7 Steps for a SMB Business Continuity Plan

The COVID-19 crisis has brought the issue of "business continuity"--management-speak for keeping things going--front and center in the minds of many business owners, be they corporate CEOs or proprietors of a 10-person enterprise. While the particulars of this pandemic are unprecedented, they underscore the importance of developing a comprehensive business continuity plan.

What Is a Business Continuity Plan?

A business continuity plan is the playbook you get out when any outside force or event seriously disrupts normal business operations--like the coronavirus has. It can be your anchor in a whirlwind of chaos and unpredictability. Of course, given the variety of disasters that can occur, your strategy to a business-disrupting event can never cover all contingencies. But you can document your process for making decisions during a crisis, who'll be responsible for making them, and the areas you'll need to address. That's the essence of business continuity planning.

The 7 Steps of Business Continuity Planning

1. Establish Your Business Continuity Management Team. Naming your business continuity management team in advance ensures you'll have the knowledge at hand to address every phase of your business when disaster strikes. Your team should comprise a group of trusted managers or advisors who can speak to the various competencies within your company. Their input will help you set goals, implement strategies, coordinate company-wide training and awareness, and identify ways to continuously improve and adapt your plan to changing conditions.
2. Prepare Backup Business Infrastructure. Infrastructure includes both a backup physical location--if one is essential for your business--and backup for business process. Business process infrastructure encompasses information technology--this element is sometimes called a Disaster Recovery Plan--and human-driven processes. As far as the IT goes: As most organizations these days have computerized business processes, it would make a lot of sense to consider cloud-based storage for either a backup of on-premises systems or as your primary IT infrastructure.Examples of human-driven processes would be sales calls made by staffers, customer service call centers, and actual production or shipping that's performed by actual people. To enable these business processes during a time of crisis, it might require a combination of a backup physical location and/or work-from-home capabilities.
3. Perform a Business Impact Analysis (BIA): Your BIA should be the focus of your first "all-hands" meeting after a disrupting event happens or is confirmed will happen (like the institution of shelter-in-place mandates this past March). The purpose of a BIA is to identify the impact of the disrupting event and/or loss of business functionality. A BIA should be comprehensive enough to address the consequences of disruption for each department. Topics to consider should include: lost sales and income, increased expenses (e.g., overtime labor, outsourcing, expediting costs, etc.), delayed sales or income, regulatory fines, contractual penalties or loss of contractual bonuses, delay of new business plans, and customer dissatisfaction. FEMA provides a BIA worksheet to help gather information from managers and others within your organization. It's important to be as granular as possible at this stage because small details can have a huge impact on the actions you take to get up and running again.
4. Perform a Gap Analysis. Your BIA should have identified and documented the impacts of a disrupting event. Next, comes the "reality check" or gap analysis. Following a business disrupting event, it's likely there will be factors or consequences you couldn't have foreseen. That's OK. A gap analysis will help highlight discrepancies between the resources you have and those you still need to establish business continuity. Your goal should be to understand your options and develop strategies and action plans you need to recover. After your gap analysis is concluded, you'll be ready to explore and implement recovery strategies.
5. Take Action on Recovery. The previous steps of your business continuity plan dealt with planning, information gathering, and strategizing. After you've prepared as much as possible and properly assessed your situation, it's time to take action. Making the right moves here is critical to bouncing back and minimizing the damage. Focus on doing what you can to function as a business and meet demand for products and services--whatever it takes to continue being a viable money-making operation. During this pandemic, for example, many companies have pivoted to making PPE products or ramped up their e-commerce operations.
6. Always Be Testing and Improving Your Business Continuity Plan. For a business continuity plan to remain viable, you can't just "set it and forget it." Everything about a business is constantly evolving over time: your people, products, markets, etc. That's why a business continuity plan is never "finished." Depending on the size of your operation and how fast things change, you'll want to define a set process and time interval for updating your business continuity plan. As part of these activities, you'll also want to stress-test it--run a drill to see how well it might work.
7. Formalize Your Readiness by Certifying to ISO 22301. ISO 22301 is a set of guidelines for business continuity management planning. Set by the International Organization for Standardization (ISO), 22301 prescribes a formal framework and specific requirements for business continuity. An outside certification body needs to approve your plan. While this may be an optional step for many organizations, those with high-stakes relationships with partners, vendors, regulatory authorities, governments, and other stakeholders will certify to ISO 22301 to build trust and demonstrate preparedness as a condition for their relationships. Over 4,000 organizations from a diverse set of industries all over the world maintain certifications to ISO 22301.

Whether the world returns to "normal" or a "new normal" post-COVID-19, your business continuity plan ensures you'll still have a place in it.