The COVID-19 crisis caught organizations around the world by surprise and left companies scrambling to figure out how to keep their operations running while simultaneously supporting an entirely remote workforce and new business processes. A recent Business Continuity Survey by industry research firm Gartner showed that only 12% of organizations felt highly prepared for the impact of coronavirus. “This lack of confidence shows that many organizations approach risk management in an outdated and ineffective manner,” said Matt Shinkman, vice president in the Gartner Risk and Audit practice. “The best-prepared organizations will manage the disruption caused by the coronavirus far better than their less-prepared peers.”

Catastrophic events like the coronavirus pandemic are impossible to predict, so your organization must be prepared with a business continuity plan in advance. Not only does a business continuity plan help mitigate risks in a catastrophic event, but it also protects your employees and assets, ensuring that your business recovers as quickly as possible. Being ill-prepared for a crisis can be extremely costly to a company. Gartner estimates, on average, businesses lose $5,600 every minute during downtime, which equates to a range of $140,000–$540,000 per hour. In this blog, we explain the rationale for having a current and tested business continuity plan and provide tips for creating a business continuity program that protects your company in the event of a crisis.

What Is a Business Continuity Plan?

A business continuity plan (BCP) is a document that outlines procedures for maintaining operations, or quickly resuming operations, during an unplanned disruption, disaster or crisis. A BCP typically identifies key emergency responders and contains detailed instructions an organization must follow in the event of significant disruption.

Why You Need a Plan: 5 Types of Crises Your Business Could Face

A crisis can be any unforeseen occurrence that causes an unstable and dangerous situation for a company. Sooner or later, no matter the size or industry, all organizations will encounter some sort of crisis. Below are the five most common types of crises a business could face.

1. Financial crisis

A financial crisis occurs when a business loses value in its assets and the company owes significantly more money than it can reasonably pay. Typically, this occurs when there is a sudden shift in the market or a dramatic drop in demand for the company’s product or service. For example, a competitor that comes out with a similar but superior product with a cheaper base cost could cause the demand for your product to significantly drop, resulting in a considerable financial loss for your company. Financial crises directly result in a loss of value for a company and can undermine company confidence among employees, investors and customers.

2. System outages or downtime

Information technology (IT), as well as essential business applications and systems, are critical to day-to-day operations and keeping businesses running smoothly. Technological failures, cyberattacks, outages or security breaches can greatly hinder or completely shut down a company’s operations, resulting in enormous losses for the organization. Frequent news stories about data breaches illustrate how this type of risk is a growing concern for enterprise companies. IT outages and breaches can also result in a major hit to the product’s or service’s reputation.

3. Unplanned loss of key personnel

A personnel crisis occurs when an employee or a key individual who’s associated with an organization abruptly leaves the company due to health, misconduct or other unforeseen circumstances. The unplanned loss of key employees, particularly those in leadership roles, often has a lasting and negative impact on business performance. Additionally, if the employee’s departure is due to misconduct, the company may experience backlash and reputational damage if the offense is perceived as a reflection of the company’s culture. Social media has amplified the speed and scope of negative publicity from personnel misconduct.

4. Organizational misdeeds

An organizational misdeed occurs when a company’s management willingly and knowingly behaves in a manner that results in negative consequences for its shareholders, employees or customers. This type of crisis may include a company withholding vital information, exploiting employees, adopting misleading policies, abusing managerial powers or misrepresenting the company’s products or services. An automobile manufacturer that sells their latest model car with faulty brakes is an example of a company committing an organizational misdeed. Whether this misdeed was unintentional or planned, public knowledge of the misdeed will almost certainly result in reputational or financial damage for the company.

5. Natural disasters

A natural disaster is any cataclysmic phenomenon that negatively impacts a company, such as a volcano, an earthquake, flooding, a hurricane, a tornado, or an outbreak of a virus. Damages caused by these calamities are typically large in scale and may affect an entire area or industry or even the global economy. The recent COVID-19 pandemic is an example of a natural disaster that negatively affected economies, employees, and organizations around the world.

How to Write a Business Continuity Plan in 5 Steps

Creating a business continuity plan helps protect your assets and personnel and gives you the best chance of successfully navigating an unanticipated crisis. While no one is able to predict when and how devastating events will negatively impact their business, crisis management, is important as it helps you prepare for them in advance.

To begin brainstorming and drafting your business continuity plan, form a team composed of staff with in-depth knowledge of your business functions and processes. It’s especially important to include cross-functional representatives spanning IT, Human Resources and finance to determine what strategies and plans are viable.

For those who haven’t yet created a business continuity plan, you can follow the step-by-step instructions below. You may also want to use a business continuity plan template to help guide you in the drafting process.

Step 1: Conduct a business impact analysis

The first step in developing an organization-wide business continuity plan is conducting a business impact analysis and risk assessment exercise. The initial review will identify threats to your organization and determine how each crisis will impact your business. Try to come up with an exhaustive list that includes obvious risks — like physical damage to your building due to extreme weather or a sudden shift in the market — as well as obscure threats, like an outbreak of a contagious virus. When determining operational time lost or delays due to a disaster or crisis, it’s important to account for the best- and worst-case scenarios. Once completed, you will want to quantify the financial impact each event could potentially have on your business so you can plan accordingly.

Step 2: Discuss recovery options

Your team should now discuss strategies for recovering from a crisis and the best way to restore business operations for each scenario. Include the required resources needed to execute an emergency response, each recovery option and how those resources should function. For damage to your physical buildings or to reduce the spread of a virus, implement a tech stack and IT strategy that can support a remote workforce and keep your operations running outside the office.

