What should I be doing to protect my business?

Welcome to the Continuity Systems on-line Recovery Healthcheck.

It contains some guidance on how to approach the protection of your business from the numerous risks which threaten it.

It is in the form of a questionnaire which you can fill in, then print and keep to nudge your conscience or send to us and we will return an action plan to prioritise your recovery planning.

Some sobering facts:

70% of organisations experiencing a disaster cease trading within 18 months (Butler Cox survey)
35% of disasters cost over £250,000 (Price Waterhouse and BIS)
There are about 100,000 fires on business premises in the UK each year

What are the main causes of disasters?

Information from the database of disasters maintained by Survive

With so many risks what can I do?

Business Continuity Management aims to provide a strategy by which the organisation can appear (to the outside world) to continue to deliver its objectives despite the disruption from a serious incident. In practice this means that strategies must be chosen that permit resumption of time-critical tasks, possibly at an alternative location, within a timescale that has been defined as tolerable to all stakeholders, especially customers.

1. Understanding your business

Have you identified the time-criticality of each of your major business processes?

Done Partly done Not attempted

Have you understood the impact (costs and intangibles) of the non-delivery of each of these processes?

Done Partly done Not attempted

Have you documented the resource requirements of each of these processes?

Done Partly done Not attempted

2. Business Continuity Management Strategies that might be appropriate include...

Establishing a routine of regular back-ups of computer and other key data to be stored off-site

Done Partly done Not attempted

Identifing an alternative location for the rapid relocation of time-critical business functions

Done Partly done Not attempted

Agreeing a telephone redirection strategy with your telecomms supplier

Done Partly done Not attempted

Contracting for guaranteed access to alternative equipment such as computer hardware or production machinery should this be required

Done Partly done Not attempted

3. Do you have documented plans to cover the following.....

Evacuation and site emergencies - fire, bomb threats, utility failures etc.

Done Partly done Not attempted

Relocation and Business Resumption

Done Partly done Not attempted

Crisis Management and Media Management

Done Partly done Not attempted

4. Is the organisation aware of its Business Continuity Programme?

Have the members of the various teams received appropriate training?

All Some None

Are all staff aware of their roles and responsibilities in the event of an incident?

All Some None

5. Are the Business Continuity plans exercised and maintained?

Are all elements of the plan exercised at least one a year?

Done Partly done Not attempted

Is the plan maintained and audited at appropriate intervals?

Done Partly done Not attempted

6. Is Business Continuity effectively managed within the organisation?

Does the Executive take an active role in the promotion of Business Continuity?

Yes Some role None

Are there clear policies and objectives set for the Business Continuity programme?

Yes Some set None

More sobering facts:
Research by Rory Knight and Deborah Pretty on the effect of catastrophes on shareholder value showed that the organisation's perceived ability to deal with the crisis was the most important factor in determining whether a company was a 'Recoverer' - whose share price gained for months afterwards or a 'Non-Recoverer' whose share price dropped and kept dropping. There is no such thing as 'Business as Usual' after a major incident.

In addition to a major incident strategy you need to become aware of specific threats to your business and take sensible precautions to reduce the likelihood or impact of an interruption. The management of key risks is prudent and good practice but does not prevent serious incidents occurring - it just makes some of them less likely. Unfortunately there is no objective criteria to assist in balancing expenditure and effort between all these competing requirements and some risk reduction measures can reduce some risks whilst increasing others - a computer room was flooded because a retaining wall built to keep out rainwater prevented the water from a leaking cistern on the floor above running away from the building.

Risk minimisation measures include...

Checking the drains regularly

Yes No

Appreciating your staff and rewarding them suitably

Yes No

Identifying and contacting industries in the vicinity that use dangerous chemicals or are likely terrorist targets

Yes No

(One private bank thought that basement flooding was its biggest threat - but it was next to the Libyan Embassy and was denied access throughout the siege)

Conducting your business in a manner that minimises the likelihood of you being a target for protest

Yes No

Regularly updating virus software and patching known system vulnerabilities

Yes No

Controlling physical access to the site and especially to computer facilities

Yes No

Measures to mitigate the impact of an incident include....

Storing back-up data further than 5kms from the site

Yes No

Ensuring that time-critical functions are run on up-to-date equipment

Yes No

Having a rehearsed crisis management team on standby

Yes No

Having adequate Business Interruption insurance cover for 'increased cost of working' and 'data recovery'

Yes No

As you can see many of the measures are relatively cheap and are merely good housekeeping! You should also be aware that there is far more to business recovery than replacing computer systems ; You need to consider issues such as staff awareness, how to handle the media and what plans the Emergency Services or Local Authority might have for dealing with incidents in your vicinity - which could conflict with yours.

Thank you for completing this questionnaire - we hope it has raised your awareness of some of the issues raised by attempting to proof your business against the unexpected. If you have any questions on Business Continuity or comments on this list please enter them below and we will endeavour to respond to them.

In addition if you wish to submit your responses we will respond with a suggested, prioritised plan of action.

Questions on Business Recovery or comments on the questionnaire:

Your e-mail address
(You need to supply this if you would like a response. It will be not be passed to any third party.)

Your name and position

Company name

Company's main business

Company postal address

Telephone number & fax number

________________________________________________________________