Business Continuity Planning (BCP) is an integral but often overlooked aspect of running a successful business. In the wake of the global Covid-19 pandemic, business continuity plans can offer the best chance at bouncing back successfully. For instance, Robinhood, a US-based financial services app valued at $7 billion, that allows people to invest and trade in stocks without commission, suffered three outages in two weeks. This resulted in trading being unavailable for several hours. These outages were also caused by different issues, depicting an intrinsic issue in their tech stack and a business continuity plan that needs to be updated accordingly.

We are experts in fintech consulting and provide commercial due diligence and IT due diligence services for businesses around the globe. Our expertise has given us insights into the benefits and importance of having an up-to-date and useful business continuity plan. In this article, we explore some of the best practices when it comes to developing a business continuity plan and some of their successful implementations.

What is a Business Continuity Plan (BCP)?

A business continuity plan is a premeditated response to anything that can disrupt the functioning of a business. Business continuity plans include contingency responses for natural disasters such as floods, famines, fires as well as human-driven catastrophes such as the current Covid-19 pandemic, wars, etc. that can affect a large number of businesses at the same time. BCPs are also developed for issues such as cyber-attacks, data breaches, sudden regulatory changes, and power outages among others.

Business continuity plans are the key for any company to continue operations during a crisis while minimizing losses and damage. They are developed to safeguard assets and personnel both during and after any emergencies. For an effective BCP, it is important to involve some key personnel as well as the stakeholders to safeguard all important aspects of the business.

What Is Included in a Business Continuity Plan?

BCPs are developed with a two-pronged agenda in mind —first, mitigating any potential or actual risks that threaten operations and profits and second, a recovery plan that puts the business back on track in the briefest time possible.

Mitigation Strategies

The first step to reducing the impact a crisis has on your business is to develop multiple mitigation strategies addressing a variety of potential risks. From natural disasters to man-made catastrophes to large internal errors and failures, the correct mitigation strategy is integral to minimize any losses the business may incur due to an unforeseen circumstance.

Recovery Plans

Once the risk has been dealt with correctly, the business needs to resume operations in the same capacity before the problem. A well-constructed recovery plan is essential to reducing losses and increasing profitability quickly.

How to Develop a Useful Business Continuity Plan

Our experience evaluating the business continuity plans of several companies across the globe has given us an inside look into what it takes to develop a useful business plan. Here is a step-by-step to developing a BCP for your business:

• Form a Business Continuity Management Team

It is important to select the right individuals to form the business continuity management team. The business continuity management team is responsible for the implementation and execution of the BCP during the crisis. The team must also be tested regularly to make sure they are up-to-date with the plan and will be ready to act at short notice.

• Review potential risks and respond quickly to unforeseen circumstances

The second step for organisations is to conduct a business impact analysis to properly explore which aspects of their business are the most vulnerable. It is important to identify the functions and resources of the business that are time-sensitive and need immediate or quick action during a crisis. A business impact analysis explores the operational, financial, and physical risks a crisis could pose. A “gap analysis” can help provide a comprehensive report of the resources that might be needed to effectively combat a crisis. A gap analysis evaluates a company’s current resources and assets and what might be required for recovery efforts.

Sometimes, businesses may not have anticipated a particular kind of crisis and might be ill-equipped to deal with it on short notice. In such situations, it can be useful to pick up integral business continuity aspects from other mitigation strategies and recovery plans to minimize damage and losses. Global emergencies and crises also bring along looming uncertainty, making it difficult to resume operations as usual. This is when seeking outside expert help can be a step in the right direction.

• Determine how these risks will affect operations both during and after the event.

As mentioned above, BCPs should have two main goals: mitigation and recovery. Once a thorough business impact analysis is conducted, it is important to understand how these risks can impact day-to-day operations. Waiting to respond only after a crisis has ended can be detrimental as it only provides opportunities to do damage-control. Developing a strategy to handle risks during an ongoing emergency can put your business ahead of the curve and reduce the impact on operations and profits as a whole.

• Implement safeguards and procedures that help mitigate a variety of risks

When it comes to building the business continuity plan, it is important to make sure the mitigation strategies and recovery plans cover a wide range of risks that can affect your business. Some risks pose short-term threats while others can impact business for a long time. Implement safeguards and procedures that take into account any changes in infrastructure, technical accessibility, and any other aspects that can hamper your business

• Testing these safeguards and procedures to ensure they are actionable

Once your business continuity plan is in place, you need to test the procedures to make sure that they are actionable without any major issues. Your safeguards need to be tested as well to ensure that they can be implemented at short notice to minimize the damage and protect assets and personnel. Testing the business continuity plan for its effectiveness can make sure it’s good to go when it needed. It also provides avenues for improvement that can only benefit your business in the long run.

