Segment 5 : Business Investment Strategies, Continuity

Plan and Role of Creativity and Innovation

in Business

Topic 2 : Business Continuity Plan

Business Continuity Plan

Table of Contents:
2.1 Introduction
Learning Objectives
2.2 Concept of Business Continuity Plan
Features of Business Continuity Plan
Relevance and Importance of Business Continuity Plan
Steps in Business Continuity Plan
2.3 Process of Developing Business Continuity Plan
2.4 Business Continuity Plan and its Influences on Strategic Management
2.5 Business Continuity Plan and its Influences on Policy Making
2.6 Contingency Planning
Process of Creating a Business Contingency Plan
2.7 Summary
2.8 Glossary
2.9 Case Study

Page No. 1
Business Continuity Plan

2.1 Introduction
This topic aims to help you understand the Business Continuity Plan (BCP)
and its related concepts. BCP is a strategy or business plan which provides
a system for the prevention, recovery and continuity of business and its
products and services from potential damage to an organisation during a
crisis. This plan ensures that the employees working in the organisation, and
other assets of the organisation, are protected and can work in the event of
an emergency or crisis.
This chapter will start with the BCP and its significance. The BCP involves
demonstrating all the risks that can affect the operations of an organisation
and including the organisation's risk management strategy. The risks and
threats of an organisation are identified and analysed, and how these can
affect the operations of the organisation. A BCP is a significant part of every
business as it helps and assists businesses to continue operations even in
time of crisis. Threats and disruptions in an organisation's workings can lead
to revenue loss or increase operational costs, which can reduce profits and
lead to a complete loss of business and customers. Note that insurance alone
cannot help an organisation recover damages or costs at the time of a
disaster.
In this topic, you will learn about the BCP's influences on strategic
management, policymaking, contingency planning, and its processes.
This topic will also discuss Business Impact Analysis, which is the process of
determining major functions of the organisation that impact the business—the
strategies required for a business to recover from emergencies.
Learning Objectives
After studying this chapter, you will be able to:
• Explain the significance of a Business Continuity Plan for an organisation
• Describe the process of Business Contingency Plan
• Describe the Business Impact Analysis and its process
• Restate the influence of the Business Continuity Plan on strategic
management and business policy

2.2 Concept of Business Continuity Plan

Page No. 2
Business Continuity Plan

A Business Continuity Plan, or BCP, is a process that an organisation adopts

to continue business, prevent damage, and recover from potential threats that
can disrupt operations. The BCP is a part of disaster management. It aims to
ensure to protect the human resources and other assets of an organisation
and is able to function in crisis as well. It describes how the business will
continue to operate during an unplanned and unexpected service disruption.
It is more detailed and constructive compared to a disaster recovery plan. It
contains those business processes that may affect assets, staff, and business
partners.
The BCP develops responsive policies to ensure that the business is able to
recover quickly after a disaster. The main purpose of the BCP is to protect
people, assets, and property, or we can say the four M's--Man, Machine,
Material and Money. It also helps to protect asset damage, financial damage,
and loss of life following an emergency. It manages and maintains a system
of protection and recovery from potential threats to an organisation. That
workers and property are safe and able to work quickly in the event of a
disaster. BCP is often conceived proactively and includes inputs for key
stakeholders and staff. It includes all possible risks that may affect a
company's operations, making it an integral part of the organisation's risk
management strategy. Risks can include natural disasters -- fires, floods, or
weather-related events and cyber-attacks. Once the risks have been
identified, the plan should include:
• Determining how those risks will affect performance
• Implement prevention and risk reduction procedures
• Test procedures to ensure their effectiveness
• Review the process to ensure it is up to date

2.2.1 Components of A Business Continuity Plan

The key components of a business continuity plan are:
• Strategy: Issues related to the strategies used by the business to
complete day-to-day operations, while ensuring continuity in operations.

• Organisation: Concerns related to the structure, skills, communication,

and responsibilities of its employees.

Page No. 3
Business Continuity Plan

• Apps and Data: Software-related features required to enable business

operations, as well as, how to provide maximum availability for use of such
software.

• Procedures: Critical business processes are required to run a business,

and the IT processes are used to ensure efficiency.

• Technology: Equipment, network, and industry-specific technologies

needed to enable the continuous operation and backup of applications
and data.
• Resources: Provision of a disaster recovery facility if the main site is
destroyed.

