Business Continuity Management Booklet
for Small and Medium-Sized Enterprises

Asian Disaster Reduction Center

Business Continuity Management Booklet
for Small and Medium-Sized Enterprises

Table of Contents
0. How to Use This Booklet ..................................................................................................................................... 3
1. Introduction ......................................................................................................................................................... 3
2. Warm Up .............................................................................................................................................................. 3
3. BCM Framework ................................................................................................................................................. 4
Step 1

Determine BCM purpose, scope, and team ........................................................................................... 5

4. Your Lifeline Businesses and the threatening Risks ......................................................................................... 6
Step 2

Prioritized Activities (PA) and Recovery Time Objectives (RTO) .......................................................... 7

Step 3What Do You Need to Resume Key Activities? ....................................................................................... 9

Step 4

Risk assessment – Know your disaster scenarios ................................................................................ 10

5. Your Survival Strategies .................................................................................................................................... 14
Step 5

Do not forget pre-disaster protection and mitigation .......................................................................... 15

Step 6Emergency response ............................................................................................................................ 17

Step 7

BC strategies for early resumption ...................................................................................................... 25

Step 8Be financially prepared ........................................................................................................................ 28

Step 9Exercises make your plan functional ................................................................................................... 31

6. PDCA: Continuous Improvement .................................................................................................................... 32
Step 10

Ongoing Review and Improvement .................................................................................................. 32

Appendix ................................................................................................................................................................ 35
1.Blank Forms ..................................................................................................................................................... 36
2.BCM Checklist ................................................................................................................................................. 592

0. How to Use This Booklet
This booklet is intended to help small and medium-sized enterprises (SME) introduce business continuity
management (BCM). It presents 10 easy steps that SME readers can follow to develop their own BCM. In each
step, forms have been prepared to assist readers. You should fill in those forms to suit the needs of your company.
When you finish all the forms, you will have a complete business continuity plan for your company.
There is one important point you should remember: introducing BCM is not a simple matter of drafting abusiness continuity plan on paper. Adopting BCM is a decision making by a business owner to protect theircompany from various disasters and accidents and to enhance their company’s ability to survive by carrying out
planned continuity strategies. Let’s proceed with this in mind.

1. Introduction
Every business owner wants to expand their business, protect their employees, and contribute to society bysupplying their products or services. You, as a business owner, have to protect your business not only on a fineday but also on a rainy day and even on a stormy day. You have to successfully compete in a tough market underordinary circumstances, but also need resilience if you are to successfully survive a crisis such as a natural disasteror a fire. You do not want to see your business destroyed by a disaster, accident, terrorist attack, or other incident.
Is your company prepared for disasters?
“Failing to prepare is preparing to fail” said Benjamin Franklin. If you have not prepared for such incidents,
you are (unconsciously) preparing for failure when a disaster or accident strikes. Business continuity management(BCM) is the solution for protecting your business during a crisis.

2. Warm Up
Consider the simple example of a traffic accident. Even if you always try to drive safely, there is no 100%
guarantee that you will be able to avoid a traffic accident. What is the disaster (or worst-case) scenario for a traffic
accident? One in which you, the driver, are killed or sustain a severe injury that causes permanent disability andkeeps you from returning to life as you knew it before.
What is the disaster scenario for your company in a disaster? Your company would be fatally wounded if
critical resources sustain devastating damage that would force you to give up on recovery (death scenario). Or
your company might sustain severe damage that would cause an extensive disruption in your business. As a result,
you might lose important customers and be forced to scale down your operations (permanent disability scenario).
These are the worst-case scenarios that your company should avoid at all costs.
But if you are lucky and only sustain minor injuries in a traffic accident, you will be able to recover in a shortperiod time and return to normal life. Likewise, the better scenario for your company is to keep damage contained
to a low level such that it would be able to resume operations at a normal or higher level of functionality in a short3

period of time. This is your survival scenario. BCM is all about your company’s ability to achieve its survival
scenario.
Here are some warm-up questions to get you started!
Q1: What is your company's disaster scenario that might lead to bankruptcy?
Q2: How soon does your company have to recover to survive from a disaster-related disruption?
Q3: What are the critical resources whose availability determines the life or death of your company?
Q4: Within 5 to 10 years, what kinds of disasters and accidents are most likely to impact you, potentiallytriggering a worst-case scenario?
Were you able to answer the above questions easily? If not, don't worry, this booklet is here to help you. But if
you were, you already have a mindset prepared for BCM. This booklet will guide you through 10 easy steps tobuild your company’s Business Continuity Management (BCM) program. These 10 steps are based on theInternational Standard ISO22301,for Business Continuity Management.
10 Steps for BCM

Step 1

Determine BCM purpose, scope, and team

Step 2

Prioritized Activities (PA) and Recovery Time Objectives (RTO)

Step 3What Do You Need to Resume Key Activities?

Step 4

Risk assessment – Know your disaster scenarios

Step 5

Do not forget pre-disaster protection and mitigation

Step 6Emergency response

Step 7

BC strategies for early resumption

Step 8Be financially prepared

Step 9Exercises make your plan functional

Step 10

Ongoing Review and Improvement

3. BCM Framework
When you start BCM planning, you need to create a solid foundation (or framework) for your company’s
BCM program by addressing these three elements:
1) Purpose: Why is your company introducing BCM?
2) Scope:

Which parts of your company will introduce BCM?

3) Leader:

Who will serve as leader of your BCM activities?

4

It is very important that not only top management show visible strong leadership, but also that all employees
are fully aware of the BCM framework (purpose, scope, and leader).

Step 1 Determine BCM purpose, scope, and team
(1) Purpose
You should make it clear why your company is going to introduce BCM. The purpose of BCM is to protect
your business operations from disasters and accidents. Having a clear purpose will be very important indetermining the priorities of your key products or services and selecting your business continuity strategies.
What is the purpose of your BCM? The first priority is to protect people, including employees and visitors toyour premises. The second is to protect your business, ensuring that you will be able to fulfill yourcontractual obligations to your customers and users, fulfill your social responsibilities, and contribute to yourlocal community and economy. It will help you secure employment for your employees and protect theirlivelihoods.
(2) Scope
Which parts of your company will introduce BCM? You can limit the scope to key departments. For example,
you can select a main factory that manufactures your top brand product or the number one shop that has thehighest sales. You can decide the BCM scope based on your business needs and specific circumstances, but
you should be sure to include the core departments that are critical to your company's survival.
(3) Leader
You need to appoint a BCM leader who takes the initiative in company-wide BCM activities. The BCM
leader should be given the authority necessary for carrying out his/her role. BCM consists of company-wide
activities that require active participation and cooperation from the relevant departments. You should
nominate a person who is widely trusted throughout the company. Support staff should be selected, if thecompany size requires, working under the BCM leader as the BCM Team. Management should ensure that
this team has the resources it needs to operate, including a budget that the BCM leader and team can use to
carry out their duties. The SME owner (top management) should demonstrate a visible commitment to BCM
activities and should know that verbal instructions alone are not enough to get successful results.

5Fill in Form 1 regarding your company’s BCM framework.
Form 1 BCM Framework
BCM Purpose

Protect People

Protect Business Activities

Recover with Local Community

BCM Scope

Departments

to introduce BCM

BCM Leader and TeamBCM Leader

BCM Team Members

4. Your Lifeline Businesses and the threatening Risks
The purpose of BCM is to protect your company and business operations even when a disaster or accident
occurs and disrupts operations. First, you will focus only on your company’s operations. Of your various businessactivities, which are your company’s lifeline (or critical) businesses? Which business activities should be given
top priority for recovery if disrupted by a disaster? What resources are necessary to keep those lifeline businesses
operating? Without those resources, the company’s top priority activities will not be able to be resumed. Second,consider the risks to your company. What kinds of risks, such as natural disasters or accidents, are most likely toseriously damage the company’s assets, businesses, and supporting resources? In this chapter, you will gain arenewed understanding of your company’s operations by looking at these two elements: lifeline (critical) businessactivities and the risks that threaten them.

