Business continuity planning

What is Business Continuity Management?

Business Continuity Management (BCM) is about preparing your organization to respond to potential threats of business disruption. It can also help create resilience to withstand negative impacts and continue operations when a disruption occurs. It’s about protecting your business and the stakeholders who rely on it – the customers who purchase your products or services, the owners and shareholders with a financial stake in the success of the company and the employees who make their livelihood serving your business and its customers.

The primary goals of planning are:

1. Maintain a minimum level of operations during disruption
2. Reduce recovery time

Having a business continuity program in place, along with associated contingency plans, is key to helping an organization achieve these goals.

Disaster recovery, crisis response, emergency response and incident response

The terminology used by business continuity professionals can be confusing. For example, the term disaster recovery may be used to describe business continuity, but its typically reserved to reference strategic plans for recovery and resumption of only critical information technology (IT) and telecommunications assets during a disaster.

Crisis response, emergency response and incident response are terms that refer to the immediate actions taken during an incident to preserve life, prevent injury and prevent further damage to property.

Contingency planning (or plans) refers to specific tactics or actions taken during a disruption. Each of these are among the elements included in a broader overall business continuity management plan.

The International Standards Organization (ISO), in May of 2012, published the first edition standard ISO 22301, Societal security – Business continuity management systems – Requirements. This document serves as a consensus standard specifying the requirements for setting up and managing an effective Business Continuity Management System (BCMS).

In summary, a Business Continuity Management System (BCMS) can be considered a suite of documented policies, organizational structure, analyses, assessments, plans, procedures and responsibilities to help ensure an organization does not experience an unacceptable interruption in the event of a disruption to its business operations.

At the core of Business Continuity Management (BCM) are four main elements:

1. Crisis response and communications
2. Risk management
3. IT disaster recovery
4. Business contingency or resumption planning and recovery

Is your business prepared for an unexpected disruption or disaster?

The risk of disruptive incidents to businesses and organizations is increasing. Recent increases in frequency and severity of weather-related disasters, rains associated with landslides and flooding, severe windstorms, and even drought conditions that can lead to increased exposure to wildfires.

Additional disruption examples include:

• Manufacturers relying on just-in-time supplies and inventory
• Suppliers with an increased risk of supply chain disruptions
• Livestock producers face increased risk for disease outbreaks that can wipe out poultry, swine or other animals
• Computer hackers create increased risk of security breach and denial-of-service (DNS) attacks
• Food manufacturers and retail restaurants face the risk of food contamination and associated customer illness, often leading to bad publicity and risks to their reputation.

How vulnerable is your business to threats of disruption? How safe are your resources? What is your tolerance for downtime?

These are all things to consider when developing a business continuity plan. Identifying key operations and dependencies, completing a business impact analysis (BIA) and conducting a risk assessment are some of the components of business continuity planning that will help you answer these questions. The results can help guide your determination for appropriate risk management techniques to employ and the specific business contingency plans to develop as a part of your overall business continuity management plan.

What keeps many businesses from developing and implementing a continuity plan?

Many business leaders and managers are aware of the concept of business continuity and the importance to their organizations. In many cases they consider potential incidents that could disrupt business and the possible actions to take in response. However, few small to medium-sized companies have formally analyzed their risk or developed business continuity plans. Why?

One reason may be that major interruption of business is relatively infrequent. This may lead to a sense of apathy about the probability of an incident impacting business operations and reduces the significance.

Another reason is the belief that disruptions can be addressed at point of impact, therefore rendering the effort and resources to develop and implement a business continuity plan low priority. The result? Many businesses will find themselves unprepared in the event of a major disruption.

Furthermore, many businesses rely on business income insurance coverage to indemnify and compensate for lost income due to interruptions of their operations. While this is one effective risk management strategy, this coverage is normally limited and tied to direct physical damage or loss to covered property due to a covered peril. Many potential threats (or perils) that can lead to a disruption of your business are not covered by your property policy. And perhaps most importantly, it will not cover the potential permanent loss of customers. Where will your customers go if your business cannot provide its products or service following a loss? Will they return?

And finally, developing a formal business continuity plan may not be a top management priority or commitment because of lack of time, budget or funding. But when you consider the risks of loss and the potential impacts to your business from a disruption, can you afford NOT to plan for business continuity?

Make Business Continuity Management part of your corporate risk management program

Nationwide encourages all businesses to make Business Continuity Management (BCM) a part of their company’s overall corporate risk management program. To help you get started, we've developed Business Contingency Planning – A Seven-Step Guide to help develop business contingency plans to address potential risks that could impact your businesses.