There was a time when Business Continuity Planning (BCP) was called “Disaster Planning”, but that phrase has fallen into disuse because it has a negative connotation: no-one wants to plan for a disaster. That's just asking for trouble. What stakeholders do want, however, is for the business to be prepared to continue operations despite the obstacles it might encounter along the way. BCP is the process by which senior management prepares for the future and manages risk. The good news is that risk is manageable and a good BCP can help to insure a long life for your operation.

Recently there has been heightened interest in BCP as a consequence of the 9/11 terror attacks, the mailing of Anthrax-tainted letters and intelligence suggesting the likelihood of future attacks. While it is unlikely for most businesses that they will be the target of an act of terror, it is important to remember that the reason the World Trade Center was targeted is that one of the goals of terrorists is to disrupt our economy. One company, Cantor Fitzgerald, lost 658 employees on September 11th, and all told, 146,100 people in New York City lost their jobs immediately as a consequence of the attacks, and over 1.1 million people nationwide lost their jobs during the last four month of 2001 (New York Metro magazine, http://www.newyorkmetro.com/news/articles/wtc/1year/numbers.htm).

These figures show how widespread the consequences can be of catastrophic events. Even if you are not the direct victim of a disaster, you can still be impacted by it. You could lose suppliers or customers and this needs to be considered as well.

BCP is about managing risks. Risk is manageable and the more well-prepared we are, the better we can mitigate the effects of any kind of disaster. Planning also helps people to “keep their heads” when a disaster does occur and to not become immobilized with panic. There are a variety of free resources available to help you implement the planning process. An excellent resource for BCP is FEMA's Emergency Management Guide for Business & Industry which can be downloaded here: http://www.fema.gov/library/bizindex.shtm).

Perhaps the biggest problem with any kind of plan is that, once it is developed, it sits in a binder on a shelf. When the time comes to implement the plan, no-one is familiar with what to do, and much of the information in the document is out-of-date. The goal is to have an effective plan that can be implemented on a moment's notice. FEMA defines four stages of BCP, designed to help you meet these objectives:

1. Establish a planning team

The team should be assigned a leader who is an effective project manager who will see to it that all of the report is completed accurately and in a timely fashion. This person needs to be an authoritative person within the organization and be given the power to implement the plan. Be sure to establish a deadline for when the plan should be completed (it might take from 6 months to a year), and then provide a budget for the group. Having a budget signals a commitment to implement the recommendations of the planning team. Everyone needs to understand that the company is serious about the process.

2.Analyze capabilities and hazards

The second stage of BCP is to identify your current risks and their potential impact on your operation. The most critical item at this stage is to review your insurance coverage. The primary cause of business failure after a disaster is inadequate insurance. This is especially important now. Insurance premiums rose as much as 300% after 9/11 (New York Metro magazine, http://www.newyorkmetro.com/news/articles/wtc/1year/numbers.htm). This prompted Congress to pass the Terror Risk Insurance Act of 2002 (TRIA), which limited the kinds of exclusions insurers could state in their policies. All insurers have to offer terrorism insurance and finding out whether your company or organization has insurance and, if not, how much it will cost to get it is crucial. It is also important to understand that TRIA is up for renewal by Congress. This means that insurance coverage needs may be changing in the future.

3. Develop the plan

Once all of the risks have been identified, then the team must develop the specific plans for how to react to these different contingencies. The plan itself pulls all of this information together in great detail. It is import to have established very clear responsibilities and lists of tasks that need to be accomplished for a given emergency. Perhaps the two most critical elements of the plan are the plans for succession should senior management be incapacitated, and the plan for communication.

4. Implement the plan

There are two primary issues with respect to implementing the plan. The first is the importance of training throughout the organization. Training needs to be provided to all employees and a schedule of practice runs needs to be developed and implemented, much like your typical schedule of fire drills. A good tactic to use is a “table top” exercise where one person prepares a scenario and presents it to the group of people who are tasked to respond to the disaster. The group then talks through what their response would be, whom they would call, etc. The second issue of major importance is keeping the plan current. Phone numbers change all the time. It is important to establish a schedule for updating the plan. One recommendation is to include an update to the plan as part of the normal budgeting cycle which will insure that everyone updates their information accordingly.

BCP is an essential activity of all businesses. Creating a plan is not enough – you also have to keep the plan current and keep your employees abreast of what to do in the case of an emergency. Many companies have BCP's that sit on a shelf somewhere, gathering dust. But when a disaster strikes, it's too late to dust it off and hope for the best.