2.2.2 Relevance and Importance of a Business Continuity Plan

The importance of a BCP can be described as follows:
Better Preparedness: The business will be better prepared to handle
unexpected situations. Every employee needs to know how to respond during
a crisis. Leaving employees to figure out will only add to the confusion and,
worse, lead to monetary and non-monetary losses in the organisation. The
BCP can document procedures before an emergency occurs.
Prevent Market Losses: The business will have security measures in
addition to insurance. Generally, it is perceived that if an organisation has
insurance, then it does not need a business continuity plan. The fact is that a
business cannot always rely on insurance alone. Insurance cannot cover
incidental injuries, loss of customers, loss of market share, and operational
issues.
Fast Recovery: A business can recover fast if it is prepared to face a crisis.
Time spent on maintaining a BCP is as good as investing in the growth of the
company. It's important to remember that the planned expenses will continue
even after the event or a crisis as well, whether the organisation is open to it
or not.
Maintaining Reputation: During the crisis, with the help of BCP, the image
and reputation of a business remain unaffected and can be maintained.
Companies that have a well-prepared BCP can respond well to emergencies

Page No. 4
Business Continuity Plan

and continue to provide products or services to their customers. Thereby

retaining customers and maintaining their image.
Building Confidence: It builds confidence among customers. When an
organisation demonstrates a high level of commitment to its business
continuity, it builds confidence among customers, as well as with other
external parties with whom they do business.
Preparing Employees: It builds confidence among employees. Internally,
employees who have a thorough knowledge of the company's continuity
strategies get the confidence to face a crisis as they know what exactly needs
to be done.
Compliance with Standards: Ensures compliance with industry standards.
An organisation which has adopted a set of business continuity levels and
standards is sure to have compliance with industry standards.
Organisational Culture: It helps develop a strong organisational culture.
Employees apply the concepts of business continuity automatically, even
when a new product or service is developed. Employees are quick to adapt
to situations when the process is not going well.
Reduce Risk: It helps to reduce financial risk. A BCP not only reduces the
business risk but also financial risk. By building a strong network or by putting
processes and procedures in place, it reduces the risk of data breaches, data
loss, or system failure.
2.2.3 Steps in Business Continuity Plan
If an organisation does not have an effective BCP, it should develop one
immediately. The effort is worthwhile and will give a company a good chance
of survival after any unexpected incident. The following steps should be taken
to develop a strong BCP.
Step 1: Create a BCP Management Team
This team uses and operates a plan. The structure of the team depends upon
the size of the company and how it plans to roll out the program. The team
should include a manager, assistant manager, and administrative assistants
from each department. These people will prepare plans for business

Page No. 5
Business Continuity Plan

continuity, train additional team members and identify processes to make the
plan go smoothly.
Step 2: Perform a Business Impact Analysis
Once the team has been assembled, the second step is to identify the
operational, financial, and physical risks to the company in the event of a
disruption. Managers can determine these risks using a Business Impact
Analysis (BIA). Once the list of potential risks to the organisation is created,
discuss how these risks can affect business performance. Asking business
impact analysis questions will identify critical business processes,
stakeholder trust, asset purchases, minimum required turnaround time, and
the minimum number of employees required to support the business. Next,
this information has to be reviewed, followed up by interviews conducted to
confirm the information and fill in the information gaps.
Step 3: Identify Required Resources
Next, identify the resources needed by doing gap analysis. After conducting
an impact analysis that identified and recorded potential risks, the analysis
may reveal inconsistencies between the available resources and the
resources needed. This is where a gap analysis needs to be done. The gap
analysis identifies the company's recovery needs compared to its current
resources. It also outlines recovery options and agreed strategies.
Step 4: Identify the Business Recovery Strategies
Explore and implement recovery strategies. Being aware of the risks is
important for an organisation. However, knowing how to react and recover is
more important to get back on track after the crisis. Once the business is
affected and financial losses grow, it will be difficult to recover without a plan.
In this step of business planning, the business recovery strategies are
identified, and their implementation process is being framed.
Step 5: Continuous Review
Continuous review is very significant in BCP, and recommendations should
be made for improvements.
The BCP can never be completed because the risks and needs of the
organisation are ever changing. The plan needs to be checked regularly to
make sure it works.

Page No. 6
Business Continuity Plan

2.3 Process of Developing Business Continuity Plan

BCP plan is framed after a detailed, thorough discussion with the top
management. The process of developing a BCP is as follows:
A. Seek support from top management: The first step is to seek support from
top management or senior executives, as they play a crucial role in
drafting the plan. Top management is always a key player in deciding the
vision, mission, and framing strategies for the organisation.
B. Engage a competent business continuity strategic consultant: Expert
advice from a competent consultant is critical. If such person is not
available within the business, then an external resource should be found.
C. Develop a basic plan: A basic plan is developed, which can assist in the
continuity of the business to the last detail.
D. Appoint a business continuity management team: Team members from
all departments are appointed to form the team to create a thorough plan.
E. Perform business impact analysis (BIA): This is done to understand the
potential consequences of disruption.
F. Develop the business continuity strategy: In this step, a final business
continuity strategy is developed to prepare the organisation for a crisis.

