Business continuity plans that get used when it matters

Disruptions come in many forms: a power failure, a software outage, a supplier that stops delivering, a building that cannot be used, a key person who is suddenly unavailable. A business continuity plan sets out how you keep essential services running or restore them quickly. Too many plans are long documents written for an auditor and forgotten. A useful plan is short, clear and rehearsed.

Start with what must keep running

List the services and activities that matter most to customers, to safety and to the survival of the business. For each, ask how long you could manage without it before the harm becomes serious, and what it depends on: people, premises, systems, data, suppliers and equipment. This analysis tells you where to put effort. Not everything needs the same level of protection.

Think in scenarios, not predictions

You cannot foresee every cause, but you can plan for the effects. Consider what you would do if a site were unavailable, if a major system were down, if a key supplier failed or if a large part of the team could not work. Plans built around effects apply to many different causes.

What a practical plan contains

• Roles and decision makers, with deputies, so that the plan does not depend on one person.
• Contact details for staff, suppliers, customers and emergency services, available even if your main systems are not.
• Recovery steps for each critical service, in order, written so that someone unfamiliar could follow them.
• Alternatives, such as backup locations, manual workarounds and secondary suppliers.
• Communication guidance: who tells staff, customers and the public what, and how.
• Data and system recovery, including where backups are kept and how restoring will be checked.

Pay attention to dependencies that are easy to overlook. Your own plan may be sound, but it may rely on a single internet provider, one payment service, a shared data center or a supplier that has no plan of its own. Ask your important partners about their arrangements, and note the points where one failure could stop several services at once. Reducing those single points of failure is often more valuable than writing more procedures.

Practice, then improve

A plan is only as good as its last test. Start with simple walk-throughs where the team talks through a scenario and notes gaps. Progress to exercises that involve real systems and contact lists. Afterward, record what went well, what confused people and what to change. Update the plan, and tell everyone about the updates.

Keep it current, and look after people

People change roles, suppliers change, systems are replaced. Review the plan on a fixed schedule and whenever something significant changes. Assign an owner whose job includes keeping it accurate, and make it simple to find, including offline copies for the moment when the network is the problem.

Disruptions are stressful. Think about how you will look after staff, communicate honestly and support those carrying extra load. Clear, calm leadership during a difficult day is remembered afterward.

Continuity planning does not remove risk, but it turns panic into a procedure. That is worth far more than a thick document nobody reads.