Nov 17, 2011

What does one need to do to have a robust BCP (Business Continuity Plan) in effect?

What are the vital components of a good Business Continuity Plan? I need to be prepared and able to allow key business operations to continue in the event of something that makes normal operations impossible. It would be a financial disaster if we had to suspend operations for more than a day or so.

Hi rtrembley,

Here's a good background article that will give you the fundamentals of what's required. Check it out.

Business continuity planning

"Business continuity planning (BCP) “identifies [an] organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention and recovery for the organization, whilst maintaining competitive advantage and value system integrity”.[1] It is also called business continuity and resiliency planning (BCRP). A business continuity plan is a roadmap for continuing operations under adverse conditions (i.e. interruption from natural or man-made hazards). BCP is an ongoing state or methodology governing how business is conducted. In the US, governmental entities refer to the process as continuity of operations planning (COOP).

BCP is working out how to continue operations under adverse conditions such as include local events like building fires, theft, and vandalism, regional incidents like earthquakes and floods, and national incidents like pandemic illnesses. In fact, any event that could impact operations should be considered, such as supply chain interruption, loss of or damage to critical infrastructure (major machinery or computing/network resource). As such, risk management must be incorporated as part of BCP.

BCP may be a part of an organizational learning effort that helps reduce operational risk. Backup plan to run any business event uninterrupted is a part of business continuity plan. BCP for specified organization is to be implemented for the organizational level in large scale however backup plan at individual level is to be implemented at small unit scale. Organizational management team is accountable for large scale BCP for any particular firm while respective individual management team is accountable for their BCP at small unit scale. This process may be integrated with improving security and corporate reputation risk management practices."


You need to have redundant systems for those things that are really critical for you to continue operations, at least in a limited capacity for a short period.  I suggest a two step analysis to determine your needs for a continuity plan.  First, identify which of your business processes are actually vital to your company's survival.  Second, determine how long you want to be able to function at a minimum level to maintain continued operation of your key business process and require redundancy.   This may not be an easy determination, because you have to balance risk and cost to come to the right decision for you.  Lastly, ask yourself, what are the components necessary for this minimum level of continued operation.


I would suggest that the basic plan would require:

A secondary business location (which could be a branch office separate from your primary facility) 

Computers, with the software (and backed up data, of course) critical to core functions.

Phones.  You have to talk to customers, suppliers, employees, etc.

Paper copies of important files.  We are not yet in a paper free world, and a few file cabinets of important documents like billing files and invoices can make life easier.


Answer this