Business Continuity

Helping to keep your business in business

What is Business Continuity
Business Continuity Plans and Business Impact Analysis
Reviewing, Testing and Implementing Your Business Continuity Arrangements
Summary of how to develop Business Continuity arrangements
Questions and contact Emergency Management and Resilience Team
Useful websites

1. What is Business Continuity?

Business continuity is the ability of Surrey County Council to continue delivering its most critical services during and following a disruption and recover with as little downtime as possible. Disruptions can arise from a range of incidents including severe weather, cyber incidents, loss of staff, loss of buildings, infrastructure failures and other emergencies. Effective business continuity arrangements enable services to respond, recover and restore operations as quickly and safely as possible.

Business Continuity is “the capability of an organization to continue the delivery of products and services within acceptable time frames at a predefined capacity during a disruption.” ISO 22301

Why is Business Continuity important?

Effective Business Continuity planning helps to ensure during times of disruption your business or organisation continues to maintain their essential functions and supporting the prioritised recovery of your most time-sensitive objectives. Nearly one in five businesses suffers a major disruption every year. If you invest in insurance cover, it makes sense to invest in Business Continuity planning too.

2. Business Continuity Plans and Business Impact Analysis

What is a Business Impact Analysis (BIA)?

A Business Impact Analysis identifies a business or organisation’s critical activities, dependencies and minimum resource requirements. It helps determine the impact of disruption and identifies priorities and contingencies for recovery.

Once organisations have identified their critical activities, the organisation should identify the Recovery Time Objective (RTO) and the Maximum Tolerable Period of Disruption (MTPD). The RTO is the period of time following an incident within which a product or an activity must be resumed, or resources must be recovered. This time should be less than the MTPD. And the MTPD is the time it would take for adverse impacts, which might arise as a result of not performing an activity, to become unacceptable. You therefore want to recover it before this point.

Once you have carried out your Business Impact Analysis, you can start developing your Business Continuity Plan.

What is a Business Continuity Plan (BCP)?

A Business Continuity Plan documents how a business or organisation will respond to a disruption and continue delivering its critical activities. It captures response and recovery arrangements, alternative working methods, dependencies and contingency measures. It also establishes communication cascades for business or organisation and identifies roles and responsibilities during a response to a disruption. A good BCP should contain the following:

Document management information such as a document owner, version control or distribution list
Roles and responsibilities
How will the plan be activated – when, by whom and how?
Key contact details – internal and external
Critical functions / activities to be recovered, timescales and recovery levels needed
Resources available to deliver critical activities during the first 24hrs and up to 2 weeks from the event, and processes for mobilising resources
Actions to be carried out, in what timescale and who will do these
Clear communication processes – who reports to whom or cascades information
Process for standing down and returning to normal business.

What are Critical Activities?

Critical activities can be defined as those activities which need to be performed to deliver key products and services that enable a business to meet their most important and time-sensitive objectives.

Why might a business or organisation invoke its Business Continuity Plan?

A business or organisation may activate its BCP when an incident affects its ability to deliver normal operations. Examples include:

Widespread staff shortages or illness.
Significant industrial action.
Severe weather impacts.
Loss of a building or workplace.
Evacuation or access restrictions.
Prolonged Information Technology or communications outages, including loss of systems and cyber attack.
Power failures.
Fuel shortages.
Other major disruptions affecting service delivery.

3. Reviewing, testing and implementing your business continuity arrangements

Make sure you regularly review your business continuity arrangements and ensure staff are fully aware of their roles and responsibilities in an emergency. Testing and validation of the business continuity arrangements can be done in a variety of ways including:

Document reviews and walkthroughs
Desktop tabletop exercises
Scenario-based workshops
Functional and/or control room exercises

Consider your main risks and produce an exercise which can scale from minimal disruption, to moderate and significant disruption.

All plans should be reviewed whenever there are any major changes to premises, processes or services, or when a new threat emerges that threatens to disrupt your business activities.

Essential contact details should be tested regularly on at least a six-monthly basis.