2.4 Business Continuity Plan (BCP) And Its Influences on

Strategic Management
Before understanding the influences of a BCP on strategic management, let's
review what strategic management is. Strategic management is a process of
formulating, implementing, evaluating, and controlling strategies to achieve
an organisation's strategic intent. It is a course of decisions and actions that
lead to the development of an effective strategy or strategies to help in
achieving corporate objectives.
There are different strategies for business continuity planning. Since there are
different types of possible impacts, strategies should be developed depending
on the type of damage or disaster. Following are some types of strategies and
situations when they can be implemented.
1. Prevention: The best option is anytime. In this strategy, action or steps
are taken to prevent or reduce the likelihood of a disaster from occurring.

Page No. 7
Business Continuity Plan

Companies can use many protective measures as protection. General

preventive measures are:
• Security Controls: Barriers are set to control access to the
company sites by preventing unauthorised access. It means using
manned surveillance at the location.
• Infrastructure Controls: This means having appropriate
infrastructure facilities such as UPS/backup power, fire/smoke
detectors, fire extinguishers, weatherproof forecasting systems, etc.
• Personnel Controls: Skilled/trained personnel are posted to areas
where key or critical resources are available.
• Software Controls: This includes installing modern methods of
control through computer programmes or software, such as:
establishing authenticity protocols at key sites, encryptions,
firewalls, intrusion detection systems, etc.
2. Response: Prevention is a proactive step; response to the crisis is a
reactive step. If prevention is not possible, then a quick response is the
next alternative strategy. After a disruption of service or operation, or
damage, the BCP team should act immediately and inform the
management and damage assessment team. The technical team and
operations team should also be involved in this. The damage
assessment team will assess the nature and extent of the damage.
Depending on the report of the damage assessment team, the technical
team and operations teams start working.
3. Resumption: In this case, the strategy is to resume normal or pre-
damage activities for the organisation. Jobs are now moving to the
Command Centre. The command centre differs from the location of the
general business activity. Both resumption and rescue operations are
integrated with the command center. The centre should possess the
required communication facilities, systems, and tools for the smooth
functioning of the BCP/technical teams. Now, the technical team needs
to decide whether sensitive business operations can be resumed at the
current location or whether these be relocated.
4. Recovery: With the resumption of critical and important operations in
the original or alternate location, the recovery process also begins.

Page No. 8
Business Continuity Plan

Recovery means installing software and controls. It is necessary for

sensitive jobs to be restored.
5. Restoration: Restoration means restoration of the original site for
normal operations. The restoration process begins simultaneously with
the recovery function. The recovery team and restoration teams are
often common.

2.5 Business Continuity Plan and Its Influence on Policymaking

The business continuity plan focuses on sustaining and maintaining the
organisation during and after a disruption. It ensures that the business
continuity management systems are developed and implemented
systematically with a commitment from the top management team. This policy
refers to an integrated strategy that includes programs, processes, and
technical measures that allow for the recovery of processes after a disruption.
Business Continuity Policy is a set of standards and guidelines that an
organisation prepares and follows to ensure sustainability and risk
management. This policy varies from organisation/industry and requires
periodic updates as technology emerges and business risks change. The
purpose of the policy is to document what is required to keep an organisation
running on normal business days and in times of emergency. A company can
ensure business continuity and risk recovery processes when the policy is
clearly defined and followed. The policy assists organisations in preparing the
BCP. It follows the following points:
• Identification of hazards
• Determine what or who can be harmed
• Evaluate the risks and create control measures
• Record the findings
• Review and update the assessment

2.6 Contingency Planning

A Business Contingency Plan is a course of action that the organisation will
take in the case of an unexpected event occurring or a risk arising. Sometimes
a contingency could be positive -- like unexpected outbursts of revenue.
However, mostly, the word refers to a negative event affecting an
organisation's dignity, financial health, or ability to stay in business. This

Page No. 9
Business Continuity Plan

includes fire, floods, data breaches, and major network failures, among
others. Contingency plans are an essential part of the growth of a business
continuity strategy because they ensure that the organisation is ready for
everything.
Contingency planning is a proactive strategy, whereas crisis management is
a reactive strategy. A contingency plan helps the organisation to ensure that
it is prepared for what may come, whereas the crisis management plan
empowers organisations to manage the response after a crisis occurs.
There is a concrete relationship between business continuity plan, business
impact analysis and contingency planning, which can be understood from the
following diagram:

