B-ReadyNow is a service offering developed by the Canadian Centre for Emergency Preparedness (www.ccep.ca), a non-profit organisation whose main mandate is to build more resilient communities.
The CCEP has done research and provided services in the areas of business continuity, emergency management, critical infrastructure protection and other crisis management fields since 1993.
Through such research and by the experience of our network’s experts, they had determined a few things:
- 2 of the main pillars of any community are the small business sector and non-profit organisations
- By and large these two sectors receive the least support from government and industry compared with their huge contribution to the economy and society
- Ther realised that not only are there few targeted programs available, there was very little ‘appetite’ to conduct traditional business continuity / crisis management programs due to lack of time, money and expertise.
- After many years of ‘selling’ business continuity to main stream business (with little success), they opted to change the delivery model: a few steps, simple language, low cost.
- They hope this will entice many small businesses & non-profits to build plans where they would have before.
Do you have any real-world stories of how businesses succeeded or failed in preparing themselves from disruption?
Unfortunately, most of the stories are of failure.
One of the most poignant stories for me is a fire that occurred in a city close to ours, Waterloo, Canada – personal for me because it is my university town, and the fire occurred next door at a place I used to frequent:
A fire Thursday morning destroyed several businesses in a Waterloo plaza.
Businesses affected by the blaze at the Campus Court plaza, 140 University Ave. W., include Mel’s Diner, Tabu, Mr. Sushi, University Vision Centre, Sugar Mountain and Caesar Martini’s.
“This is the saddest day of my life,” said Benny Afrouzi, owner of University Vision Centre. “That’s 22 years of work there.”
Owners of the stores were called shortly after the blaze broke out around 5:30 a.m. They stood crying and hugging each other as firefighters tried to save their businesses.
Afrouzi said he employed seven people at the business, who are now out of their jobs. They’ve had about 40,000 patients “that we’ve looked after all these years,” he said. All of the patient charts are now destroyed, he said.
“We’re just asking our patients to be patient,” Afrouzi said, “until we find a solution to this disaster.”
Notwithstanding the trauma of fire, how could this have turned out better for Mr. Afrouzi if his records were electronic, back up and taken home every night? Also note through the news stories the secondary impacts: lost student jobs, traffic chaos, evacuations, lost business.
What is Business Disruption Contingency Plan, and how does it differ from other forms of disaster planning?
We coined the term Business Disruption Planning to personalize business continuity / continuity of operations planning for the ‘uninitiated’ owner / operator. As a former emergency manager, I have found that attention to the BIG events such as Katrina & 911 turns people off. Sure it’s exciting from a rubbernecking point of view, but “it will never happen to me”, or if it does “we’re all toast anyway”. Either that or the thought of having to plan for such an event is too overwhelming to contemplate.
We see the same sort of effect impeding the uptake for 72 hr / home preparedness kits… do you have one?
We know it is far more likely to experience a water main break flood, localized power outage or sustained snowstorm (up here anyway) – any of these could severely impact your business, especially if you are not prepared.
We are most interested in building resilience within a business to lessen the impact from disruptions. Hence the name.
What are the steps involved in putting together a business disruption contingency plan?
In a nutshell:
Step 1: Know Your Risks
Here you discover and document what threatens your business. What are the core problems that could severely impact your business, stop production, halt sales? The first three tasks walk through as risk assessment process to produce your operations’ risk profile (Risk Assessment / Analysis).
- Identify Your Risks (check list of business impact risks)
- Possible Causes and Impact (how can they happen?)
- Determine Your Vulnerability (rank the likelihood)
Product: Your Risk Profile
Step 2: Know the Impacts
What would happen if the threats from Step 1 actually occur? What would the impact to your business be? This step involves examining your operations to pinpoint what the keys to your business are and how long you can survive without them. (Business Impact Analysis)
- Key Products, Services, and Processes (what’s important to your business?)
