How to create an effective business continuity plan

Every small business owners’ worst nightmare is facing sudden disruption to their operation, causing a need to change how you work, make bold decisions, and alert employees using platforms like WhatsApp.

Having a strategy in place for when disaster strikes is essential to every small business – and this is where a Business Continuity Plan (BCP) comes into play.

This article will explore what a BCP is, why they are important, and how to create one for your small business.

What is a business continuity plan?

Business continuity is the ability of an organisation to continue production and delivery to an acceptable standard following a disruptive incident.

Often pulled together by the business owner, a business continuity plan (BCP) details how the business will continue running throughout major disruption or disaster – this could be anything from a cyber attack to a fire or even a pandemic.

The plan should list out the strategies and steps that everyone in the business needs to take to keep operations going and protect critical business functions. Once achieved, business owners can then implement their recovery strategy.

Why is a business continuity plan important?

It is crucial that every business has a BCP because, without one, an unforeseen circumstance could cease operations – after all, the Covid-19 pandemic taught us that catastrophic events can start unexpectedly and escalate quickly. Without any guidance in place, employees won’t know how to act quickly in response to a disaster.

The key reasons a BCP is important are:

• It helps your business to survive major disruption
• It enables you to plan timescales to get your infrastructure and IT up and running as soon as possible
• It helps you reassure customers that disruption to your business won’t impact them
• It prevents slow responses to disruption that may not be covered by your insurance policies
• It sets out a short-term relocation strategy if your building is destroyed

When disaster strikes, it is hard to think clearly in the moment – but having a BCP in place means you’ll have clear guidelines to follow immediately.

What does a business continuity plan include?

A BCP clearly lists any risks that could potentially impact your business’s operations as normal, from floods to cyber attacks, pandemics to power cuts.

Once these potential risks are listed, the plan should clearly define how to respond to each should the worst happen.

In your BCP, you should:

1. Detail exactly how each potential risk would impact your business
2. Plan procedures to mitigate the impact of each scenario. Prioritise strategies that work to maintain or restore your critical business functions first (processes that must be in place in order for you to keep meeting what’s expected of your business)
3. Define which roles and stakeholders are responsible for which actions
4. Include a communication plan that states who needs to be contacted in each circumstance, how they will be contacted, and what the content and tone of the information will be

Be mindful of how each risk impacts every department – for example, a cyber attack would have a bigger immediate impact on your IT team than, say, the marketing department.

Read more: what are the security risks of using WhatsApp?

How to create a business continuity plan for a small business

So, you understand what a BCP is, why it’s important, and what it should include – now it’s time to create your own. There’s no one-size-fits-all BCP, so it’s essential that you take the time to go through each stage of planning to ensure your BCP is as effective as possible should the worst happen.

Business continuity planning should involve five key stages:

1. Research and analysis, including risk assessment and business impact analysis
2. Development and design of the BCP
3. Deciding on implementation
4. Testing the procedures outlined to ensure they actually work (this may involve staff training and practice drills)
5. Once completed, regular maintenance and updating where needed

Remember, it’s important to consider every possible risk that could impact or prevent your business from operating as normal. This includes the risks that seem very unlikely to happen – like, some would have once argued, a global pandemic.

Employees will also find it very useful to have a checklist to refer to in the immediate aftermath of sudden disaster – this should include emergency contact details, a list of useful resources, details of where important information and backup data is stored, and key actions that will differ from business to business – for example, how best to interact with colleagues in the event of a cyberattack, through channels like WhatsApp.

It’s important to keep your BCP simple and concise, as it needs to be easy to follow and understand in the heat of the moment.

Working out how to implement a business continuity plan

Figuring out how you would implement the plan is a very important stage in the BCP creation process. Questions to consider include:

• Who will be impacted by this disruption?
• How and when will employees and customers be notified?
• How will you communicate with employees if IT systems are down – for example, via personal phones?
• What services should be restored first?
• What issues must be addressed in the first 24 hours?
• Which employees will deliver each task?
• Who will interact with emergency responders?
• Who will look after a hard copy of your most important information, such as important customers’ and suppliers’ details?

It’s essential that the implementation planning stage isn’t overlooked – while creating the BCP is important, it is useless without the right actionable plans in place in the event of a disaster.

Read more: best practice for using WhatsApp in the workplace

When should I review my plan?

It’s important to review potential continuity risks and your BCP regularly – at least once a year or, even better, every six months if possible. This is because businesses and their operations evolve with time, potentially including relocations to new offices, new products or services being used, and business priorities changing – all of which could bring new risks, or render your previous BCP no longer appropriate.

It’s also advised to review your BCP when there are changes to your staffing. Both new recruits and leavers may necessitate changes to your BCP – and so too will a change in suppliers, a change to how often your team works remotely, or a shift in employee responsibility that could come with a promotion, for example.

Once you’ve reviewed and updated your BCP, remember to redistribute your plan to the relevant team members so they are aware of any changes, and arrange for the new plan to be tested out as soon as possible.

Save your updated plan in a secure location, and discard any outdated versions on your server to avoid confusion. Ensure that copies of your plan are available in a few different formats and accessible to everyone who needs one (for example, everyone who is responsible for an action within your plan is given a paper copy to refer to in the event that your server goes down).

Final thoughts

When disaster strikes, it’s natural to go into panic mode – but with a clear and detailed BCP in place that has been carefully curated and implemented, you’ll have a point of reference to guide you through the most stressful times possible as a business owner. Remember, reviewing your BCP regularly is crucial to its positive impact in that moment of need.

Kirstie Pickering - business journalist

Kirstie is a freelance journalist writing in the tech, startup and business spaces for publications including Sifted, TNW, UKTN, The Business Magazine and Maddyness UK. She also works closely with agencies such as CEW Communications to develop content for their startup and scaleup clients.