6Step 2 Prioritized Activities (PA) and Recovery Time Objectives (RTO)
In Step 2, you will think about your company’s lifeline products or services. Which product or service should
be recovered with the highest priority when a natural disaster (or accident) disrupts operations? Which businessactivity yields your top-selling product? Which shop in your company has the highest sales? These criticallyimportant business activities are called Prioritized Activities, and you have to identify which activities constitutePrioritized Activities for your company. Second, you have to think about how soon such Prioritized Activities
have to be resumed if they are disrupted. Needless to say, those critical operations have to be resumed, at the latest,
before the company goes bankrupt. Coming up with these answers is the task of Step 2.
The importance of this simple analysis is to focus only on the impacts of disruption, setting aside risk factors.
By disregarding risk factors, such as occurrence probability and severity of damage, during the process ofanalyzing your business and identifying Prioritized Activities, you will gain a clearer understanding of how soon
your company has to resume operations to avoid bankruptcy.
Start by assessing the impacts of your company’s main business activities when those are disrupted by a natural
disaster or accident. Enter your company’s business activities (product/service lines) in the left column of Form
2-1. You will compare the importance of the activities listed. The level of importance of each business activity(product/service line) should be rated using two criteria: external and internal impacts. First rate the external
impacts, those which might affect customers, users, and society at large. How seriously might your customers,
users, the environment, or society at large be impacted if your product or service were to stop being delivered?
How long will your customers willingly wait for you to resume operations? How soon might your key customers
switch to another provider? If you deliver certain types of products, such as medical supplies, the disruption ofsuch deliveries could threaten the lives of end users. Rate the degree of the external impact as large (L), medium(M) or small (S), using your subjective judgment to determine the relative differences between those three levels.
Internal impacts should be reviewed based on various criteria such as financial status (e.g., cash flow),
operational problems, and the reputation of the company. When the production line of product A is shut down,
how serious of an impact will it have, over time, on the company’s revenue? If your top brand service issuspended, what level of impact might it have on the company's cash flow? Rate the degree of the internal impact
as large (L), medium (M) or small (S).
Next, you should know the timeline of the impact of a total disruption. How soon would a total disruption in
those activities become unacceptable to your company? This period is called the Maximum Tolerable Period ofDisruption, or MTPD. This is the very latest time at which your company would have to resume the listed
activities before reaching a worst-case scenario that would end in bankruptcy.
Enter the listed activities in Form 2-2 (left column). Consider the MTPD for each activity listed and select oneof the five columns showing periods of time (3 days, 1 week, 2 weeks, 1 month, 2 months or more). Determine theperiod by which each listed activity has to be resumed. For example, if the first activity’s MTPD is one month,place a checkmark (➜) in the "1 month" column. If you have to restore delivery to a key customer within 2 weeks,7write "2 weeks" in the rightmost column entitled Recovery Time Objective (RTO). Repeat this process for all
listed activities.
Now that you have analyzed and evaluated the internal and external impacts and identified the Recovery Time
Objectives of the main activities of your company, you will select and identify your company’s Prioritized
Activities and set Recovery Time Objectives (RTO) from a company-wide perspective in Form 2-3. Your
company may select one or more PA(s) depending on your business operations.
Form 2-1 Impact Level Comparison Chart
Departments Handling Each Product/Service

Impact Levels
External Impact

Internal Impact

Product / Service A

L:M:S

L:M:S

Product / Service B

L:M:S

L:M:S

Product / Service C

L:M:S

L:M:S

Product / Service D

L:M:S

L:M:S

Product / Service E

L:M:S

L:M:S

Form 2-2 Maximum Tolerable Period of Disruption
Departments HandlingTime When Impact Becomes Unacceptable

Recovery Time

Each Product/Service

MTPD

Objective (RTO)

Product / Service A

3 ds

1 wk

2 wks

1 mo

2 mos.

Product / Service B

3 ds

1 wk

2 wks

1 mo

2 mos.

Product / Service C

3 ds

1 wk

2 wks

1 mo

2 mos.

3 ds

1 wk

2 wks

1 mo

2 mos.

3 ds

1 wk

2 wks

1 mo

2 mos.

Form 2-3 Prioritized Activities and RTOs

Prioritized Activity(ies)

Recovery Time
Objective(s)
(RTO)

8

Step 3 What Do You Need to Resume Key Activities?
Prioritized Activities (PAs) are supported by various internal and external resources. When disrupted PAs aregoing be resumed, those supporting resources must be available and ready. In Step 3, you will identify thosenecessary resources and list them in Form 3-1. In the subsequent steps, you will review risks to those listed
resources and their vulnerabilities. You will consider what measures must be taken to protect and secure theavailability of these resources, or identify the measures that must be taken to prepare alternate options. This list
provides important information for your BCM planning.
List the necessary resources in Form 3-1, dividing them into three categories: (1) internal resources, (2)essential services, and (3) business partners. Internal resources are resources that are usually under yourcompany’s control, such as buildings, equipment, machinery, tools, inventory, materials, IT systems, documents,
and drawings. Human resources should be reviewed from the perspective of the employees’ special skills andexpertise, as well.
Essential services include electricity, gas, fuel, water, and sewage. Communication networks (phone andInternet) and transportation networks (roads, railroads, and ports) are also included. These resources are provided
by public entities. They are not usually under your control. Ordinary companies cannot afford to arrange alternate
sources for these essential services due to the prohibitively high costs of doing so. Their availability would,
therefore, become a basic condition for the resumption of PAs.
In the business partners section, include partners in both your upstream and downstream business chains. They
are not only your suppliers, but also your customers. Your direct partners and indirect partners should be included.
In two catastrophic natural disasters that occurred in 2011, the Great East Japan Earthquake and the Thailand
Floods, many companies were seriously affected by disruptions to their supply chains even though they
themselves were not directly affected.
Form 3-1 Necessary Resources for Prioritized Activities
Necessary Resources for Prioritized Activities
Type of Resources

Contents

Building
Equipment / Machinery
Internal
Resources

Inventory
PeopleIT System
Fund(OtherEssential
SocialServices)

Electricity
Gas
Water
Phone / Communication9

Traffic / Roads(Other)Direct supplierSupplies

2nd, 3rd Supplier
Customer(Other)(Note: The processes of identifying Prioritized Activities, setting Recovery Time Objectives, and listing necessary
resources constitute a Business Impact Analysis (BIA). This term is commonly used in BCM.)

Step 4 Risk assessment – Know your disaster scenarios
In Step 4, you will clearly identify risks that may seriously threaten your company (or lead to a worst-case)scenario. You will identify the types of risks your company faces, and will analyze and evaluate those risks,
identifying the high-priority risks against which your company needs to take action. You will also analyze andestimate the extent to which your critical resources might be damaged by such risks, and how long it would taketo restore those damaged resources. You will compare the estimated restoration periods with your company’s
Recovery Time Objectives (RTO) set in Step 2, and determine which resources will require that measures be taken
if a worst-case scenario is to be avoided.
Form 4-1 assists in the process of identifying, evaluating, and prioritizing risks. First, enter the risks yourcompany is exposed to in the leftmost column. These are risks which could potentially cause a disruption in yourbusiness operations or could lead to a worst-case scenario (bankruptcy). For example, risks to your company
might include natural disasters such as earthquakes, floods, and typhoons, or industrial disasters such as fire,
explosion, blackout, leakage of chemical substances or intentional acts such as terrorist attacks, sabotage. The pasthistory of such natural disasters, hazard maps, and risk information for your local area may be published by local
governments and public organizations. If available, these can be very useful resources in conducting the risk
assessment in this step.
Next, evaluate the “Impact” and “Likelihood” of each risk, marking each as either H (high), M (medium), or L(low) in the columns indicated. The criteria for rating these items are shown in Table 4-1.
Table 4-1 Risk - Likelihood/Impact Scoring Scale
Rank

