How to Develop a Business Continuity Plan for Emergencies

An emergency plan helps keep people safe during an emergency. But what happens after everyone is safe and the emergency has been resolved? That’s where a Business Continuity Plan comes in.

A Business Continuity Plan explains how your business will continue operating, recover and return to normal after a major disruption such as a flood, bushfire, cyberattack, power outage or even loss of premises.

Your emergency plan and business continuity plan work together, but they serve different purposes.

What Is a Business Continuity Plan?

A Business Continuity Plan explains how a business will maintain, resume and recover its critical operations during and after an emergency.

It is different from other emergency plans:

• Emergency Response Plan: Focuses on keeping people safe during the immediate emergency, including evacuation and shelter-in-place.
• Business Continuity Plan: Focuses on keeping the wider business operating, including staff, suppliers, customers, facilities, finances and critical services.

These plans should work together, but a Business Continuity Plan needs to be developed separately.

A key part of the standard for a Business Continuity Plan is understanding:

• What parts of the business are critical
• What could disrupt them
• How long the business can operate without them
• What resources are required to recover
• How the plan will be tested and improved

Where WHS Fits In- WHS legislation requires workplaces to have an emergency plan, but it does not directly require every business to have a Business Continuity Plan.

However, WHS responsibilities still matter during recovery.

For example, reopening a workplace too quickly after a flood, fire or other disaster could create new safety risks.

A good BCP should therefore consider how the business will safely resume work, including staffing, facilities, equipment and systems.

How to Develop Your Business Continuity Plan

1. Get Leadership Involved

Business continuity planning needs support from management. Decide:

• What parts of the business the plan will cover
• Who is responsible for managing it
• What resources are available
• Who has authority to make important decisions during a disruption

2. Conduct a Business Impact Analysis

A Business Impact Analysis (BIA) helps identify what your business cannot afford to lose. Consider:

• Which activities are critical?
• What happens if they stop?
• How long can they be unavailable?
• What needs to be restored first?
• Which people, systems, suppliers and facilities are required?

Two important terms are:

• Maximum Tolerable Period of Disruption (MTPD): The longest period a critical activity can be unavailable before the impact becomes unacceptable.
• Recovery Time Objective (RTO): How quickly the activity needs to be restored.

3. Identify Your Risks

Consider the events that could disrupt your business. These may include:

• Floods
• Bushfires
• Cyclones
• Severe storms
• Cyberattacks
• Power or IT outages
• Loss of premises
• Supplier failures
• Loss of key employees
• Major workforce disruptions

Your risks should be based on your actual business and location rather than a generic template.

4. Develop Continuity Strategies

Once you know your critical activities and risks, decide how you will keep them operating. Strategies could include:

• Working from another location
• Working remotely
• Cloud-based systems and data backups
• Alternative suppliers
• Backup equipment
• Emergency contractors
• Cross-training staff
• Keeping important information in multiple locations

The goal is to avoid having a single point of failure that could stop the business.

5. Document Your Plan

Your BCP should be clear and easy to use. It should include:

• Roles and responsibilities
• Who activates the plan
• Who manages the response
• Communication procedures
• Recovery priorities
• Contact details
• Important suppliers and contractors
• Insurance information
• Financial arrangements
• Payroll arrangements
• IT and data recovery procedures

Keep it practical.A short, well-organised plan that people can actually use is more valuable than a huge document that nobody understands.

6. Train Your Staff

People need to understand their responsibilities before an emergency happens. Anyone with a role in the BCP should know:

• What their responsibilities are
• Who they report to
• How the plan is activated
• How to communicate during a disruption
• What they need to do to help the business recover

7. Test Your Plan

Test it using different scenarios, such as:

• Your workplace becomes unavailable
• Your IT systems go offline
• A key supplier cannot deliver
• Several key employees are unavailable

Testing can range from a simple discussion or tabletop exercise through to a full simulation. Record what worked, what didn’t and what needs to change.

8. Review and Improve

Your BCP should be treated as a living document. Review it regularly and whenever there are significant changes to your business, such as:

• Moving premises
• Introducing new technology
• Changing suppliers
• Restructuring
• Significant staffing changes
• Experiencing an emergency
• Identifying problems during an exercise

A plan that isn’t kept up to date may not work when you need it most.

Your Emergency Plan and BCP Work Together

Your emergency plan and Business Continuity Plan have different jobs.

Emergency Plan: Keeps people safe during the immediate emergency.

Business Continuity Plan: Helps keep the business operating and recover afterwards.

For example, during a flood, your emergency plan may tell workers when and how to evacuate. Once everyone is safe, your BCP can help answer questions such as:

• Where will we work?
• How will we contact customers?
• How will we access our data?
• What happens if our suppliers can’t deliver?
• How will we pay our employees?
• How will we safely reopen?

Be Prepared Before You Need It

Disruptions can happen with little warning. Having a Business Continuity Plan gives your organisation a clear process for responding, maintaining critical operations and recovering as quickly and safely as possible. Don’t wait for an emergency to discover what your business can’t operate without. Build, test and review your Business Continuity Plan now.