• Reviewing these procedures and the entire process from time to time to make sure it is up to date as the business grows

The final step of building an effective business plan is to make sure that your strategies and procedures are reviewed from time-to-time and built to adapt to any changes. Developing a good business plan is of no use if it is not current as it will not be able to correctly address the issues your business is facing.

Examples of Business Continuity Plans in Action

Now that we’ve covered all of the basics, let’s take a look at some of business continuity plans (or lack thereof) and how crises have affected the businesses in question.

Cantey Technology, Struck by Lightning

Cantey Technology in South Carolina, USA, was struck by lightning in 2013 which caused a fire to break out. Cantey Technology offered IT solutions in the form of hosting servers for 200+ clients. The fire torched Cantey’s network infrastructure completely, resulting in melted cables and burned computer hardware. With their office unusable and their equipment destroyed beyond repair, Cantey Technology’s employees had to shift into a temporary office. But Cantey Technology’s business continuity plan included moving client servers to a remote data centre with continual backup storage. The clients did not experience any interruption in service.

This business continuity plan was only developed five years prior as the founder understood that holding all data in one site could be dangerous. A single on-site disruption (like the one that happened) could potentially wipe out not only Cantey Technology’s servers but also its clients’ exposing them to legal liabilities. Thus, an effective business continuity plan made a major difference in the recovery of Cantey Technology post the fire.

Delta, IT infrastructure outage

Major US-airline Delta faced a critical IT infrastructure outage in 2016 that resulted in $120 million in losses. The outage lasted for over three days, and there was a severe delay before backup systems kicked in. This resulted in 2,100 cancellations. The lack of an effective data recovery strategy in Delta’s business continuity plan, especially one that included responsive and modern backup systems, is a lesson for other businesses need to pay heed to. Along with financial losses, Delta also saw serious damage to its reputation. It weathered the storm because of its size and stakeholders, a small or medium-sized business would not have been able to sustain business with a hit like this.

Gaille Media, Hurricane Harvey

In 2017, Hurricane Harvey devastated Southeast Texas causing more than $125 billion in damage. Gaille Media, a small internet marketing agency, was located on the second floor of an office building, but was still flooded when Lake Houston overflowed. When employees could finally enter, they entered a destroyed office filled with mould. But their operations were not affected much as the bulk of their data was stored on the cloud, allowing employees to work remotely during the crisis. Gaille Media’s business continuity plan allowed for a smooth recovery, so much so that post the crisis, the company went fully remote for all employees, without any significant impact on the business.

The Penser Perspective: Covid-19 & Business Continuity Planning

As the world battles a highly contagious pandemic, businesses have had to (quite literally) shut their doors to protect employees, clients, and customers. Over ten million people have applied for unemployment in the US alone, the highest since 1982. Several businesses across the globe have seen a dip in sales and been forced to limit operations, as several countries and regional markets have implemented lockdowns. Tourism and travel have been a couple of sectors that have been highly affected, as countries have also suspended travel and postponed large-scale events.

According to research, 40-60% of small businesses close permanently after a disaster. These difficult times across the globe have shown us all the importance of a well-made and effective business continuity plan. A BCP can be the deciding factor between being able to resume operations almost immediately or permanently shuttering stores. Businesses that allow remote work have triumphed over this particular crisis as employees can contribute to the business’s operations as usual.

Without a business continuity plan in place, recovery can be almost impossible. It is important to evaluate all the vulnerable aspects of your business and which of those can be safeguarded immediately. Even if your business does not have a business continuity plan in place to deal with the effects of Covid-19, develop a temporary one to secure the business’s assets and personnel at the earliest. The global pandemic crisis is also an opportunity to learn from to develop a more useful and effective BCP for the future. Penser can offer expertise and assistance to help your business develop a robust and effective business continuity plan to safeguard against future crises and emergencies.

At Penser, we have assisted several fintechs and financial institutions in their IT due diligence needs that have helped them evaluate their technical infrastructure to safeguard them against any calamities. Similarly, we also provide commercial due diligence services to help evaluate any potential risks to your business’s operations. Contact us to know more about how we can help your business.