Likelihood

ImpactDisastrous, Severe damage

High

LikelyThreatening the company
Death, multiple injuries

MiddleMedium level damage

Moderate likely

Affecting operations,10Multiple injuries
Low

Insignificant damage

Unlikely

Minor injuries

After you have entered L ,M or S in both the “Impact” and “Likelihood” columns of Form 4-1, assign them anorder of priority in which measures need to be taken. Indicate the priority number in the rightmost “Priority”
column.
Form 4-1 Risk Impact and Likelihood Comparison Chart (sample)
Risk

ImpactLikelihood

Priority

Earthquake

HML

HML

1

Flood

HML

HML

2

HML

HML

HML

HML

Next, select a top priority risk (e.g., earthquake) and estimate the level of damage and length of time needed
for the restoration of resources should they be damaged as the result of an incident or a disaster. The estimatedrestoration period should be compared against your company’s Recovery Time Objectives (RTO), which wasestablished in Form 2-3. Determine the resources for which measures need to be taken.
Proceed through the following eight steps and enter the appropriate data in the columns indicated (by arrows)
in Form 4-2. Separate forms should be completed for each selected risk because the expected damage could vary
widely by risk.
1) Enter the critical resources that were identified in Step 32) Enter the prioritized risk
3) Enter an outline of estimated damages to your facilities
4) Enter estimated levels of damage
5) Enter estimated periods for repair, restoration, or recovery
6) Mark the graph bars to correspond to the length indicated in item (5) above7) Draw your RTO line (see your Form2-3)8) Determine whether measures need to be taken for each listed resource to achieve RTO and place amark in the column indicated
The resources for which measures may need to be taken may include both those whose restoration period
exceeds your RTO and those that do not. If essential services such as electricity, water, and phone service takelonger to get back online than your RTO, you may need to reconsider your RTO in consideration of the wait-time11needed for the restoration of those resources.

12Form 4-2 Resource Damage Estimate Sheet (sample)

2)

Risk

Earthquake

Assumed damage○○○

Necessary resources

DamageBuilding

3)

Assumed recovery period
Day (shown by graph)
Day

days

○○○

Equipment/

Machinery

○○○

3 ds

Resources

People○○○

3 ds

IT System

○○○

10 ds

Fund

○○○

Social Services

2 mos

3 mos

needed○○○Electricity

○○○

3 ds

Gas

○○○

30 ds

○

Water

○○○

15 ds

○

○○○

10 ds

○○○

8 ds

Direct supplier

○○○

30 ds

○

2nd, 3rd Supplier

○○○

20 ds

○

Customer

○○○

10 ds

○

Phone

/

Communication(Other(Other

1)

1 mo

)

Traffic / Roads

Supplies

2 wks

30 ds

○○○

Inventory

Essential

1 wk

7 ds

Internal(Other3

Measures

)

)

4)

13

5)

6)

7)

8)

The details regarding measures to be taken will be reviewed in Steps 5 to 7 below.
Examples of such measures are as follows:
1) Protection (Prevention) and Mitigation- see Step 5- Anti-earthquake reinforcements to buildings- Installation of equipment restraints
2) Emergency Response (Incident Response)- see Step 6- Evacuation plan formulation- Development of safety confirmation procedures
3) Strategies for the Early Resumption of Prioritized Activities - see Step 7- Alternate site recovery- IT system back ups
The required measures differ depending on the type of disaster experienced since damage estimates can vary
widely. This booklet guides you through a process in which you select one risk and then proceed to estimate thedamage that would be sustained as a result. For SME owners, it might be difficult at first to prepare for multiple
risks. We suggest starting with your top priority risk first, and then repeat the process for other risks if yourcompany can afford to do so.

5. Your Survival Strategies
In this section, you are going to work on the core items of your company’s BCM. You will plan and implement
your company’s Business Continuity (BC) Strategies to achieve the Recovery Time Objectives (RTO) you set in
Step 2 (Form 2-3). There are three phases to a BC Strategy, all of which are important and necessary forachieving your RTOs. You will identify the necessary measures for your company in consideration of these threephases(1) Protection and mitigation (Step 5)This phase involves the protection (prevention) or mitigation of the damage caused by an incident so that
Prioritized Activities can be resumed quickly in accordance with their RTOs. Protection and mitigation
measures primarily consist of pre-incident measures, but can also include important post-incident measuresintended to contain and minimize damage.
(2) Emergency response (Step 6)
When a disruption affects your company, you have to stabilize the situation by eliminating danger andprotecting your people, assets, and business operations. This should be done immediately to prevent an
emergency situation from becoming an uncontrollable crisis. The first priority of emergency response is toprotect and rescue people. Subsequent priorities are to eliminate threats and secure safety, protect assets, andprevent further damage and secondary disasters.

14

(3) Continuity and recovery strategies (Step 7)
This phase involves planning and implementing strategies for continuing (or resuming) Prioritized
Activities and then restoring normal operations. Continuity strategies focus on restarting Prioritized
Activities immediately using alternative or temporary measures. Recovery strategies focus on restoring
operations to pre-incident levels.

Figure 5-1 Three phases of a Business Continuity Strategy

Step 5 Do not forget pre-disaster protection and mitigation
To successfully resume operations as planned, the damage to supporting resources should be contained to an
extent that makes early repair and restoration possible. If such important resources are severely damaged, yourcompany may fall into a worst-case scenario, forcing you to either give up on recovery or shut down for a long
period of time. This would be the end of the story! This is why pre-incident strategies for protection andmitigation are so important.
In Step 4 (Form 4-2) you identified which resources require that measures be taken to achieve yourcompany’s Recovery Time Objectives (RTO). Those identified resources are vulnerable and might hinder theachievement of your RTO. In this step, you will select resources that require protection and mitigation measuresand determine the details of those measures in order to avoid a level of damage that would make it impossible torecover your Prioritized Activities by the established RTOs.
In Form 5-1, enter (1) resources that require measures be taken, (2) objectives of those measures, (3) what
measures to take, (4) specific plans for taking those measures, (5) implementation deadlines, and (6) the
department in charge of implementation.

15

Form 5-1 Protection and Mitigation Measures for Key Resources (sample)
Implementation Deadlines
Resources

Objectives

Personnel

Keep personnel
safe

Buildings

Protect/mitigate
damage tobuildings

Facilities
Systems

Protect/mitigate
damage tofacilities
Protect/mitigate
damage tobuildings

What To Do

Provide instructions on
evacuation safety
Checkearthquake-resistance ofbuildings
Make buildings
earthquake-resistantInstall restraints toprevent equipment fromfalling over
Install restraints toprevent computers fromfalling overYour Plan

Immedi

Withinately

1 yearMid toDepartment inLong

ChargeTerm- Make an evacuation plan and disseminate
it to employees- Conduct evacuation drills○

General affairs
dept.

Check earthquake-resistance of the buildingin which the headquarters is located○General affairs
dept.

Make the headquarters building
earthquake-resistant○General affairs
dept.

Fix machine tools to the factory floor○

Manufacturing
dept.

Put servers at headquarters in a server rack○

Information
systems dept.

16

Step 6 Emergency response
In Step 6, you will consider the immediate response measures that need to be taken when an incident occurs inorder to prevent an emergency situation from becoming an uncontrollable crisis. This is called emergency
response or incident response. The first priority of emergency response is to protect and rescue people.
Subsequent priorities are to eliminate threats and secure safety, protect assets, and prevent further damage andsecondary disasters.
First, you should have a general understanding of the emergency response scenario. As shown in Figure 6-1,
there are several activities that need to be undertaken during emergency response, and these must be carried out
promptly, following the timeline shown. Evacuation and rescue activities should be undertaken immediately by
individuals who are in the area. The Emergency Operation Center (EOC) should be mobilized, if necessary, sothat coordinated measures can be taken under the unified command of your company. Activities (3) to (8) are
performed by the Emergency Operation Center, if one is set up.
The main activities to be performed are (1) evacuation and rescue, (2) setting up an Emergency Operation
Center, (3) confirmation of employee safety, (4) stabilization of the situation and prevention of secondary damage,(5) survey of damage, (6) asset protection, (7) confirmation of safe commuting conditions, and (8) compilationand sharing of incident/damage information.
These eight activities are described in further detail below.

