Business Continuity Management Services, often (wrongly) called Disaster Recovery

Business Impacts Analysis

The business impacts analysis will be done in conjunction with a company’s key personnel.
It will take into account events such as:

People, eg what happens if key people are ill?
Premises, eg fire
Technology, eg what happens if key equipment breaks down? What happens if the local phone system fails?
Supplies, including key external services, eg what happens if a key supplier is unable to supply?
Civil emergencies, including lack of accessibility to the site because of external factors such a major chemical spill on the industrial estate or accidents or flooding on access roads.

and will consider appropriate effects from the following list, taken from the guidance on BS 25999:

Loss of life or unacceptable threat to human safety;
Significant damage to or total loss of infrastructure;
Significant loss of revenue and/or funds;
Disruption of essential services to stakeholders (eg customers);
Loss of confidence;
Loss of vital records;
Disproportionate recovery costs;
Disruption of obligations to employees;
Loss of expertise

For the outcome of each event, we will assign a severity score and a likelihood score and combine these to derive a risk score, much in the same way as with a health and safety risk assessment, to determine which factors have the potential for the biggest impact.

Business Continuity Plan

The business continuity plan is based on the most significant risks from the impact analysis and defines steps to recover the situation. Just how far we go with each event in the plan, using the hierarchy below, depends on the risk; in some cases it may be sufficient to just carry out stage 1 for an event, in other cases it may be necessary to go as far as stage 4.

1. Define steps to be taken to recover a situation.

2. Carry out step 1, plus where appropriate, define provisions to make such steps work. For example, with IT systems, not only is a back-up necessary, but it may be advisable to have an off-site back-up.

3. Carry out the above steps, plus make contact with appropriate organisations to organise the support they can provide and define how this may be organised. For example, you may use another company to carry out operations which are unavailable because of the event. Contact this company and arrange how this may be arranged, ie contact names and numbers.

4. Carry out the above steps, and then carry out a test of the plan. This is typically essential where the provisions are technology-based. For example, you need to test IT back-ups to confirm that they actually work.

Strategic Safety Systems will work closely with you to develop a plan most suited to your organisation, including the test phase if desired.

In what format is the plan?

This depends on the company. In most cases, the plan is a Word document. In others, where the SSS INTACT integrated management system is in place, then the plan is one of the functions of INTACT

What do we end up with?

The final plan will be a list of all the perceived events and their impacts, along with details of the recovery steps, specifying where appropriate, contact names and phone numbers.

The final step – putting it all into place

One key step is to make sure that everyone knows what the plan is and where it is kept. It may be that this is a simple briefing, but in complex organisations, then a more involved training arrangement may be necessary.

Along with Strategic Safety Systems’ core philosophy of having arrangements that suit the organisation, we strongly advise that the plan is tailored to suit your situation and will work with you to achieve this.

Contact us for more details