Additionally, many third-party companies support business continuity and information technology recovery strategies for critical business functions. For IT outages and breaches, you may consider contracting a vendor specializing in data loss prevention services in advance. Depending upon the size of your organization and available resources, there may be many different recovery options that can be explored for each event.

Step 3: Refine your continuity plan

Now it’s time to map each crisis scenario with your recovery plans to narrow down the list to the best options. Decide which strategies will help your business recover as quickly as possible while keeping your employees and assets safe. While you’ll want to have plans for best- and worst-case scenarios, it’s essential to simplify the plans with easy-to-understand instructions. Remember, emergency responders and employees may need to implement these plans with just a moment’s notice when disaster strikes.

Step 4: Train your team

A great plan is only as good as its execution. That’s why it’s crucial that you educate and train your staff on how to respond to crises. First, identify key personnel who will be the first to assist and follow the business continuity plan in the event of an emergency. These employees should know their specific responsibilities and roles in the plan. While your designated emergency responders will need the most training, you should get your whole staff involved with the BCP, even if they are not directly affected. Embed continuity training into your company culture so all employees know how to respond to various scenarios and whom they should contact in an emergency.

Discussing the need for a business continuity culture, MHA Consulting’s Richard Long writes, “When an organization has a continuity culture, its employees constantly ask themselves the question: How do we ensure that this process, application or function will remain available (even in a degraded state) in case of a disaster?”

Step 5: Map out the transitional phase

Finally, map out the transitional phase to ease back into normal operations and work postcrisis. Determine what requirements need to be met before business operations can resume. If your physical building was damaged, what steps need to be completed before employees can safely return to the office? If a key individual who’s associated with your organization abruptly leaves due to misconduct, how will you communicate this with your employees and help them transition back into a normal workflow? The effects of some events may be extremely personal for your staff and extend far beyond the initial shock. It’s important to plan out different scenarios of how and when business operations can return to normal after a crisis.

Business Continuity Plan in the COVID-19 Era

The COVID-19 pandemic presents a serious threat to individuals, businesses and entire economies around the world. Many companies implemented mandatory work-from-home policies for their entire workforces to slow the spread of the virus. With the ongoing uncertainty surrounding coronavirus, organizations are now faced with a new challenge: how and when to return employees to the workplace safely. While your initial focus may be getting your employees back in the office, you must keep your employees’ safety, comfort and well-being in mind. Here are our five recommendations for business continuity management planning in the COVID-19 era.

1. Work toward a work-from-home + office hybrid model

Not all employees will be ready to return to the office after COVID-19 is suppressed. Some will need to continue to work from home for medical or personal reasons and therefore needs to be accounted for in your planning process. Other employees will be ready and eager to return to office life full-time or may want to continue to work remotely but commute into the office a few days every week. Consider instituting a hybrid work model with some employees working from the office and others working from home on either a permanent or rotating basis. This gives your staff the flexibility to work from wherever they are most comfortable and keeps everyone productive and engaged during this transitional phase. Decide what the business recovery point objective is and decide what works best for your team members; fully remote, hybrid work model, or the traditional office setting.

2. Build a tech stack that supports remote work

To support a distributed workforce made up of remote and in-office employees, you must invest in tools that enable seamless work and collaboration regardless of your employees’ locations. Cloud-based technology allows employees to effectively work from anywhere they can connect to the internet. Productivity and collaboration no longer happen at a single office location. Delivered via the cloud, video conferencing, messaging apps and project management tools make it easier than ever before for distributed team members to meet, share ideas and seamlessly work together, even if they are not physically together.

3. Create a video-first culture

Employee satisfaction and happiness go hand in hand with a collaborative and inclusive culture. This is especially important when transitioning into a hybrid work model made up of remote and in-office workers. Remote employees should feel just as informed and included as their in-office colleagues. Create a video-first culture that places a priority on using video conferencing tools for all team meetings, as opposed to audio-only conference calls or text-based tools. The face-to-face interactions help teams with remote workers stay engaged during meetings and build collaborative and authentic relationships.

4. Reduce coronavirus transmission in the office

The best way to stop the spread of the virus in the workplace is to keep the germs out of the office in the first place. This starts with educating your workforce on the signs and symptoms of COVID-19 and encouraging employees to stay home if they feel sick. Additionally, employees should follow CDC guidelines for social distancing in the office and practice good hygiene by thoroughly washing their hands throughout the day. Workstations will need to be properly spaced apart and thoroughly disinfected and cleaned every day to reduce the spread of the virus.

5. Create a contingency strategy

Your business continuity plan for returning to work post-COVID-19 should include a contingency strategy in case there is an outbreak of the virus in the office. The key to a solid contingency strategy that quickly stops the spread of the virus is preparation and communication. Reach out to your staff immediately if an employee tests positive for the virus or comes into contact with an infected person. Employees should be able to start working remotely with short notice. This means employees will need to take their laptops and work home with them on a daily basis.

Conclusion

We rarely get advance notice that a catastrophic event is about to occur. Even with some lead time, multiple things can go wrong as the events unfold in unexpected ways. An effective business continuity plan is the best safety net for an organization facing a crisis. Even though costs and time are involved in creating the plan, a BCP is invaluable to your company. Well-thought-out and executed plans give your company the best chance of keeping your employees and assets safe while maintaining or restoring operations in a timely matter during a crisis.