Fig 1: Relationship between BCP, BIA and Contingency Planning

2.6.1 Process of Creating a Business Contingency Plan

Page No. 10
Business Continuity Plan

The process of creating a business contingency plan includes the following

steps:
1. Identify and Prioritise Resources: Thorough study of the organisation
should be done first. All the key resources of the company, such as
teams, departments, tools, machines, facilities, etc., should be identified
and listed out. After this, the prioritisation of these resources should be
done from the most important to the least important.
2. Identify Key Risk Areas: In this step, all the possible areas requiring
attention and vulnerable to risks should be identified. This requires
meeting with teams, managers, and other executives to get detailed
information about the contingencies which can compromise the
resources of the organisation.
3. Draft a Contingency Plan: After listing out all possible threats and
risks, drafting a contingency plan should be done. Drafting should start
with the most critical risk for the organisation.
4. Getting the Plan Approved: Once the plan is framed, it is presented to
the top management for approval. If any correction or revision is
suggested, then it is made before finalising the plan.
5. Share the Plan: The next step is to communicate the plan with
everyone in the organisation. This avoids any state of confusion in the
minds of the employees.
6. Revisit the Plan: No matter how good and effective a contingency plan
is, it should be revisited, revised, and maintained so that the changes
can be managed.

2.7 Summary
Let us recapitulate the important concepts discussed in this topic:
• A Business Continuity Plan or BCP is a plan which is a process an
organisation adopts to prevent and recover from potential threats which
can hamper an organisation. The BCP is a part of disaster management.
It ensures that the human resources and other assets of the organisation
are protected and able to function in a crisis as well.
• Strategic management is a process of formulating, implementing,
evaluating, and controlling the strategies to achieve an organisation's
strategic intent. It is a course of decisions and actions that lead to the

Page No. 11
Business Continuity Plan

development of an effective strategy or strategies to help in achieving

corporate objectives.

• Business Continuity Policy is a set of standards and guidelines that an

organisation commits to ensure sustainability and risk management.
Business continuity policies vary from organisation/industry and require
periodic updates as technology emerges and business risks change.
• A Business Contingency Plan is a course of action that an organisation will
take in the case of an unexpected event or situation. Sometimes a
contingency could be positive -- like unexpected outbursts of revenue-- but
most often, the word refers to a negative event affecting an organisation's
dignity, financial health, or ability to stay in business.

2.8 Glossary
Let us have an overview of the important terms mentioned in the topic:
• Business Operations: It refers to the activities in which a business is
engaged regularly to enhance the organisation's value and earn profit.
• Contingency: Contingency is an event that could possibly happen in the
future, which can cause problems and is unexpected.
• Disaster: It is a sudden accident or a natural accident that can cause
great damage or loss of life.
• Policy: A policy is a deliberate set of principles for guiding decisions and
achieving meaningful outcomes.
• Restoration: A restoration is an act of restoring or bringing back
something to a former condition.
• Strategy: It is a plan of action that is designed to achieve a long-term
objective.
2.9 Case Study
Birla Sun Life Insurance
Birla Sun Life Insurance is one of the few Indian companies with a fully
operational business continuity plan (BCP). It consists of a response plan to
restore and recover operations for critical processes within a predetermined
time after a disaster. The plan will ensure minimal impact on the organisation,

Page No. 12
Business Continuity Plan

its people, and most importantly, its customers. The objective is to have a
planned response in the event of any contingency, ensuring recovery of
critical activities within agreed time frames. The plans would comply with
various regulatory requirements and minimise the potential business impact
on the company. Additionally, it helps to create a system that fosters
continuous improvement of business continuity management.
Highlights of the plan are as follows:
• Crisis management and incident response
• Data backup, data and system recovery documented in the Disaster
recovery plan
• Recovery of all critical business functions and supporting systems
• Alternate recovery sites if primary location is unavailable
• Communication with customers, employees, and other stakeholders
• Assurance to customers that they will continue to receive optimum
customer services at all times
Source: http://insurance.birlasunlife.com/Pages/Individual/About-
Us/BusinessContinuity-Plan.aspx
References
• Kazmi, A., & Kazmi, A. (2020). Strategic Management. The McGraw-Hill
Companies.
• Lawrence R. J., (2005). Business Policy and Strategic Management,
Frank Bros. & Co. Ltd.

E-References
• Business Continuity Plan viewed on 12 May 2021,
<https://facilityexecutive.com/2019/11/5-step-guide-to-creating-a-
business-continuity-plan-that-works/>
• Business Continuity Plan, viewed on 12 May 2021
<https://www.ctrls.com/lp/business-continuity-
plan/?source=&medium=&campaignid=13071772957&adgroupid=12751
1020972&keyword=business%20continuity%20plan&matchtype=e&devi
ce=c&network=g&creative=521136268255&gclid=CjwKCAjwy42FBhB2
EiwAJY0yQprAZat1SU-NONtPVtjAw8CkBLcfMYtRb-
4wjLFT3k3dJfNC8sXRKhoCo1EQAvD_BwE

Page No. 13
Business Continuity Plan

Page No. 14