Unit 10
Unit 10
SEMESTER 2
DMBA212
Strategic Management and Business Policy
Unit: 10 – Business Continuity Plan 1
DMBA212: Strategic Management and Business Policy
Unit 10
Business Continuity Plan
8 Glossary - - 19
9 Case Study - - 20
10 Terminal Questions - - 21
11 Answers - -
1. INTRODUCTION
This unit aims to help you understand the Business Continuity Plan (BCP) and its related concepts.
BCP is a strategy or business plan which provides a system for the prevention, recovery and
continuity of business and its products and services from potential damage to an organization during
a crisis. This plan ensures that the employees working in the organization, and other assets of the
organization, are protected and can work in the event of an emergency or crisis.
This chapter will start with the BCP and its significance. The BCP involves demonstrating all the risks
that can affect operations of an organization and including the organization’s risk management
strategy. The risks and threats of an organization are identified and analyzed, and how these can affect
the operations of the organization. A BCP is a significant part of every business as it helps and assists
businesses to continue operations even at the time of a crisis. Threats and disruptions in the workings
of an organization can lead to loss of revenue, or increase operational costs, which can not only reduce
profits, but may lead to complete loss of business and customers. Note that insurance alone cannot
help an organization recover damages or costs at the time of a disaster.
In this unit, you will learn about the influences of the BCP on strategic management and policymaking
and also, contingency planning and its processes.
This unit will also discuss Business Impact Analysis, which is the process of determining major
functions of the organization that impact the business. The strategies required for a business to
recover from emergencies.
A Business Continuity Plan, or BCP, is a process which an organization adopts to continue business,
prevent damage and recover from potential threats which can disrupt operations for an organization.
The BCP is a part for disaster management. It aims to ensure to protect the human resources and
other assets of an organization and is able to function in crisis as well. It describes how the business
will continue to operate during an unplanned and unexpected service disruption. It is more detailed
and constructive compared to a disaster recovery plan. It contains those business processes that may
affect assets, staff, and business partners.
The BCP develops responsive policies to ensure that the business is able to recover quickly after a
disaster. The main purpose of the BCP is to protect people, assets, and property, or we can say, the
four M’s--Man, Machine, Material and Money. It also helps to protect asset damage, financial damage,
and loss of life following an emergency. It manages and maintains a system of protection and recovery
from potential threats to an organization. That workers and property are safe and able to work
quickly in the event of a disaster. BCP is often conceived proactively and includes inputs for key
stakeholders and staff. It includes all possible risks that may affect a company's operations, making it
an integral part of the organization's risk management strategy. Risks can include natural disasters -
- fires, floods, or weather-related events and cyber-attacks. Once the risks have been identified, the
plan should include:
• Determining how those risks will affect performance
• Implement prevention and risk reduction procedures
• Test procedures to ensure their effectiveness
• Review the process to ensure it is up to date
• Apps and Data: Software-related features required to enable business operations, as well as,
how to provide maximum availability for use of such software.
• Procedures: Critical business processes are required to run a business, and the IT processes
used to ensure efficiency.
• Technology: Equipment, network, and industry-specific technologies needed to enable the
continuous operation and backup of applications and data.
• Resources: Provision of a disaster recovery facility, if the main site is destroyed.
Prevent Market Losses: The business will have security measures, in addition to insurance.
Generally, it is perceived that if an organization is having insurance, then it does not need a business
continuity plan. The fact is that a business cannot always rely on insurance alone. Insurance cannot
cover incidental injuries, loss of customers, loss of market share, and operational issues.
Fast Recovery: A business can recover fast if it is prepared to face a crisis. Time spent on maintaining
a BCP is as good as investing in the growth of the company. It’s important to remember that the
planned expenses will continue even after the event or a crisis as well, whether the organization is
open to it or not.
Maintaining Reputation: During the crisis, with the help of BCP, the image and reputation of a
business remains unaffected and can be maintained. Companies that have a well-prepared BCP can
respond well to emergencies and continue to provide products or services to their customers.
Thereby retaining customers and maintaining their image.
Preparing Employees: It builds confidence among employees. Internally, employees who have a
thorough knowledge of the company’s continuity strategies get the confidence to face a crisis as they
know what exactly needs to be done.
Compliance with Standards: Ensures compliance with industry standards. An organization which
has adopted a set of business continuity levels and standards is sure to have compliance with industry
standards.
Employees apply the concepts of business continuity automatically, even when a new product or
service is developed. Employees are quick to adapt to situations when the process is not going well.
Reduce Risk: It helps to reduce financial risk. A BCP not only reduces the business risk but also
financial risk. By building a strong network, or by putting processes and procedures in place, it
reduces the risk of data breaches, data loss, or system failure.
turnaround time, and the minimum number of employees required to support the business. Next, this
information has to be reviewed, followed-up by interviews conducted to confirm the information, and
fill in the information gaps.