Figure 6-1 Emergency Response Activities

17(1) Evacuation and rescue
First, your company should have a general evacuation plan, which includes evacuation procedures, evacuationsites, evacuee guidance procedures, and names of evacuation activity leaders. You will use Form 6-1 to create
your company’s evacuation plan. You need to make sure all employees understand the evacuation plan and areable to safely evacuate as planned. Many companies give all employees a small emergency card containing such
key information as what actions to take, where to evacuate, and emergency contacts. Employees are asked to carrythe card with them at all times so that they can refer to it whenever necessary. Such an emergency card is highly
recommended.
Form 6-1 Evacuation and Rescue Plan (sample)
Office/Factory

Head officeEvacuation site

Parking lot in front of the head office building(meeting place)
Leader

Person in charge: Manager of the general affairs department
Assistant: Deputy manager of general affairs department

Person in charge of rescue

Person in charge: Manager of general affairs department

and medical care

Assistant: Deputy manager of the general affairs department

Hospital(name, address, telephone number)
Name: ○○hospital
Address: ○○○Tel: **-****-****

In case of a natural disaster such as an earthquake or flood, the infrastructure (such as the traffic network) may
be damaged. Your employees may not be able to get home and may have to stay on the company’s premises or at
an emergency shelter. Your company needs to prepare food, water, and other supplies (e.g., blankets, radios) for
employees, and it is recommended to store enough necessary supplies (e.g., food and water) to shelter them for 3
days (see Appendix 6-1).
(2) Setting up an Emergency Operation Center
When an incident occurs that could affect your business, the company has to respond immediately to protect
its people and operations. It is critical not to succumb to panic or chaos, but to behave calmly and make the best
decisions possible while taking the necessary measures under the circumstances. In order for the company to carryout those activities in a unified and coordinated manner, you should establish an Emergency Operation Center(EOC) that can serve as a central command center.
The EOC’s framework, members, duties, and procedures must be decided on in advance and put down on paper.
Form 6-2 will assist you in creating an EOC framework for your company.

18a) EOC Leader
The leader is in charge of the overall activities of the EOC. The deputies must also be identified who will takeover for the leader when he/she is absent. The order of succession for the authority and responsibilities of theleader should also be decided.
b) EOC members and roles
The members of the EOC should be appointed and a list of their names created and periodically updated. EOC
members are required to convene at the EOC whenever the EOC is mobilized. EOC members must be selectedfrom among those employees who would be able to convene on short notice. Form 6-2 lists the four functions
shown below. If the size of the company requires, a team can be formed to carry out each function. You should
decide on your company’s EOC framework and the functions that best suit your company's needs.
1. Analysis and planning
2. Information gathering
3. Site operations- Stabilization- Rescue and medical care
- Confirmation of employee safety- Sanitation- Logistics
4. Public relations
This function is for keeping internal and external stakeholders informed about the status of the company.
c) EOC mobilization criteria
When should an EOC be mobilized? You must decide the thresholds that must be met for the EOC to be
mobilized and its members called to duty. You can establish these criteria by incident type and magnitude, suchas “an earthquake measuring 6 on the Richter scale” or "a flood warning is issued.”d) EOC locations
The location where EOC members are to convene must be decided in advance. You should prepare for asituation in which your first choice location (e.g., the head office building) is unusable by selecting alternate
EOC locations as well. EOC centers (including alternate sites) should be prepared for mobilization at any time,
and thus equipped with communication equipment, IT and office equipment, and other supporting resources.

19

Form 6-2 Emergency Operation Center (sample)
MembersRoles

department nameTel

Leaders

CEO**-****-****(including deputies)

Director ○○○○**-****-****

Director ○○○○**-****-****

Analysis and planning○○dept.

○○○○**-****-****

Information function○○dept.

○○○○**-****-****

Site operation function○○dept.

○○○○**-****-****(stabilization, rescue and○○dept.

○○○○**-****-****

medical care, confirmation○○dept.

○○○○**-****-****

of employee safety,○○dept.

○○○○**-****-****

sanitation, logistics)○○dept.

○○○○**-****-****

Public relations○○dept.

○○○○**-****-****○○○○

Mobilization- Earthquake measuring 6 on the Richter scale

thresholds- Flood warning is issued

Meeting

Order ofplace

priority(including

Workplace

Address

Tel

1

Head office○○○○**-****-****

alternate2

A office○○○○**-****-****

locations)3

B factory○○○○**-****-****(3) Confirmation of employee safety
You must establish procedures for confirming the safety of your employees in advance. You will have to makesure that all employees promptly follow the established procedures in the event of a disaster. Your company
should test its procedures by conducting drills, as these show how well employees follow the establishedinstructions and how long it takes to complete a confirmation of the safety of all employees. Your safety
confirmation procedures should include a way for employees to contact the company. Multiple means ofcommunication should be identified (e.g., phone calls, e-mail, and Internet bulletin board) so that redundancies arebuilt in. Remember the lesson learned from the catastrophic Great East Japan Earthquake of March 2011 (M9.0),
after which the mobile phone network was non-operational across a wide area due to extensive damage andcongestion. Since such risks are inherent when relying on a single mode of communication that utilizes the mobile
phone network, backup methods must be identified.
Form 6-3 is an employee contact list with columns for each employee's department, name, telephone number,and e-mail address. This form can also be used as a checklist when confirming employee safety.

20

Form 6-3 Emergency Contact list (sample)
Safety status
Department

Name

Telephone number

E-mail address(to be entered in an
emergency)○○dept.

○○○○**-****-********@***.***.***○○dept.

○○○○**-****-********@***.***.***○○dept.

○○○○**-****-********@***.***.***(4) Confirmation of safe commuting conditions
When a disaster affects a widespread area across an entire region, the social infrastructure may be damaged.
Your company has to decide whether it is safe to let employees go home or whether they will need to stay on thepremises. You can do this by monitoring disaster and traffic information.
(5) Stabilization of the situation and prevention of secondary damage
When an incident occurs and creates a dangerous situation, you must work on stabilizing the situation toensure employee safety and prevent secondary damage. This may include efforts to fight fires or prevent the
spread of harmful substances.
(6) Survey of damage
Once the situation has been stabilized and safety has been secured, the damage to your company should be
immediately surveyed. Your company will have to decide on any necessary repair and recovery plans, and must
start on its recovery process as soon as possible. A sample survey form is shown in Appendix 6-2.
(7) Asset protection
Based on the damage survey results, you must protect and preserve your facilities and equipment. For example,
you will want to take measures to prevent the damage from spreading and to secure your assets against theft.
(8) Compilation and sharing of information
When a disaster hits your region, it is critical that you gather the following information using various media,
including television, radio, and the Internet:-

Disaster details-

Damage to the region (including the status of essential services and traffic conditions)-

Alerts and warnings from central/local government authorities

Your company should maintain communication with stakeholders such as suppliers, customers, publicagencies, and financial institutions by gathering and sharing relevant disaster information. It is important to give
your business partners status updates and information on your recovery plans so as to maintain your business
relationships while you are engaged in recovery efforts. Form 6-4 is a sample External Contact List.

21

Form 6-4 External Contact List (sample)
StatusExternal Partners

Name

Tel.

E-mail address(complete when an
incident occurs)

Materials & Parts○○○○**-****-********@***.***.***

Suppliers○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***

Logistics Service○○○○**-****-********@***.***.***

Providers○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***

Equipment○○○○**-****-********@***.***.***

Maintenance Co.

○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***

Financial○○○○**-****-********@***.***.***

Institutions○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***

Public Agencies,○○○○**-****-********@***.***.***

Local Government○○○○**-****-********@***.***.***

Offices○○○○**-****-********@***.***.***

Essential Service○○○○**-****-********@***.***.***

Providers○○○○**-****-********@***.***.***○○○○**-****-********@***.***.***

Customers

22

Appendix 6-1 Storage List for Disasters
Categories
Food / Water
Living supplies

Items

Numbers of items to prepare

Drinking water

3 liters/person for 3 days

Emergency food

3 day supply/person

Sanitation supplies (tissues, wet tissues, toilet

3 dayspaper, etc.)

