This content was reviewed in September 2024
What is a business continuity plan?
A business continuity plan (BCP) helps your company survive and continue running after a major disruption or disaster, like a fire, flood or cyber-attack. It highlights the step-by-step process of what should be done to prevent risks that can lead to your business having to close. It aims to protect critical business functions so you can continue operating and implement a recovery strategy.
Why is it important?
Although you know the risks, the effects these have on you are often unique to your business. With disaster recovery planning, there is no standard response. You know your business best, but rebuilding it, whilst continuing to operate if possible, is rarely easy or straightforward, even with help.
- Business continuity planning helps your business survive a major disruptive event
- Insurance doesn’t cover all aspects of business continuity risk, since it can’t cover any issues arising from a slow response
- Plan timescales to ensure your IT gets back on track as quickly as possible in case of major disruption
- Coordinate an emergency response and work to recover your business at the same time in case of a dangerous event such as fire or flood
- In case of damage or destruction to infrastructure, your facilities managers will have a plan in place to either relocate or rebuild quickly
- Getting up and running again soon after sends a powerful message to your customers, reassuring them that they will never be left uncertain or under-supplied if your business suffers disruption
Get started with your free BCP kit
FSB members can access a free business continuity planning kit from FSB Insurance Service. It’s free to register with FSB Insurance Service.
Jump to:
- Who should be involved in creating your continuity plan?
- How long does business continuity planning take?
- What is included in a business continuity plan?
- Contingency planning and business recovery
- How much does business continuity planning cost?
- Finalising your business continuity plan
- Reviewing your business continuity plan
Who should be involved in creating your business continuity plan?
As the owner or managing director of your business, it’s your responsibility to create a continuity plan for your company. If you have set up a company with a partner, you should work together to create the plan and make crucial business decisions.
Identify the potential impacts an incident can have if certain sections of the business are disrupted. Harness the knowledge and experience of people who are fundamental to the operation of your business. Depending on the kind of company you operate, this could include directors, key personnel, or employees with valuable experience and knowledge of:
- How your business manufactures its products
- How your business provides its services
- Your key service providers
- The regulations associated with providing your services
- Key supply processes your business depends on
- Your product distribution processes
How long does business continuity planning take?
There’s no one size fits all template when it comes to building an effective plan. Your aim should be to ensure it works for your business and will be fully effective should you need it later down the line.
For example, a manufacturing company based in an area that’s prone to flooding, with more processes, resources, and company threats, might require more time to gather all this information. On the other hand, a high-street retailer located in a built-up area, which has fewer processes and resources to rely on, may be less likely to be affected.
The following factors can help you to plan more effectively:
- Local knowledge to find suitable contingency locations and source emergency equipment
- Business expertise and well-researched information
- Reliable staff to delegate the work needed to complete different sections and finalise the plan more quickly
What is included in a business continuity plan?
Let’s assess the key functions of your business, the potential threats, and risks, and the impact this could have on your company.
Key business processes
These are the essential areas of your business operations. This is likely to be your production services if you manufacture products, your IT infrastructure if you’re a website designer, or your stock if you’re a retailer. Other business processes could include:
- Accounting
- HR
- Marketing
- Sales
Understanding company threats
Consider ranking these in order of which threats could pose the highest risk to the lowest risk of disrupting your business. Threats could include:
- Biological hazard
- Epidemic illness
- Natural disasters, fires, or floods
- Gas leak or power cut
- Cyber attacks
Determining impact
A Business Impact Analysis (BIA) predicts the potential consequences of your business processes being disrupted. The amount of time for recovery before your business will suffer consequences is known as a Recovery Time Objective (RTO). It also determines your potential business loss from these processes being down for a day, a week, a month or longer. Impacts could include:
- Loss of sales and income
- Increased expenses
- Decrease in customer satisfaction and loyalty
- Delayed service delivery and poor product quality
- Regulatory fines
Determining your key resources
Once you’ve determined areas of business functions, threats, and impacts, you should list the key resources your company relies on. This includes key staff, external contacts, equipment, and documents.
Consider ranking the resources in order of importance to your business, according to the maximum manageable downtime and how long your company can survive without that resource in place.
Staff
These are the employees that your business can’t function without. Consider staff who:
- Lead your sales services
- Manage your company accountancy
- Know the regulations associated with your services
- Lead your production processes
- Manage your clients and their accounts
External contacts
List the key people (and their companies) outside your business who are key to its operation. This can include:
- Contractors and service providers
- Suppliers and distributors
- Banks, accountants, and lawyers
- IT consultants, electricians, or engineers
- Utility companies
You should list vital contact information about your key staff and external contacts. This includes personal and business phone numbers and email addresses.
