has caused unprecedented
disruption to business globally and has highlighted
the importance of business continuity plans. Grant
Gray, PCQI, Management Systems Consultant at 2SB
Management Systems, UK, explains how to write
a business continuity plan that is rigorous and willfunction effectively when it needs to be executedM

any people in small- and medium-sized enterprises (SMEs) will know
the dread of being tasked to write a business continuity plan. Common
questions such as ‘Where do I start?’, ‘How should it be structured?’and ‘Why are we even writing a plan?’ enter the mind. The Covid-19
pandemic has, in one fell swoop, made the scenario very real – and a pandemic
probably wasn’t even included in the vast majority of business continuity plans.
The coronavirus pandemic has created significant disruption to organisations
and supply chains and highlighted how unprepared the world was for an event
like Covid-19. True, even the best-laid plans may have struggled to cope with theimpact, but in many ways, we were all blindsided. With the benefit of hindsight,
it seems inconceivable that in January 2020, an article in Forbes magazine
entitled ‘5 Trends Set To Disrupt Global Supply Chains In 2020’ doesn’t mention
coronavirus as a risk.
The pandemic has brought and will continue to bring business continuity into
the foreground and accelerate its growing prevalence.
In this article, I explain how to write an effective business continuity plan andreview some simple examples, consider some of the common pitfalls and makesuggestions as to tangible ways to improve the effectiveness of a plan.

QUALITY.ORG | 35

RESILIENCE

THE RISE OF BUSINESS CONTINUITY
AND ISO 22301

Although it is hard pinpoint the exact origins ofbusiness continuity management, its practices canbe dated back to at least the 1970s, when efforts wereneeded to safeguard the significant infrastructure
required to keep large data centres and computerscool. It became a more formalised discipline in the1980s, with a clearly defined mission to protect
the organisation.
There have been various iterations of businesscontinuity standards (PAS 56:2003, replaced by
BS 25999:2007, which was in turn replaced by ISO22301:2012), which have led to the latest version of
the international standard ISO 22301:2019 Security
and resilience – Business continuity management
systems – Requirements.
With the globalisation of supply chains and therapid adoption of cloud computing, the need forbusinesses to manage their own resilience, as well
as monitor the strength of their supply chains, has
never been greater. The latest data available fromthe International Standards Organization (ISO)shows that although there are still only a modest
number of ISO 22301 certificates worldwide, there isa significant annual increase.
ISO certification bodies are reporting
unprecedented demand for ISO 22301:2019 audits,
particularly since the start of the pandemic. Thereare other frameworks for implementing a business
continuity management system, but this article will
focus on ISO 22301.

BUSINESS CONTINUITYMANAGEMENT SYSTEM

The first important point to highlight is that abusiness continuity plan is an output of a detailed
investigatory process, rather than the starting point.
Therefore, it follows that the most comprehensive
business continuity plans are an output of abusiness continuity management system. What thismeans in practice is that there should be a culture
and structure woven into an organisation thatconsiders business continuity from senior leadership
downwards, and that is used to establish, implement,
operate, monitor, review, maintain and improvebusiness continuity.
Business continuity can be considered a wholediscipline in itself, but many SMEs do not have theresources to spend purely on this concern. However,there are a number of elements that should not
be missed.

SENIOR LEADERSHIP INVOLVEMENT

To have any chance of success, business continuity
planning must have senior leadership backing

36 | QUALITY WORLD | SPRING 2021

and involvement in its construction (Clause 5.1 –Leadership and commitment). They will be able tooffer essential business information that will affectrecovery in times of disaster, and provide the time,
resources and clout needed to embed its practiceand achieve widespread acceptance. Involving
management in the decisions also appeals to Clause 5of ISO 22301 and is a key driver for a strong business
continuity management system.

WELL-DEFINED ROLESAND RESPONSIBILITIESIn small organisations, it may be possible for twoor three people to own the planning, testing andexecution of business continuity arrangements.
However, in medium-sized and larger organisations,key people from mission-critical departments should
be involved. Roles and responsibilities need to bewritten and communicated, for example in the formof a RACI (responsible, accountable, consulted andinformed) matrix (Clause 5.3 – Roles, responsibilities
and authorities).

CONDUCT A BUSINESSIMPACT ANALYSISOne of the most important tasks for organisations toundertake is an analysis to determine their ‘prioritised
activities’ (Clause 8.2.2 – Business impact analysis).
Managers should assess which are the most vital
activities in the business – those that would causesignificant organisational issues if impacted by adisruptive event.
For each prioritised activity, consideration should
be given to the type of impact it would have(financial, reputational, legal, contractual etc),
the maximum tolerable period of disruption, therecovery time objective and, bearing in mind it may
not be possible to restore the process to full capacity
immediately, the minimum level of product orservice that is acceptable to the organisation inthe interim.

