Prioritizing Business Continuity: A Step-by-Step Guide for Protecting Your Organization’s Stability and Reputation During a Crisis

Devra Schwartz’s years of experience in government organizations, educational institutions, and the private sector have given her a unique insight into the importance of prioritizing business continuity. A seasoned safety and security consultant, Devra Schwartz emphasizes the need to maintain consistent operations in order to enhance a company’s stability and maintain its reputation.

The Need for a Continuity of Operations Plan (COOP)

The goal of an effective Continuity of Operations Plan (COOP) is to facilitate an organization’s resumption of critical and essential functions following a crisis or major emergency, ultimately allowing the organization to maintain its employee-base, reputation, and financial position.

A COOP covers “all-hazards” and can be activated due to a wide range of emergencies, which may result in the loss of critical personnel, critical buildings, facilities, equipment, corrupted or inaccessible data, the loss of vendor assistance or services, and the loss of critical documents and records.  With a thoughtful and thorough COOP in place, your organization will be poised to mitigate risk amidst unforeseen challenges, laying the groundwork for your organization’s resilience and continued success.

Steps to Ensuring Business Continuity

To be effective and ensure every business unit is aligned and ready to meet the expectations of the organization during or immediately following an emergency, the organization must create a COOP base plan, which establishes a structure, set of requirements, policies, and priorities for business units. This COOP should be created by the organization’s risk manager or emergency manager with input and approval from senior leadership.

Every business unit should then be responsible for developing a detailed COOP, which is aligned with the organization’s priorities and meets the requirements. The most effective plans consist of thoughtful pre-planning work and a carefully structured set of components, which include the following:

1) Assessing risks

The first major step is identifying impacts that could disrupt your organization’s operations. Many organizations tend to focus on identifying hazards (e.g. earthquake, fire, civil unrest, pandemic). However, keep in mind that identifying hazards may be too limiting as it can hinder our thinking based on our lived experiences. Instead, start by imagining and considering potential impacts (e.g. evacuation of offices/buildings, loss of access to data, loss of power, etc), and then use a list of  hazards as a litmus test to identify which impacts may be missing and eventually to validate your work.

2) Identifying functions

Each business unit must then identify every business function they perform. This can feel tedious, though it is critical as this will be the foundation for the final COOP. Take your time with this step, and involve others in your business unit.

3) Analyzing business impact

The third step is to assess how disruptions can affect each of the business functions identified in step two, including revenue and reputation. This is called a Business Impact Analysis (BIA).

4) Developing a comprehensive plan

Using the risk assessment, comprehensive list of functions, and BIA, develop each component of your COOP: (a) Order of Succession, (b) Activation/Notification, (c) Functions, Locations, & Data/Systems, and (d) Contractors/Vendors.

a) Order of Succession

One of the fundamental principles of continuity planning is to maintain leadership in the event of a disruption. This can be accomplished by establishing an order of succession, which can be used if unit leadership cannot be reached. The order of succession may include limitations for each individual listed, noting in advance the authorities they may or may not assume (e.g. budget approval, contract execution, etc).

b) Activation/Notification

Each business unit should be responsible for activating their COOP during or in the aftermath of an emergency that disrupts regular operations and services. Tasks including employee notification and communication, retrieval of essential records and equipment, and possible relocation of functions will ultimately ensure continuity of operations.

c) Daily Functions

Each business unit’s COOP must list an outline of their daily functions, including primary locations and vital records/systems used in support of each function.

Based on the BIA and organizational priorities, leadership in each business unit should assign a priority category for each daily function:

• Critical – These are functions that concern life, safety, security, and protection of property and the environment, and must be resumed within 12 hours following an incident.
• Essential – These functions must be resumed within a 12 hour to 30-day period after an incident to avoid irreparable harm to the organization.
• Extended – These functions are not mission critical or essential, and will not cause lasting harm to the organization if delayed more than 30 days.
• Deferrable – These functions can be delayed until operations are back to normal.

d) Primary locations

Buildings or other physical spaces that are used to complete each daily function should be identified in the COOP process. That way, in the event that a building is inaccessible, business units can use this information to swiftly identify daily functions that will be impacted and devise an alternate plan for those functions.

e) Data/Systems

Awareness of systems, vital records, files, and databases that are required to perform critical and essential functions is crucial to resuming or maintaining services. To achieve this, identify the systems, data, and records that are “vital” in that they are required to complete critical and essential functions.

4) Contractors & Vendors

Each business unit should determine which critical or essential functions are dependent on external suppliers (agencies, organizations, and businesses). It is important to meet with your contractors and vendors to learn about their emergency and business continuity plans, as their readiness or lack thereof may directly impact your organization’s resilience.

5) Testing and maintenance

Training employees and testing the effectiveness of plans in a no-risk environment like an emergency exercise are essential. At least one time per year, COOPs should be reviewed and updated to reflect staffing changes or changes to business operations. At least every two years, plans should be evaluated and exercised.

Just like all emergency plans, COOPs are not intended to be the 100% solution. That said, with a thorough COOP and staff who are familiar with and trained on business continuity, an organization will have the tools it needs to adapt their COOPs quickly, allowing them to resume and maintain critical and essential functions with minimal disruption or impacts.

Devra Schwartz has long championed the importance of business continuity as a crucial aspect of maintaining an organization’s financial stability and upholding its reputation. With her firsthand experience in establishing and activating successful COOP programs, she strongly believes that prioritizing emergency preparedness is key to building the resilience an organization needs to weather crises.