Medical supplies
Tools

Utensils

Necessary numbers for people

Portable toilets

3 daysPlastic bags, tape

Equal to the number of people

Blankets, sleeping bags

Equal to the number of people

Portable gas and stoves

3 daysPots and kettles

3 eachPocket warmers

3 day supply/person

Oil heaters, oil

Fuel for 3 days

First aid kits

Equal to the number of people

Folding stretcher

3

Tools (crow bar, pliers, hammer, shovel, cloth tape,

3 eachstepladder)
Helmet and gloves

Equal to the number of people

Plastic sheets, tarps

3 sheets (10m×10m)

Garbage cans, buckets

3 eachSupport for getting

Rainwear

Equal to the number of people

people home

Maps

Equal to the number of people

Information

Radios, dry batteries

3 eachgathering,

Cell phone chargers

3 units per each model

communication

Loudspeakers

3 units

Other

Generators, generator fuel2 units of fuel for 3 days

23

Appendix 6-2 Damage Survey Form
Surveyed location
Employee injuries

Injured employees

Names:

Damage to buildings

Appearance

Large ㋪ Medium ㋪ Small ㋪ None

InsideLarge ㋪ Medium ㋪ Small ㋪ None

Safe entry
Damage to assets

Yes ㋪ No

Equipment(Damaged equipment / number of items)

Communication(Damaged equipment / number of items)

equipment
IT apparatus(Damaged equipment / number of items)

Fixtures and fittings(Damaged items / number of items)

Vehicles(Damaged vehicles / number of items)

Damage to essential

Electricity

Available ㋪ Not Available

services

Gas

Available ㋪ Not Available

Water

Available ㋪ Not Available

Landline

phone

Available ㋪ Not Available

Mobile phone service

Available ㋪ Not Available

Internet

Available ㋪ Not Available

Fire

Available ㋪ Not Available

service

Neighboring situations

Other
Business continuity
Visitors

Disrupted ㋪ Not Disrupted(Injured people)

Others24

Step 7 BC strategies for early resumption
In Step 7, you will create your company’s Business Continuity (BC) Strategies for the resumption ofPrioritized Activities (PAs) within the Recovery Time Objectives (RTOs). To do this, you must identify andprepare the internal and external supporting resources that are necessary for the resumption of those activities.
There are three key concepts to consider in planning your BC Strategies for the resumption of your Prioritized
Activities (PAs). You are going to take these concepts into consideration in developing your own BC Strategies forachieving the RTOs of your PAs.
Concept 1: Resume PA at the damaged/affected site.
Concept 2: Resume PA at an alternate site (either in-house or external facility)
Concept 3: Resume PA by alternate methods (or workaround methods)
Your BC Strategies might contain a combination of the above three concepts.
In the very early stages of your recovery planning, you have to decide where your company will restart its
critical operations (or PAs). One option is to resume operations at a damaged or affected site; another is to resume
at an alternate site. You should have plans for both options. Your company should be prepared for a scenario in
which your main facilities, such as your headquarters or main factory, becomes unusable. For an SME that has
limited resources, it might be difficult to prepare an alternate site. An SME may only have the option of preparing
a BC Strategy for restarting operations at an affected site. Still, you should remember in this case that yourcompany will be defenseless if your key facility is damaged to the point of being unusable. Over the mid to longterm, you should consider ways to address this risk. This requires more than mere paperwork. The business owner(top management) has to make a business decision about how and where to recover prioritized activities in theevent of a disruption.
Form 7-1 summarizes the BC Strategies for your company, and should be completed based on the concepts
listed above. Enter your selected BC Strategy into the appropriate column of the form.
Concept 1: Let’s start with a BC Strategy for resuming operations at a damaged/affected site. You have to startby restoring damaged resources. The buildings and equipment/machinery may be damaged such that assistance byan outside expert from a construction company or machinery manufacturer may be necessary. Essential services
such as electricity, gas, and water are necessary for resuming disrupted operations. The recovery of such essential
services to your company may become an essential condition of business resumption. You should therefore
estimate how soon those public utilities will be able to resume services and review/adapt your BC Strategy
accordingly.
Concept 2: The next option is to resume operations at an alternate site. The alternate site should be far enoughaway to be undamaged by the same disaster. You should make sure that the essential services your company needs
would be unaffected and available at this site. This option requires that all necessary resources, such as buildings,
equipment, and machinery be available at this site. You also need to consider how to transport your workforce, as

25

well as your materials and parts, to this location, and you will need cooperation from external partners to make allof this happen.
Concept 3: This concept focuses on resuming PAs using alternate methods. This option can be combined withboth concepts 1 and 2 above. For example, older spare equipment can be used to replace damaged newer
equipment. Manual labor can replace the use of a disrupted IT system. Your company must select the alternate
methods best suited to your operations. You need also identify what kind of assistance might be needed fromexternal partners.
Form 7-1 Continuity Strategy Summary
Continuity Strategy Summary
Priority

Strategy Outline

Activities toResumeKey Resources

Necessary(bottleneck

External

resources)

Partners

Strategy 1: Resume at the damaged/affected site(ex.)
Restore damaged buildings andequipment and resume PA
Strategy 2: Resume at an alternate site(ex.)
Start up an alternate factory/ office /
shop
(ex)
Activate back-up IT center
Strategy 3: Resume using alternate methods(ex)Start up using older methods, using
spare (old) equipment
Strategy: Other

Now that you have decided on your company’s BC Strategy using Form 7-1, you need to identify the resources
necessary for executing this strategy. Complete Form 7-2 to identify the necessary resources for each BC Strategy
listed in Form 7-1. You will prepare Form 7-2 for each BC Strategy. At the top of Form 7-2, enter the Prioritized
Activity and strategy outline you are going to consider. There are columns of resources categorized into three26

groups: internal resources, essential social services, and external partners (same as Form 3-1).
Form 7-2 BC Strategy Planning sheet
Prioritized Activity

Strategy Outline
To be done byCategories

Resources

What’s to be

Details ofdone / needed

Measures

when
Mid-!
Short

Long

Term

Term

Department inchargeBuilding
EquipmentInternal
Resources/

Machinery
Stock
PeopleIT System(others )Electricity/Gas/Water

Essential

Phone/

SocialCommunication

Services

Traffic / Roads(others )Suppliers

Outside!

CustomerPartners(others )Next, enter the necessary measures in the relevant column for each resource. In this process, you should checkyour review results in Form 4-2, the Resource Damage Estimate Sheet (see column 8 where you identified which
resources are needed for achieving the RTO). For the resources identified, decide what measures should be takenfrom the perspective of preventing and/or minimizing damage and expediting restoration.
The resources that are critical in determining the restoration period required (or bottleneck resources) should27be carefully reviewed. Particular attention should be paid to finding out how soon those resources that are notunder your control will be become available to you. You may need to flexibly revise your RTO and BC Strategy
based on that review. Enter the deadline for implementing each measure, indicating whether it must be
implemented in the short term (within 1 year) or the mid to long term (2 to 3 years or more). Also enter the
departments in charge of those measures. Once Form 7-2 has been completed with the designated departments
and deadlines, you can use the form for managing progress on the implementation of measures. As stated above,
this process takes more than mere paperwork; it requires management decisions to be made by the business owner(or top management) in cooperation with their BCM Team. It is very important that top management exercise its
leadership in implementing BC Strategies.
Your outside business partners have a significant impact on your business operations and BC Strategies. Since
you cannot control your business partners, what role do they play in your BC Strategies? It depends on yourbusiness relationship you have with them, but you can start by checking into their preparedness levels by asking
about their disaster management and BCM programs. Are they aware of such matters or uninterested? If they areinterested, both parties would be well served by sharing what they are doing in terms of their disaster management
and BCM activities. Ideally, you and your partners would hold regular meetings on this topic and plan joint
meetings or exercises.