Data, equipment, and supplies
- Data and databases to conduct client work projects
- Equipment such as manufacturing machinery
- Technology, including specific computers or software
- Passwords and identification data to access key files and sites
- Supplies, like materials to make products
Business documents
This is all documentation you would need to continue running your business or restart your company. This could include:
- Banking information
- HR documents
- Legal papers, like articles of cooperation
- Tax returns
- Utility bills
Make copies of these documents and store them off-site. List any ongoing payment dates, such as for business loans or your email services.
Contingency planning and business recovery
Once you’ve listed your essential resources, it’s important to determine your contingency plan to help your business continue running and recover in the event of a disaster.
Contingency equipment
Identify alternative equipment you could use, and the services you could use to access it, if your current company equipment was destroyed. This could include services for:
- Renting delivery vehicles
- Copying or printing
- Renting computers or laptops
You should also think about who in your staff will be responsible for managing the relationships with these service providers and making any key decisions.
Contingency location
This is where you will operate your business when your premises are unavailable. This could be a hotel, a conference centre, a vacant shop, or a storage rental facility. Include a map of the new location and the contact information you need to access it. Some employees may be able to work from home if your contingency location can’t accommodate all your staff.
How much does it cost?
Business continuity planning costs can vary from business to business, depending on the nature of your business, the equipment you use, and the scale of the potential incident. To determine the costs of implementing a business continuity plan, look at the different areas where you might need to spend money.
Premises and relocating
You may require a certain size, standard and suitable location to operate your business from after an incident. Think about:
- Will your equipment fit?
- Is there good road access?
- Is there safe access for customers?
- Will you need a removals service to deliver furniture and equipment?
The time to set up the office, collate documents you’ve stored away, carry out risk assessments, and ensure power is connected, up and running, can also impact on costs.
Furniture and equipment
You might need to buy or rent furniture, such as desks and chairs for your team to work effectively. However, you might plan to have your team temporarily work from home or decide to operate your company from your home.
You’re also likely to need essential equipment and devices, such as mobile phones and laptops, so you can maintain good communication with your clients and customers. If you have stored away spare items like these, as part of your plan, this should also lower your business continuity costs.
Stock, staff, suppliers, and maintaining business
If you’re a high-street retailer, you might need to quickly replace stock or materials. This might mean you have to pay your supplier extra to replace and deliver items or find an additional supplier that can do this for you instead.
There are also staff expenses to consider, such as if a new location for your business means your sales team will need to travel further afield than previously to visit key clients. It’s a good idea to have a plan of action that helps limit unnecessary travel.
Consider investing in backup servers and remote devices such as laptops, tablets and smartphones. You might also decide to invest in a storage facility where key documents and confidential company information can be held to keep it safe and protected outside your business.
Insurance claims
Your insurance policy cover might allow you to replace damaged equipment, repair damaged property, or cover you for business disruption, allowing you to claim back any loss of earnings.
Finalising your business continuity plan
With all the information across your key functions, resources, and contingencies, you should be able to create step-by-step instructions on how to execute your business continuity plan.
- List the names and responsibilities of the people in your plan
- File all your information together as one document
- Make copies of your plan for your continuity team and in a location off-site
Reviewing your business continuity plan
As with many business processes, you should review your business continuity plan regularly to make sure it’s up-to-date and fit for purpose. As we’ve seen with the spread of COVID-19, risks to your business can develop and change rapidly.
When should you review your plan?
Changes to your company operation
- Relocation to new offices or acquiring a new site
- New products or services
- Changing priority levels in your business
- New equipment, upgrades to your technology, or changes to your production processes
- The emergency site you plan to work from and recover your business is no longer accessible
Changes to people in your business
- When you change key staff that your business can’t function without, such as senior employees who lead your sales team or manage your company accountancy
- When you appoint staff to manage a new site
- When responsibilities of your staff change, such as junior employees being promoted to key senior roles
- When you change your suppliers or extend your list of key external contacts
- When key staff may need to work remotely on a temporary, permanent or flexible basis
How often should you review your plan?
You should aim to review your plan at least once a year, or every six months, if possible. Setting time aside to do this can help you identify new risks. Once reviewed and updated, you need to redistribute your plan. Make sure everyone is aware of the changes you’ve made, so your business is prepared for when the plan must be put into action. Save your updated plan in a secure location and discard any outdated versions of the plan.