The BCP can never be completed because the risks and needs of the organization are ever changing.
The plan needs to be checked regularly to make sure it works.
SELF-ASSESSMENT QUESTIONS – 1
Fill in the blanks:
1 What is the first step that should be performed for the development of a business continuity
plan?
a) BCP team selection
b) Business organization analysis
c) Resource requirements analysis
d) Legal and regulatory assessment
2 What will be the major resource consumed by the BCP process during the BCP phase?
a) Hardware
b) Software
c) Processing time
d) Personnel
3 An organization requires a BCP to ensure uninterrupted availability of all key business
resources required to support essential business functions. (True/False)
4 Which of the following is not a recognized form of Business Continuity Planning?
a) Contingency Planning
b) Scenario Planning
c) Financial Planning
d) Building Planning
SELF-ASSESSMENT QUESTIONS – 2
Fill in the blanks:
5 What is one of the purposes of the BIA?
a) To determine the maximum level at which activities should be performed
b) To determine minimally acceptable outage
c) To identify risks
d) To assess the impact of disruptions for a longer period
6 A BIA critical survey helps to identify which of the following?
a) Project initiation phase
b) BIA phase
c) Recovery strategy phase
d) Testing phase
7 Specific tools used to conduct a BIA include:
a) Interviews
b) Organizational charts
c) Questionnaire
d) All the above
8 A business impact analysis is the analysis of ___________ and _____________ implications of
disruption of business operations and processes.
There are different strategies of business continuity planning. Since there are different types of
possible impacts, strategies should be developed depending on the type of damage or disaster.
Following are some types of strategies and situations when they can be implemented.
1. Prevention: The best option anytime. In this strategy, action or steps are taken to prevent or
reduce the likelihood of a disaster from occurring. Companies can use many protective measures
as protection. General preventive measures are:
• Security Controls: Barriers are set to control access to the company sites by preventing
unauthorised access. It means, using manned surveillance at the location.
• Infrastructure Controls: This means having appropriate infrastructure facilities such as
UPS/backup power, fire/smoke detectors, fire extinguishers, weatherproof forecasting
systems, etc.
• Personnel Controls: Skilled/trained personnel are posted to areas where key or critical
resources are available.
• Software Controls: This includes installing modern methods of control through computer
programmes or software, such as: establishing authenticity protocols at key sites,
encryptions, firewalls, intrusion detection systems, etc.
2. Response: Prevention is a proactive step; response to the crisis is a reactive step. If prevention
is not possible, then a quick response is the next alternative strategy. After a disruption of service
or operation, or damage, the BCP team should act immediately and inform the management and
damage assessment team. The technical team and operations team should also be involved in
this. The damage assessment team will assess the nature and extent of the damage. Depending
on the report of the damage assessment team, the technical team and operations teams start
working.
3. Resumption: In this case, the strategy is to resume normal or pre-damage activities for the
organization. Jobs are now moving to the Command Centre. The command center differs from
the location of the general business activity. Both resumption and rescue operations are
integrated with the command center. The center should possess the required communication
facilities, systems and tools for the smooth functioning of the BCP/technical teams. Now, the
technical team needs to decide whether sensitive business operations can be resumed at the
current location or whether these be relocated.
4. Recovery: With resumption of critical and important operations, on the original or alternate
location, the recovery process also begins. Recovery means installing software and controls. It
is necessary for sensitive jobs to be restored.
5. Restoration: Restoration means restoration of the original site for normal operations. The
restoration process begins simultaneously with the recovery function. The recovery team and
restoration teams are often common.
SELF-ASSESSMENT QUESTIONS – 3
Fill in the blanks:
9 Strategic Management is defined as a dynamic process of
a) Formulation of strategies
b) Implementation of strategies
c) Evaluation of strategies
d) All the above
10 The strategies for a BCP are Prevention, Response, Resumption, Recovery and _______________.
11 Prevention is a strategy; this means taking action or steps to enhance or increase the disaster
(True/False)
Business Continuity Policy is a set of standards and guidelines that an organization prepares and
follows to ensure sustainability and risk management. This policy varies from organization /industry
and requires periodic updates as technology emerges and business risks change. The purpose of the
policy is to document what is required to keep an organization running on normal business days and
in times of emergency. When the policy is clearly defined and followed, a company can ensure
business continuity and risk recovery processes. The policy assists organizations in preparing the
BCP. It follows the following points:
• Identification of hazards
• Determine what or who can be harmed
• Evaluate the risks and create control measures
• Record the findings
• Review and update the assessment
SELF-ASSESSMENT QUESTIONS – 4
Fill in the blanks:
12 The business continuity plan (BCP) focuses on sustaining and maintaining the organization
during and after the ____________.