Step 8 Be financially prepared
Can you survive financially if your operations are
disrupted for one to two months? The objective of
Step 8 is to recognize what the financial status ofyour company would be in case of businessdisruption and to take appropriate measures inadvance to avoid bankruptcy even during a period ofsuspended income. If your company’s operations are
disrupted, you will be losing revenue while still
having to pay expenses like payroll and rent. And if
your facilities are damaged, you will need to pay the
repair and restoration costs. In Step 8, you will
estimate how much money you will need if yourcompany sustains damage and consider any measuresthat need to be taken to make up any shortfalls. This financial analysis will help you:
- Understand how much your revenue will decrease as the result of a business disruption (Section 1)- Estimate how much you will incur in recovery costs to resume your business operations (Section 2)- Recognize how much in ordinary expenses you will incur during a disruption (Section 3)- Calculate how much you need to meet any shortfall (Section 4)28

From past experience, we recommend that your company maintains a reserve of cash and deposits equivalent to
one month's worth of revenues.
You can assess your financial status by completing Form 8-1.
(1) Check your available funds
You should check the amount of funds that you have on hand in reserves or that would otherwise be available
if needed during a business disruption. First, fill in the total amount of available funds in Form 8-1. Examples ofavailable funds include cash, deposits, and short-term securities. Additionally, your company might be able to get
private funding from an owner of the company. Next you should check your company’s insurance policies. Findout what types of insurance policies your company has and whether such insurance policies cover the disaster or
accident in question. Also find out how much coverage you have. You should be aware that in most cases, it takessome time for insurance payouts to be made due thetime required for investigations and settlement

Figure 8-1 Financial Status During Disruption

negotiations.
The bottom line of Form 8-1 shows the total amount of available funds (A).
Form 8-1 Available Fund (sample)
Type

AmountOther

Cash and Deposits

100,000

Insurance

50,000Available Funds (A)150,000

Fire / Flood /Earthquake(2) Estimate recovery costs
Next you will assess the expenditures your company would incur as the result of a disaster and during thedisruption period. You have already estimated damages and restoration periods for your important resources(Steps 4, 5, 6, and 7). Now you have to do some guesswork regarding how much it would cost to repair andrestore the damaged resources that are essential to the resumption of your Prioritized Activities. Estimate therecovery cost for each main category of resources, as shown in Form 8-2. Buildings, equipment and machinery,
fixtures and fittings, and inventory are listed as examples. Enter the expected total recovery cost for each category.
The bottom line of Form 8-2 shows the total amount of estimated recovery costs (B).
Form 8-2 Recovery Costs
Recovery Cost

AmountOther

Building

10,000Equipment and machinery

5,000

29

Fixtures and fittings

5,000

Inventory

5,000

Total Recovery Costs (B)25,000(3) Summarize ordinary expenditures
There are ordinary expenditures that your company has to pay even during a disruption. These expenses
include fixed costs such as payroll and rents on real estate and warehouses, as well as variable costs such as debt
payments. You need to know the total monthly amount of your ordinary expenditures during a disruption period.
Use Form 8-3 to enter the expense items and total amounts. The bottom line shows the total ordinary
expenditures (C).
Form 8-3 Ordinary Expenditures
Ordinary Expenditure

AmountOther

Payroll
Purchased supplies
Rent
OthersTotal Ordinary Expenditures (C)(4) Assess cash flow status
By completing processes (1), (2) and (3) above, you will have obtained the total amounts of your available
funds (A), recovery costs (B), and ordinary expenditures (C). Enter those amounts in Form 8-4 and calculate thebalance (=A-B-C). If the balance is negative, your company will have a shortfall in necessary funds. If it ispositive, your company is likely to have sufficient funds for weathering a disruption.
Form 8-4 Financial Status Sheet
Available Funds (A)Recovery Costs (B)Ordinary Expenditures (C)Balance (=A-B-C)(5) Financial measures
If the balance shown in Form 8-4 is negative (indicating a fund shortage), your company needs to take30

financial measures to make up for that shortfall. You may need to increase available funds by taking out a loan
from your bank or by cutting down on redundant costs to decrease expenditures. In many cases, the national andlocal governments provide low interest disaster loans for SMEs that have been affected financially by a disaster. It
is therefore important to research what kinds of financial support programs might be available to your company.
Form 8-5 Financial Measures (sample)
Financial Measures

AmountDetail(example) Borrow from bank

100,000

Check the amount every December(example) Disaster loan

150,000

Apply when hit by a typhoon

Step 9 Exercises make your plan functional
In Steps 5, 6, and 7, your company planned out your BC Strategies. The next question relate to some of thoseplans. How confident are you that you can you answer "Yes" to the following questions?
- Can all employees (and visitors) evacuate promptly and safely, following your evacuation plan?
- Can all employees call your emergency phone number to confirm their safety status?
- Can EOC members gather immediately as instructed at the established meeting place and perform theirdesignated duties?
Making a plan and executing a plan are different tasks. Your company’s business continuity plans need towork effectively as planned in the case of an emergency. The purpose of an exercise is to ensure that yourcompany’s plans work effectively and can achieve their objectives. Exercises are intended not only to test how
well your plan performs, but also to provide employees with education and training to enhance their knowledge
and expertise, empowering them to act as instructed in a disaster.
Exercises can included the following:- Evacuation drills: Test and practice safe and prompt evacuation to designated locations.
- Safety confirmation exercises: Test and practice emergency calls to employees to confirm their safety.
- EOC exercises: Test and practice the mobilization of the EOC and the performance of designated roles by
EOC members.
- Backup data recovery exercise: Test and practice recovery using backup data.
- Operational restart exercise: Test and practice the resumption of operations after a disruption.
- Alternative site launch exercise: Test and practice starting up operations at an alternate site.
There are many types of exercises that can be conducted. It is recommended that you conduct any exercises

31that your company thinks necessary and feasible. You can increase the level of complexity of your exercises andadopt different types of exercises to improve your company’s business continuity capabilities.
Use Form 9-1 to create an exercise plan for your company. The post-exercise review is important for
identifying any deficiencies or problems, so that your company can make any necessary improvements.
Form 9-1 Exercise Plan
Type of Exercise

Aim

Target Group

Date of Exercise

Post Review

6. PDCA: Continuous Improvement
Business Continuity Management refers to your company-wide efforts to develop your capabilities forresuming critical operations (Prioritized Activities) after a disruption caused by a disaster. It is not easy toestablish such capabilities in a short period of time, but it is essential to continuously improve and enhance themover time. We strongly recommend that you utilize the PDCA Cycle (Plan, Do, Check, Act) for your company’s
continuous BCM improvement.

Step 10 Ongoing Review and Improvement
You have already gone through the firsttwo of the four phases (Plan and Do). In
Step 10, you finish the remaining two steps:
Check (monitor and review) and Act(maintain and improve).

(1) Review and check your BCM
In order to make your company’s BCM as32

effective as possible, you should monitor and review your company’s BCM activities. All phases of your BCM
activities – before, during, and after an incident - should be reviewed.
Use Form 10-1 to assist in this process, proceeding through each of the 10 steps outlined in this booklet.
Ask yourself the following questions as you review each step.
- Are the BCM activities that have been established being performed effectively ?
- Are there any tasks or problems that require improvement?
- Are there any changes in internal or external circumstances that need to be considered?
- Are there any areas or items which were not included in the BCM but need to be added?
Form 10-1: BCM Review Form
Step

1

Items to Review and Check

RelatedCurrently

Changes

Forms

Effective

in Business Environment

BCM Framework

1-1,

Purpose, scope, BCM leaders

1-2,

and team members

1-3

Y/ N

Prioritized activities, recovery
2

3
4
5

time objectives
Supporting resources
Bottleneck resources
Surrounding risks
Expected damages
Protection and mitigation
measures
Emergency response,

6

EOC, safety confirmation, risk
communication

7
8
9
10

Continuity and recovery
measures
Exercises, training
Cash flow for emergencies
Financial measures
Monitor, review, andimprovement

