Planning for emergencies

If you manage or own a business, you need to plan for unexpected emergencies to minimise the likelihood or impact of any disruption to your business or organisation.

A robust, comprehensive and exercised Business Continuity Management Plan (BCM) greatly increases the chances of your business surviving a major incident.

Below is a step-by-step guide to planning for emergencies.

Business impact analysis

First you need to get to know your own business better.

• Look at how your processes and procedures work.
• Identify the critical functions and activities of the business – in an emergency you need to concentrate on the areas that MUST be done to continue the business.
• Understand the key resources for the business – the staff, premises, equipment, data, systems, suppliers and communications.

Hazard analysis

The second stage of the BCM process is to assess the risks and hazards to the business, and the likelihood of them happening.

Potential risks (which may not be solely affecting your business) could include:

• Data loss
• flooding or other severe weather
• transport problems or fuel shortage
• loss of power, heating,telephones or water supply
• civil disorder
• chemical spill
• terrorist action
• nearby incidents.

You should consider if these risks could affect your business. Then decide on one of the following actions:

• Remove the risk entirely, for example, by ceasing the activity or changing a business process
• reduce the risk by taking mitigating actions, for example, by ensuring that data is backed up
• accept the risk and plan accordingly.

Prepare a recovery strategy

Using the business impact analysis and the hazard analysis, you need to work out a recovery strategy.

You should consider:

• How do you identify the scale of the disruption to the critical activities of the business?
• What would trigger the start of your recovery plan?
• How you would maintain communications with your staff, customers, suppliers, regulators and investors?
• What resources would you need to recover the business? Where would these resources come from?

Write an action plan

You can now write a timetabled action plan for use in an emergency.

This should concentrate on the 'must do' rather than 'nice to do' activities. It should cover at least the following:

• The procedures for triggering the business continuity management plan. Who decides to use the BCM plan and in what circumstances? Ensure that there is a deputy for this role.
• The decision making process. Who makes the difficult decisions? Ensure that this process is clear and understood, and that there are nominated deputies.
• Communications procedures. Who should be contacted and by whom? Make sure that the plan includes a list of key contacts, including staff, suppliers, building firms (for repairs), and customers.
• A time-driven recovery process. When should specified processes be complete?
• Ensure that the plan shows:
  • how the business will continue to operate
  • which members of staff and external contractors will be required, and
  • what other resources (IT, premises, transport, etc) will be needed.
• Stand-down procedures – who will decide that a 'return to normal' is appropriate, and how will this be communicated to staff, customers and suppliers? There may be a need for staff to receive additional support following an emergency, so decide how to plan for this need. 

To help you, download an example of a plan from the right of this page, along with guidance notes.

You can also use our suggested starting list for an emergency pack. Such a pack should be stored away from the usual business or organisation premises.

In addition, you can download a site plan document from the menu on the right. This gives details of the location of key items on your business premises. It could be used by the London Fire Brigade to aid them in dealing with an incident on your premises, for example, the location of utility supply shut-off switches or hazardous materials.

Test your plan

An untested emergency plan is a recipe for disaster. It is important to test the plan regularly to ensure that it is still relevant and adequate.

You need to treat the plan as a living document, that changes with circumstances and the needs of the business.

There are a number of ways to do this, including:

• Reading through and reviewing the plan. Perhaps you could ask someone else to read the plan. Alternatively you could do a quick assessment of your current arrangements against our 10 Minute BCM Checklist available as a download from the right of this page.
• Desk-top walkthroughs: setting staff the task of reviewing the plan against a set scenario (for example, the reaction to a loss of an important piece of equipment).
• Staff awareness training: ensuring that everyone in the business knows their role should an emergency occurs. This could be combined with fire evacuation training.
• Component testing – checking a part of the plan to ensure that it works. For example, you could test the recovery of your IT and communications systems.
• 'Live' testing – a full recovery exercise.