13 The business continuity policy is a set of standards and guidelines that the organization is
committed to ensuring sustainability and ________________________.
6. CONTINGENCY PLANNING
A Business Contingency Plan is a course of action that the organization will take in the case of an
unexpected event occurring or a risk arising. Sometimes a contingency could be positive -- like
unexpected outbursts of revenue, but mostly, the word refers to a negative event affecting an
organization's dignity, financial health, or ability to stay in business. This includes fire, floods, data
breaches, major network failures, among others. Contingency plans are an essential part of the growth
of a business continuity strategy because they ensure that the organization is ready for everything.
There is a concrete relationship between business continuity plan, business impact analysis and
contingency planning, which can be understood from the following diagram:
SELF-ASSESSMENT QUESTIONS – 5
Fill in the blanks:
14 Contingency planning is a reactive strategy to take action after something has happened in the
organization. (True/False)
15 Contingency plans are an essential part of the growth of a business continuity strategy because
they help ensure that the organization is ready for anything. (True/False)
7. SUMMARY
• A Business Continuity Plan or BCP is a plan which is a process an organization adopts to prevent
and recover from potential threats which can hamper an organization. The BCP is a part of
disaster management. It ensures that the human resources and other assets of the organization
are protected and able to function in a crisis as well.
• Strategic management is a process of formulating, implementing, evaluating and controlling the
strategies to achieve an organization’s strategic intent. It is a course of decisions and actions that
lead to the development of an effective strategy or strategies to help in achieving the corporate
objectives.
• Business Continuity Policy is a set of standards and guidelines that an organization commits to
ensure sustainability and risk management. Business continuity policies vary from
organization/industry and require periodic updates as technology emerges and business risks
change.
• A Business Contingency Plan is a course of action that an organization will take in the case of an
unexpected event or situation. Sometimes a contingency could be positive -- like unexpected
outbursts of revenue-- but most often, the word refers to a negative event affecting an
organization's dignity, financial health, or ability to stay in business.
8. GLOSSARY
9. CASE STUDY
Source: http://insurance.birlasunlife.com/Pages/Individual/About-Us/BusinessContinuity-
Plan.aspx
11. ANSWERS
Answer 3: Businesses need to be organized not only for the present and for the future. This means
business continuity and the need for sustainability. Sustainability requires understanding and
analysis of the environment. Business fluctuations and disruptions can occur because of natural
disasters, such as, floods, earthquakes, hurricanes, etc. To counter and overcome these threats or
disasters, planning for business continuity is important.
Answer 4: Contingency planning is defined as a plan and procedure which is designed to assist an
organization in responding to an event or crisis that may or may not happen. This plan works as an
alternative action if the events and tasks do not function as they are planned.
Answer 3: A business contingency plan is a course of action that the organization will take in the case
of an unexpected event or situation. The process of the business contingency plan is as follows:
1. Identify and prioritize resources: Thorough study of the organization should be done first and
all the key resources of the company such as teams, departments, tools, machines, facilities etc.
should be identified and listed out.
2. Identify the key risk areas: In this step, all those areas requiring more attention being more
vulnerable towards risks should be identified. Meeting with teams, managers and other
executives has to be done to get information about the contingencies which can compromise the
resources of the organization.
3. Draft a contingency plan: After listing out all possible threats and risks, drafting of the
contingency plan should be done.
4. Share the plan: Once the organization has written the contingency plan and is approved, the next
step is to communicate the same with everyone in the organization.
5. Revisit the Plan: No matter how good and effective a contingency plan is, it should be revisited,
revised and maintained so that the changes can be managed.
BOOKS:
• Kazmi, A., & Kazmi, A. (2020). Strategic Management. The McGraw-Hill Companies.
• Lawrence R. J., (2005). Business Policy and Strategic Management, Frank Bros. & Co. Ltd.
REFERENCES:
• Business Continuity Plan viewed on 12May 2021, <https://facilityexecutive.com/2019/11/5-
step-guide-to-creating-a-business-continuity-plan-that-works/>
• Business Continuity Plan, viewed on 12 May 2021 <https://www.ctrls.com/lp/business-
continuity-
plan/?source=&medium=&campaignid=13071772957&adgroupid=127511020972&keyword
=business%20continuity%20plan&matchtype=e&device=c&network=g&creative=521136268
255&gclid=CjwKCAjwy42FBhB2EiwAJY0yQprAZat1SU-NONtPVtjAw8CkBLcfMYtRb-
4wjLFT3k3dJfNC8sXRKhoCo1EQAvD_BwE