33

Issues to Review

This review process should be conducted periodically, at least once a year. If there are any changes in thebusiness environment surrounding your company, such as a change in partner companies (suppliers or vendors),core business operations (products or services), IT systems, location changes, or changes due to a merger or
acquisition, you should pay attention to their potential effects on your BCM. Those factors may not have beentaken into consideration or may have been omitted in your reviews and you may have to reconsider and makechanges to your BCM program. It is important that you conduct periodic reviews so as not to miss a chance toupdate your BCM. These internal reviews are usually performed by the BCM Team, the departments in charge,
and your internal audit department.
(2) Management review
In addition to the above review and check processes, top management has to proactively initiate a review of
the company’s BCM at least annually, ensuring that it is being managed effectively and that the PDCA cycle isworking. Form 10-2 is for management review. The input items to and output items from top management during
management review should be determined. It should be understood that the management review serves as a strong
motivator for closing the loop on the PDCA cycle.
Form 10-2 Management Review Sheet
Check & Review Items

Person in Charge

34

Due Date

Top
Management

Appendix
1.Blank Forms
Form 1 BCM Framework
Form 2-1 Impact Level Comparison Chart
Form 2-2 Maximum Tolerable Period of Disruption
Form 2-3 Prioritized Activities and RTOs
Form 3-1 Necessary Resources for Prioritized Activities
Form 4-1 Risk Impact and Likelihood Comparison Chart
Form 4-2 Resource Damage Estimate Sheet
Form 5-1 Protection and Mitigation Measures for Key Resources
Form 6-1 Evacuation and Rescue Plan
Form 6-2 Emergency Operation Center
Form 6-3 Emergency Contact List
Form 6-4 External Contact List
Form 6-5 Storage List for Disasters
Form 6-6 Damage Survey Form
Form 7-1 Continuity Strategy Summary
Form 7-2 BC Strategy Planning Sheet
Form 8-1 Available Funds
Form 8-2 Recovery Costs
Form 8-3 Ordinary Expenditures
Form 8-4 Financial Status Sheet
Form 8-5 Financial Measures
Form 9-1 Exercise Plan
Form 10-1 BCM Review Form
Form 10-2 Management Review Sheet

2.BCM Checklist

35

1.Blank Forms
Form 1BCM Framework
BCM Purpose

Protect People

Protect Business
Activities

Recover with Local Community

BCM Scope
Departments
to introduce BCM

BCM Leader and TeamBCM Leader

BCM Team Members

36Form 2-1
Impact Level Comparison Chart
Department Handling Each Product/ Service

Impact Levels
External! Impact

Internal! Impact

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

L

:

M

:

S

37

Form 2-2
Maximum Tolerable Period of Disruption
Departments HandlingTime When Impact Becomes Unacceptable

Recovery Time

Each Product/Service

MTPD

Objective (RTO)

Product / Service A

3 ds

1 wk

2 wks

1 mo

2 mos.

Product / Service B

3 ds

1 wk

2 wks

1 mo

2 mos.

Product / Service C

3 ds

1 wk

2 wks

1 mo

2 mos.

3 ds

1 wk

2 wks

1 mo

2 mos.

3 ds

1 wk

2 wks

1 mo

2 mos.

Form 2-3
Prioritized Activities and RTOs

Prioritized Activity(ies)

Recovery Time
Objective(s)
(RTO)

38

Form 3-1
Necessary Resources for Prioritized Activities
Type of Resources

Contents

Building
Equipment / Machinery
Internal
Resources

Inventory
PeopleIT System
Fund(Other)Electricity
Essential
SocialServices

Gas
Water
Phone / Communication
Traffic / Roads(Other)Direct supplierSupplies

2nd, 3rd Supplier
Customer(Other)39

Form 4-1
Risk Impact and Likelihood Comparison Chart
Risk

ImpactLikelihood

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

H! ! M! ! L

40

PriorityForm 4-2
Resource Damage Estimate Sheet
Risk

Assumed recovery period

Assumed damage
Necessary resourcesDay

DamageBuilding
Equipment/

MachineryInternal

Inventory

Resources

PeopleIT System
Fund(other)Electricity
Gas
Essential
Social Services

Water
Phone

/

Communication
Traffic / Roads(other)Direct supplierSupply2nd, 3rd Supplier
Customer(other

)

41

Need

Day (shown by graph)
3ds

1wk

2wks

1mo

2mos

3mos

measures

Form5-1
Protection and Mitigation Measures for Key Resources
Implementation Deadlines
Resources

Objectives

What To Do

Your Plan

42

Immediately

Within1 yearMid toDepartment inLong

ChargeTerm

Form6-1
Evacuation and Rescue Plan

Office/Factory

Evacuation Site
(meeting place)

Person in charge;
LeaderAssistant;

Person in charge of rescue
and medical care

Person in charge;
Assistant;(name, address, telephone number)

Hospital

43

Form6-2
Emergency Operation Center
MembersRoles

department nameTel

Address

Tel

Leaders(including deputies)
Analysis and planning
Information function
Site operation function(stabilization,

rescueandmedical care, confirmation of
employeesafety,sanitation,

logistics)
Public relations
Mobilization-thresholds
Meeting place

Order(includingofalternatepriority

locations)

1

Workplace2344

Form6-3
Emergency Contact List
Safety status to be
Department

Name

Tel

E-mail address

entered in anemegency

45

Form 6-4
External Contact List
StatusExternal Partners

Name

Tel.

E-mail address(complete when an
incident occurs)46Form 6-5
Storage List for Disasters
Categories
Food / Water
Living supplies

Items

Numbers of items to prepare

Drinking water

3 liters/person for 3 days

Emergency food

3 day supply/person

Sanitation supplies (tissues, wet tissues, toilet

3 dayspaper, etc.)

Medical supplies
Tools

Utensils

Necessary numbers for people

Portable toilets

3 daysPlastic bags, tape

Equal to the number of people

Blankets, sleeping bags

Equal to the number of people

Portable gas and stoves

3 daysPots and kettles

3 eachPocket warmers

3 day supply/person

Oil heaters, oil

Fuel for 3 days

First aid kits

Equal to the number of people

Folding stretcher

3

Tools (crow bar, pliers, hammer, shovel, cloth

3 eachtape, stepladder)
Helmet and gloves

Equal to the number of people

Plastic sheets, tarps

3 sheets (10m×10m)

Garbage cans, buckets

3 eachSupport for getting

Rainwear

Equal to the number of people

people home

Maps

Equal to the number of people

Information

Radios, dry batteries

3 eachgathering,

Cell phone chargers

3 units per each model

communication

Loudspeakers

3 units

Other

Generators, generator fuel2 units of fuel for 3 days

47

Form 6-6
Damage survey form
Surveyed location
Employee injuries

Injured employees

Names:

Damage to buildings

Appearance

Large ㋪ Medium ㋪ Small ㋪ None

InsideLarge ㋪ Medium ㋪ Small ㋪ None

Safe entry
Damage to assets

Yes ㋪ No

Equipment(Damaged equipment / number of items)

Communication(Damaged equipment / number of items)

equipment
IT apparatus(Damaged equipment / number of items)

Fixtures and fittings(Damaged items / number of items)

Vehicles(Damaged vehicles / number of items)

Damage to essential

Electricity

Available ㋪ Not Available

services

Gas

Available ㋪ Not Available

Water

Available ㋪ Not Available

Landline

phone

Available ㋪ Not Available

phone

Available ㋪ Not Available

service
Mobileservice
Neighboring situations

Internet

Available ㋪ Not Available

Fire

Available ㋪ Not Available

Other
Business continuity
Visitors

Disrupted ㋪ Not Disrupted(Injured people)

OthersForm 7-1
48

Continuity Strategy Summary
Key Resources
Priority

Strategy Outline

Activities to Resume(bottleneck
resources)

Strategy 1: Resume at the damaged/affected site

Strategy 2: Resume at an alternate site

Strategy 3: Resume using alternate methods

Strategy: Other

49

Necessary
External Partners

Form 7-2
BC Strategy Planning Sheet
Prioritized Activity

Strategy Outline
To be done byCategories

Resources

What’s to be

Details ofdone / needed

Measures

Building
Internal
Resources

Equipment / Machinery
Stock
PeopleIT System(others

Essential
SocialServices
Outside!
Partners)