“The need for businesses
to manage their own
resilience, as well as
monitor the strength oftheir supply chains, has
never been greater”

RESILIENCEUNDERTAKE A RISK ASSESSMENT
With the critical processes in mind and input fromsenior management, a risk assessment should beconducted (Clause 8.2.3 – Risk assessment) todetermine all the potential threats to continuity. This
will follow the natural sequence of identifying risksof disruption, analysing the risks, evaluating the risks
and deciding what treatment is most appropriate.
Avoiding the risk (ie, by changing the parameters of
the activity), mitigating the risk (ie, by taking direct
action to reduce the likelihood or consequence),
sharing the risk (ie, through insurance) or accepting
the risk (if it is small or financially infeasible to takeaction) are the four main options upon which thebusiness must decide. Particular attention should be
paid to any single points of failure, which can include
key employees, software, hardware or a vital supplier.

DEFINE STRATEGIES
Based upon the business impact analysis and risk
assessment, the organisation will need to define thestrategies required to protect key activities. This isdefined in Clause 8.3 (Business continuity strategiesand solutions) and involves considering solutions
that will reduce the likelihood of disruption, shorten
the period of disruption and limit the impact on
products and services.
The business should consider the costs and benefitsof each proposed strategy and may find that some of
the most comprehensive strategies are not viable.

ESTABLISH AN INCIDENT RESPONSESTRUCTURE
Once the organisation knows what could beimpacted, how it could be impacted and have somestrategies for tackling a business continuity event,it needs to create a structure for responding toincidents if they do occur (Clause 8.4.2 –Response structure).
Competent teams should be able to assess thenature, extent and potential impact of the disruption,

decide whether it crosses predefined thresholds and,if so, activate the appropriate response.

WRITE YOUR BUSINESSCONTINUITY PLAN
Finally, write the business continuity plan. The planshould contain details of the activities required tocontinue or recover prioritised activities, monitor theimpact of the disruption against agreed thresholds
and prevent further loss of prioritised activities,
while meeting the requirements in Clause 8.4.4(Business continuity plans).
As plans are typically used in critical situations,they should be clear, concise and easy to follow.
Referencing other procedures, such as those for
emergency communication, is a good way tostreamline the business continuity plan.

OBTAIN SENIOR MANAGEMENTAPPROVAL OF THE PLAN
A common oversight when building a plan is theomission of strategic considerations that only senior
management may be aware of. Without this input,
the plan may leave out key aspects, such as financial,people and business growth information, which
would impact the success of the plan when it isimplemented. The Management review (Clause 9.3)
is one tool for achieving this.

TEST AND VALIDATE YOUR PLAN
Even the best-curated plans will have weaknesses,
and therefore it is critical to test them regularly andat planned intervals. Testing methods include botha discussion-based exercise, which is intended tofamiliarise and consult team members and supplierson plans, and an operations-based exercise, in which
a simulation is carried out to put the team throughtheir paces. Exercises should be reviewed, findings
documented, and improvements incorporated backinto the planning documents (Clause 8.5 – Exercise
programmes).

Figure 1

Number of Sites Certified Worldwide

Number of Certificates Worldwide
6000
5282

5000
4281
3853

4000
3133

iStock.com/Eternalcreative

3000
2000

1757

1000
02014

2015

2016

2017

2018

7000
6000
5000
4000
3000
2000
1000
06231
5282
4281
3853
3133
1757

2014

2015

2016

2017

2018

2019

ISO 22301 sites certified worldwide; Source: www.iso.org/the-iso-survey.html

QUALITY.ORG | 37

RESILIENCECONSIDER THE IMPACT OF
ORGANISATIONAL CHANGES

Organisations should not forget about change
management [see ‘Change Management: A StepBy-Step Guide’ on p12 of Quality World November/
December 2020 for how to introduce and managechange]. This requires a high level of disciplinefrom organisations to properly consider changes
before they are introduced and assess their impact
on business continuity. Plans should be updated
accordingly, and this highlights why senior leadership
involvement is critical. Those authorising changes
should also be questioning the business continuity
impacts (Clause 6.3 – Planning changes to thebusiness continuity management system).

BUSINESS CONTINUITY VERSUS
DISASTER RECOVERY

It is important to make the distinction between thesetwo plans as there is often confusion and they areoften used interchangeably. A business continuity
plan ensures that regular business will continue evenduring a disaster.
A disaster recovery plan is typically a subsectionof a business continuity plan and is primarily
concerned with the process of restoring vital
support systems, such as IT infrastructure,communications and hardware.

COMMON PITFALLS IN BUSINESSCONTINUITY PLANS

Recently, I had the opportunity to review twobusiness continuity plans for manufacturingbusinesses. By playing out different scenarios to see
how effective the plans would be if they had to beimplemented, it was not entirely surprising that there
were some areas that needed addressing. Below is asummary of what I discovered, and considerations
to give when creating a business continuity plan.
Writing an effective plan requires real thought andeffort, but it doesn’t need to be complicated.
Testing the plans
Although it can be highly beneficial to test yourplan by enacting the scenario (for example, by
asking all staff to work from home at short notice)
to highlight any issues, the reality is not every
scenario can be tested this way, particularly by small
businesses. Where it isn’t possible to enact partsof the plan, a detailed and interactive desktop test
should be conducted. If, for example, you have amutual business continuity agreement with anotherbusiness, call them to ask if they could realistically fit
your current workload onto their machines.
The plans of the manufacturing businesses I lookedat were based upon similar strategies and assumptions:• Implementing the plan in the event of a major

disruption was to be funded by the business.

