How to create a small business continuity plan for your startup
Disasters like floods, earthquakes, fires, or cyberattacks rarely arrive announced. Is your company adequately prepared for such events? A business continuity plan provides a rundown of the procedures a company must follow in the face of an emergency to continue business operations during and after a disaster. A tested, up-to-date plan that’s ready to execute is your startup’s best chance for surviving when the unexpected strikes.
What is business continuity?
Business continuity is a company’s ability to maintain its operations and critical business functions during and after a disruption. The business continuity plan (BC or BCP) provides instructions to an organization on how to proceed after a disruptive event. It includes a list of procedures to follow, covering human resources, business processes, protection of assets, and more.
Don’t mistake a disaster recovery plan with a business continuity plan—a disaster recovery plan is just one aspect of the business continuity plan, primarily focusing on protecting and restoring information technology (IT) operations.
The BCP handles business impact analysis issues such as:
- Where key staff will work if the office building is damaged
- How and where manufacturing will occur to continue production
- How the sales teams will operate during and after the disaster so the company can keep generating revenue
Who needs business continuity planning?
All businesses are susceptible to some level of disaster ranging from small to catastrophic. The last thing your startup needs is to shut down because of an emergency. Therefore, all businesses, large or small, could benefit from a plan that addresses disaster recovery planning.
Many companies have business continuity procedures for IT but lack a comprehensive BC plan for other departments. A complete plan where all departments have procedures in place to respond quickly and appropriately to a disruptive event is crucial, so a startup can continue to service clients while projecting itself as stable and reliable.
The business continuity plan outline
To create a business continuity plan, list your company’s vital functions or departments, such as Finance, Marketing, and Accounting. Look for which small business operations may be the most vulnerable during a disaster. They normally include those which could cause financial losses if the startup can’t operate for as little as one day. Organize the most vulnerable departments or processes from most important to least.
Once you have a snapshot, develop a plan. Think of creating a plan of loose guidelines instead of a strict code of regulations so personnel can follow an outline yet still adapt to the type of business disruption.
Besides a digital copy distributed to several key staff members, keep several hard copies of your company’s BC plan in various locations. If your computer systems shut down, a printed handbook will give you access to critical information.
Follow these five general steps to create a BC plan:
1. Describe how potential threats could affect your company’s operations
Create a risk assessment by describing which business interruptions and emergencies your company may be affected by and why. A company on the West Coast may list earthquakes and fires as potential risks while a company in South Florida may list hurricanes, flooding, and cybersecurity attacks as its main vulnerabilities.
Each company would go into detail on why these events could interrupt its business. For example, a company in Florida may suffer from flooding at headquarters, the inability for employees to report to work, and a widespread electrical outage (creating downtime for several days after a hurricane) as major factors that would affect their operations.
As you create your BCP, discuss it with chief personnel or other business partners who may have experienced a disaster. Their "war stories" could provide you with invaluable advice and techniques that could help your company get through the interruption quickly and efficiently.
2. Establish procedures and safeguards to mitigate the potential risks
The procedures and safeguards section of the BC plan covers risk management. It should include an inventory and location of all critical equipment, supplies, data, and data backups.
Include a contact information list for key personnel, the continuity team, emergency response personnel, the IT team, and backup location providers. Add a list of resources the continuity team may need, such as where backup data and other company-sensitive documents are stored. Most importantly, include a checklist of procedures and safeguards so the team can respond to a disruption. It may be a brief list, such as:
- Move all documents and data backups offsite
- Forward customer service calls to employee home phone numbers so they may work from home
- Set up a backup operations headquarters until the disruption is resolved, etc.
3. Assign personnel to a business continuity team who will respond and manage the event
The continuity team will be the first responders during a disruption. They should study and train in all aspects of the plan, so they can act quickly should disaster happen. Continuity team members could also serve as the liaisons between employees, the company’s officers, and all the personnel required to keep a business running (or get it back to operating as quickly as possible).
In the case of the Florida company affected by a hurricane, the team would be responsible for moving critical data, documents, and equipment from the vulnerable site to a safer location. If flooding affected the company location, they could hire a cleanup team to quickly address the flooding damage to headquarters and set up a temporary work location.
4. Set up a testing schedule to ensure the procedures work properly
Testing your crafted BCP is the only way to know if it will work. Rigorously test the plan by attempting to “break it.” Only when you stretch your objectives and push the procedural limits can you uncover what requires improvement.
Organizations test a business continuity plan at least two times per year. The testing schedule depends on where your company is located, how high the risk from a natural disaster is, and the amount of turnover in the continuity team since the last test. Assign independent staff to monitor the drills in action and note any observations about shortfalls or potential gaps in the plan that the company should address.
Common tests include structured walk-throughs, emergency evacuation drills, simulations, and table-top exercises.
- A table-top exercise is performed in a meeting room. The team reviews every aspect of the plan to make sure all departments and procedures are covered.
- Followed by a more comprehensive structured walk-through, the continuity team members follow through on their sections of the plan according to the types of potential disasters outlined and question the steps to identify weaknesses. Gaps or deficiencies in the walk-through should be corrected and noted for an update.
- An emergency evacuation drill trains all employees, so they know what part they play in an actual evacuation. Continuity team members should take notes on how the evacuation progresses and make changes or special arrangements that should be updated in the plan.
- The most comprehensive drill is the disaster simulation testing. A simulation of an actual disaster—with all equipment, supplies, and personnel—will determine if your startup can carry out its critical business functions under pressure due to the event.
5. Update the BCP as needed
Once the drills and testing are finished, meet with the continuity team members and the independent monitors to review the outcome, what shortfalls were uncovered, and what recovery strategies were suggested to correct any issues with the plan. Revise procedures, update all the plan copies, and redistribute them to the appropriate personnel.
The keys to success of a business continuity plan
For a BC plan to succeed, it must be supported and promoted at all levels, from senior management down. For the plan to remain current and viable, adequate review and regular testing are essential.
Promoting awareness for all staff should be a priority. Employees who aren’t familiar with the plan won’t be able to react appropriately in the event of a disaster, affecting the company’s chances of successfully surviving the event. Involve all personnel in the drills and feedback process to ensure that in case of an emergency or unexpected disruption, your startup team will get through it as smoothly as possible.