Electricity/Gas/Water
Phone/ Communication
Traffic / Roads(others)

Suppliers
Customer(others

)

50

when
Mid-!
Short

Long

term

Term

Department
in charge

Form 8-1
Available Funds
Type

AmountOther! Available Funds ( A )51

Form 8-2
Recovery Costs
Recovery Cost

Amount! Total Recovery Costs( B )

52

Other

Form 8-3
Ordinary Expenditures
Ordinary Expenditure

Amount! Total Ordinary Expenditures (C)

53

Other

Form 8-4
Financial Status Sheet
Available Funds (A)Recovery Costs (B)Ordinary Expenditures (C)Balance （ =A-B-C ）54

Form 8-5
Financial Measures
Financial Measures

AmountDetail55

Form 9-1
Exercise Plan
Type of Exercise

Aim

Target Group

56

Date of Exercise

Post Review

Form10-1
BCM Review Form
Step

RelatedCurrently

Changes

Forms

Effective

in Business Environment

1-1,

Y/ N

Prioritized activities, recovery

2-1

Y/ N

time objectives

2-2

Y/ N

2-3

Y/ N

3-1

Y/ N

Surrounding risks

4-1

Y/ N

Expected damages

4-2

Y/ N

5-1

Y/ N

6-1

Y/ N

6-2

Y/ N

6-3

Y/ N

6-4

Y/ N

Continuity and recovery

7-1

Y/ N

measures

7-2

Y/ N

8-1

Y/ N

8-2

Y/ N

8-3

Y/ N

8-4

Y/ N

8-5

Y/ N

9-1

Y/ N

Monitor, review, and

10-1

Y/ N

improvement

10-2

Y/ N

Items to Review and Check
BCM Framework

1

Purpose, scope, BCM leaders
and team members

2

3
4
5

Supporting resources
Bottleneck resources

Protection and mitigation
measures
Emergency response,

6

EOC, safety confirmation, risk
communication

7

8

9
10

Exercises, training

Cash flow for emergencies
Financial measures

57

Issues to Review

Form 10-2
Management Review Sheet
Persons in

Check & Review Items

Charge58

Due Date

Top Management

2.BCM Checklist
Answers
No.

Question

Steps

No

Yes-

Yes!

PartiallyDone

1

Has a BCM Manager been appointed and has a budget for BCM activities been allocated?

1

0

2

4

2

Are the BCM purpose, scope and leader well known throughout your company?

1

0

2

4

1

0

2

4

2

0

2

4

2

0

2

4

2

0

2

4

3

0

2

4

3

0

2

4

4

0

2

4

4

0

2

4

4

0

2

4

5

0

2

4

5

0

2

4

6

0

2

4

6

0

2

4

6

0

2

4

3

4

5

6

7

8

9

10

Does upper management take a visible leadership role in BCM activities and show its
commitment to BCM to employees?
Does your company understand what the impacts would be if the company's operations were
to be disrupted for one week? One month?
Does your company understand how soon it would have to resume operations after adisruption to avoid severe impacts that would threaten the company's survival?
Has your company identified which businesses should be given top priority for the recovery
and resumption of operations?
Has your company identified important internal resources or outside essential services thatmight create a bottleneck for business resumption efforts?
Has your company already identified necessary materials or parts which are supplied by asingle supplier?
Has your company researched the disaster history or risk information (such as hazard maps)that have been published by your local government or other organization?
Is your company able to withstand the type of natural disaster (with extensive impacts) thathas a higher probability of occurring than other disasters?
Has your company identified which necessary resources might sustain severe damage as a11result of the natural disaster identified above (question 10), thus becoming an obstacle forearly business resumption?
Has your company planned and implemented pre-disaster protection (prevention) and12

mitigation measures to protect the safety and welfare of your employees from expecteddisasters?
Has your company planned and implemented pre-disaster protection (prevention) and13

mitigation measures to protect your company's assets from disasters (earthquake, floods,
typhoons) and accidents?

14
15
16

Has your company prepared an emergency contact list of employees?
Has your company decided on the framework for an Emergency Operation Center, such aswhere to gather, what members are to be called, and the criteria for mobilization?
Has your company made a contact list of customers, business partners, and authorities?

59

17
18

19

20

21

22

Does your company periodically backup its data?
Does your company have an alternate site in place in case its headquarters or main businesslocation is shut down?
Does your company have alternate or temporary measures in place to replace mainequipment (or other resources) in case primary equipment becomes unusable?
Does your company know the disaster management and business continuity status of
suppliers that supply its essential materials and parts?
Do you know how much funding you would be short if your company's operations were to
be totally disrupted for one month?
Have you checked into what kinds of disaster support programs are available through yourlocal government or other public organizations?

7

0

2

4

7

0

2

4

7

0

2

4

7

0

2

4

8

0

2

4

8

0

2

4

23

Have you set aside a cash reserve equal to one month of revenue for disasters?

8

0

2

4

24

Does your company conduct periodic evacuation drills?

9

0

2

4

9

0

2

4

9

0

2

4

10

0

2

4

10

0

2

4

25

26

27
28

Does your company conduct exercises to test that data can be safely recovered from backup
systems?
Does your company conduct exercises to practice mobilizing the Emergency Operation
Center?
Does your company periodically review its disaster management and business continuity
plans and implement improvement measures if necessary?
Does upper management proactively engage in the periodic review of BCM activities?

Total Score

Your BCM Status Level

Your Total Score

Your company is defenseless against disasters and accidents. If a disaster strikes, your company is very likely tosustain severe damage which may cause long-term disruption. Your company needs to know the risks that threaten it

0 - 36and to start considering what can be done to minimize the potential damage that might be caused by such risks.
Your company is aware of the risks to which it is exposed and has taken some necessary preparatory measures.
However, the expected results of those measures may be limited. Your company is still exposed to severe damage
because of the weakness of your BCM activities. Be sure to prioritize BCM activities to make your BCM more

37 -74effective.
Your company has almost established BCM and has implemented measures that would probably be effective if therisks are within your estimates. Continue following the PDCA cycle in your BCM activities to enhance yourbusiness continuity preparedness and ensure that you will be able to respond effectively to an unexpected incident ordisaster.

60

75 - 112APEC Project: M SCE 02 11A

Produced by:
Name: Maggie Hsiu-Ling Hsu
Title: Senior Executive Officer, Business Start-up and Incubation Division
Organization: Small and Medium Enterprise Administration, Ministry of Economic Affairs
Postal address: 3rd FL., No. 95, Sec 2, Roosevelt Rd., Taipei, Taiwan
Tel: + 886-2-2366-2251 Fax: + 886-2-2367-3914 Email: hlhsu@moeasmea.gov.tw
In Collaboration with ADRC
Name: Mr. Takahiro Ono
Title: Visiting Researcher/BCP Manager
Organization: Asian Disaster Reduction Center/Mitsubishi Corporation Insurance Co., Ltd
Postal address: Shin-Yurakucho Bldg, 12-1 Yurakucho 1-Chome, Chiyoda-Ku, Tokyo 100-0006 Japan
Tel: + 81-3-6269-3792
Fax: + 81-3-6269-3799
Email: t-ono3792@mcic.co.jp / onotaco@gmail.com
Name: Mr. Shinichi (Nick) Okabe
Title: Adviser
Organization: Tokio Marine and Nichido Risk Consulting Co., Ltd
Postal address: 2-1 Marunouchi 1-chome , Chiyoda-ku, Tokyo,100-0005 Japan
Tel: + 81-3-5288-6580
Email: shinichi.okabe@ani-com.com / nick_okabe@yahoo.co.jp
Name: Mr. Tsuyoshi Yoshiga
Title: Independent Consultant
Postal address: Togoshi , Shinagawa-ku, Tokyo, Japan
Tel:Email: tsuyoshi_yoshiga@hotmail.com

For Asia Pacific Economic Cooperation Secretariat
35 Heng Mui Keng Terrance
Singapore, 119616
Tel: (65) 68919 600
Fax: (65) 68919 690
Email: info@apec.org
Website: www.apec.org©2013 APEC Secretariat

61