38 | QUALITY WORLD | SPRING 2021

••

•

•
•

Insurance would cover the losses once theinsurance company investigations were complete.
Temporary cabins/offices for accommodating staff
could be easily acquired and there would only be afew days disruption to staff work.
Additional specialised units/spaces could beprocured and commissioned within a few days withminimal interruption to the operational process.
Work-in-progress standing on the floor,
usually two to four weeks’ worth, could easily
be replicated with a two-week delay with
notifications going to clients. Disruption wasexpected to be minimal.
There was an assumption that key staff would bearound after a disaster.
The temporary business continuity arrangements
could be in place within a week and the businesscould survive if it sorted itself out within
two months.

Results of testing
The tests pointed to the following findings:• Despite what was stated in the plans, when•••

•

•

•

•

pressed, the directors believed they could go outof business within two to four weeks if the plan
was ineffective. They had not been fully involved
during the initial writing of the plan.
There was a huge cash flow burden on thebusiness if insurance did not pay out quickly,
which could be terminal.
Although mutual business continuity
arrangements were in place with businesses withthe same production capabilities, the directors
said the reality was that these competitors wereunlikely to have sufficient capacity and hadquestionably lower quality standards. Being able
to redirect all the work on their books would
probably not be possible, and clients would
be likely to seek alternative manufacturers,
potentially for good.
Calls were placed to the suppliers of cabins andspecialist equipment. These suppliers reported
that it could take up to two weeks to deliverand commission.
Incomplete jobs standing on the floor could
overshoot deadlines by at least two weeks to amonth, missing the maximum six-week deadline.
This would place the business and its reputation
at risk.
There was, in fact, no space to house sufficientcabins for all office-based staff on the site andremote working would need to be initiated.
There was no prior experience or testing of
having a significant proportion of staff remote
working for any significant time.
Directors and managers were high-risk individuals
and loss of these parties without disseminatedknowledge could affect the business moving forward.

RESILIENCEKEY CONSIDERATIONS FOR YOUR PLAN
I have highlighted some of the key findings, but ingeneral the plans were not as accurate, employableand effective as had been thought. This should notreflect negatively on these organisations, as the issues
raised above are a common issue in most plans I see.
When writing an effective business plan, I suggest
you bear the following in mind.

• How aware are staff and management of the•• Are senior management involved in the processof creating a business continuity plan? They must
be! It is the senior management who know how
long the business can survive; what time frame
will start putting unbearable stress on finances;which processes must be prioritised; which
other companies could take some workload; thetolerance of customers for delayed delivery on
products and services.
• Do you have enough finances to recover in caseinsurance takes months to pay out?
• Will suppliers deliver essential items in fair timeframes, and are they easily housed and accessedby staff? Ensure you call suppliers to find out how
long it would take to deliver critical infrastructure.
• Is there space to accommodate staff at analternative location? If not, is the remote working
process easy to implement and manage? Manycompanies have found enabling remote working
has been more time-consuming than initiallyexpected. Speak to your IT company tounderstand this.

•••information and data security risks that could
be introduced while executing the business
continuity plan? Can information be transferredfrom the home environment to the company
servers securely? This is more of an issue forcompanies with local rather than cloud servers.
If your primary server is damaged orcompromised, how quickly can you access yourbackup? Will the backup be a precise snapshot at
the time the server fails, or will you have lost 24
hours or more of work? Do you need to adjust thebackup regime?
How often should the plan be tested to ensure
it is current and effective in a disaster? Decide
which elements of the plan are most critical. Runa theoretical test at a minimum, to decide whether
the controls are effective.
For many businesses, the introduction of remote
working during the Covid-19 pandemic has taken
a number of days or even weeks to get working
properly from an infrastructure point of viewalone. If companies had tested their remote
working ability by requesting all staff work fromhome for one day prior to the pandemic, would
they have been better positioned to know andaddress the challenges?
Think outside the box – very few people werepredicting this pandemic and the magnitudeof its impact. What other seemingly unrealistic
scenarios could you be overlooking?

CONCLUSION“Leaving things tochance is creating
the potential for abusiness to close,
placing everyone at
risk of job loss”

Business continuity plans are not just there to
survive a major disaster. Sometimes less-damaging
situations, such as the loss of a key member of staff,
could severely affect a business, but may seem aminor issue until they happen.
An effective plan will consider all options, involve
multiple parties from across the business and be wellcommunicated to staff. Leaving things to chance iscreating the potential for a business to close, placing
everyone at risk of job loss.
Effective planning produces effective results.

Further information
For a detailed understanding of the steps
involved in creating a business continuity plan,
the International Standards Organization’sISO 22301:2019 standard gives a framework
within which to build a business continuity
management system. This is available to buy
online at: iso.org/standard/75106.html

QUALITY.ORG | 39