- Critical Inputs and Downtime (what makes those go, how long can they be down)
Product: Your Recovery Priorities
Step 3: Develop Strategies
What can be done? You may be able to prevent an event or lessen its impact by taking proactive measures. And if a disruption occurs, you should have a plan for responding to the crisis. Take this step to develop protection measures.
- Define Prevention Strategies (“mitigation” strategies)
- Define Prevention Tasks (details, timings, completion)
- Define Response Strategies (if something did happen…)
Product: Strategy Outline (“To Do” List of mitigation tasks)
Step 4: Create Communications Lists
Proper communications, at the best of times is an important function. During a disruption, the ability to contact staff, suppliers and clients is vital to an efficient response. This step creates the contact list tool for your response.
Create Contact Lists (employee, supplier / contractor, client)
Product: Print Your Contact Lists
Step 5: Action Plan
Having response strategies is crucial, but do you know who is doing what and what their priorities are? This step helps you build the best way for you to organise your response.
- Define Major Tasks (Response strategy details as in 3B)
- Assign Your Response Team (put people from your employee list into response teams & assign tasks from 5A)
Product: Print Your Action Plan
Step 6: Review
A plan is a living document. Operations change, the plan changes. People change, the contact lists change. Through experience, the response changes. This step allows you to set review periods for important plan components and coaches you on how to learn from tests and disruptions.
- Exercise and Review (create a plan & log of testing (exercises), set review cycles)
How do business disruption contingency plans differ from large, medium and small companies?
The concepts and basic planning process are virtually the same no matter the size of company. What differs dramatically is the time, support and resources available to commit to the project and the amount of data required to fully analyze, assess and make sense of. This translates to greater complexity of strategies and a higher level of detailed analyses for the increase in size of business. There is a caveat here, that the bigger the company, the greater the expectation that more formal standards or processes are used, such as those found with DRII or the BCI. You will see more ‘management’ cycle processes involved such as executive support, change management and thorough documentation and reporting.
As well, regardless of size, businesses within certain sectors may have a legal or industry requirements for business continuity planning: finance, insurance, telecommunications, etc.
What are some of the leading ways that companies get sunk by an unexpected disruption?
Loss of power (and no back up), loss of premises (and nowhere to go), no succession plan or loss of ‘irreplaceable employee’ (braintrust), loss of critical supplies / supplier, loss of computer equipment (theft) or data (crash!), competition…. Note that the event does not matter – the impact does. Plan for power loss (however caused), not a blown transformer, tree branch down in Indiana, lightning strike, etc…
How can a company evaluate their readiness for an unexpected disruption?
Testing and exercising. Test procedures and exercise a response plan. This can be done by talking through plausible scenarios in the board room or actually role playing through a simulated event. Was everything that was needed available? Did everyone get notified and respond as per the plan? Did it happen as quickly as hoped or required? Did everyone know what they should be doing, where they should be and who they report to?
What is the most often neglected part of corporate disaster protection plans?
Well, I have no trusted survey results – but we have a saying in the EM field “the first thing to fail in any emergency is communications”. The first line of this defence is the contact list. Is it up to date? Is every necessary contact included? Can it be accessed quickly in all cases? That’s the official line (and it’s true!).
Most neglected from another standpoint is attention to employee needs. Not just having EAPs (employee assistance programs); insurance and a first aid kit, but recognition that in any big emergency an employee will think of their family first, not their job.
In extraordinary circumstances, is the safety of the employee paramount?
Are there tasks above and beyond regular duties that an employee may have to do – have they been trained / certified? Have they the right of refusal?
Is there a Collective Bargaining Agreement to be considered? These are issued BEST worked out WAY before something happens.
Anything else you’d like to add?
We do not see ourselves as competition to the business continuity industry, in fact we feel we compliment what currently exists. With this simplified (and ‘cost effective’) process, we believe we are opening the industry to a massive number of entrants into the process who would not have considered it before.
We know we are the simplest of contingency planning processes, we know (and hope) that as clients become more sophisticated in their planning they will move on to the next level of detail. We’re ok with that. Small businesses and non-profits comprise the vast majority of organisations within an economy, we just want to get a bunch of them started.