Business continuity procedure
Business continuity procedure is an easy to follow guide for risk managers.
Business continuity is crucial to the success of a company. Therefore, it’s important you adapt the procedure to suit your needs, local laws and prevailing best practice.
Contents
Business continuity procedure summary
In summary, the business continuity procedure is as follows:
- Assess immediate response and define the type of business critical incident that has occurred
- Go through your initial review agenda, this will consider impact analysis, organisation objectives, communication, legal, insurance, media, project information
- Go through secondary review agenda. This will consider legal. reputation. organisation objectives
- Draft press release, approve and publish
- Draft staff briefing, approve and brief staff
Automate procedures
SIRV automates procedures like lift entrapment, eject people, bomb threat and business continuity.
Business continuity procedure template
Contents
Immediate response
Step 1
Question: Does the crisis meet one of the following criteria?
- Major disruption to services
- Significant financial impact on organisation profits
- Major health and safety incident
- Significant damage to reputation
- Major regulatory breach
- National / International media involvement
- Fraud
Go to step 3
- Kidnap / Extortion
Go to step 2
___
Step 2
A threat to injure or kill personnel, damage goods or property or reveal information that could be damaging to your organisation’s reputation or a senior member of management.
UK Contact
Inform local Police force (999). The Police have contingency plans for dealing with such events.
Overseas Contact
- Identify the correct local law enforcement agency for extortion crimes
- Decide on the policy with liaising with the agency and instruct local staff how to act
- Decide the degree of liaison with local government agencies
- Assess the agency’s ability and experience in dealing with such crimes
Considerations
It is important to carry out a detailed assessment of any approach:
- Identify the target – [YOUR ORGANISATION] or a member of staff
- Motive, capability and likely intentions of the perpetrator(s)
- Reality and credibility of the threat
Detailed analysis of the threat:
- To kill, kidnap or injure personnel
- To sabotage, damage or steal equipment or property
- To damage the reputation of [YOUR ORGANISATION] or an employee
- Implications to [YOUR ORGANISATION] if the threat is carried out
- [YOUR ORGANISATION] ability to protect against, deflect the threat in both short & long term
- Information about any other existing or previous similar threats and their outcome
- Legal implications of conceding to demands
- The time available before a response has to be made
Options Open
Following your assessment of the situation, decide what action to take. The options are:
- To ignore the approach in order to test the seriousness of the extortionist
- To make a response, indicating that [YOUR ORGANISATION] are willing to enter into a dialogue, but are not willing to concede to demands immediately
- To signal to the extortionist that [YOUR ORGANISATION] are willing to concede to demands
Administration
- Start an events log, noting developments, issues raised and decisions taken
- Ensure all documents are treated confidentially and stored securely
- Keep all originals for use in the event of court proceedings
- Ensure that the incident is not discussed with unauthorised personnel
- If applicable, contact insurers as specific insurance cover has been contracted
Media
- Prepare holding statement for any enquiries
- Decide media spokesperson and policy in the event that the incident becomes public knowledge
Security
- Review existing security measures
- Identify if any additional measures can be introduced to prevent the threats being carried out
- Decide whether to call in specialist consultants
___
Step 3
Select an option:
- Rendezvous location – go to step 4
- Contact Details – go to step 5
- Resource Requirement – go to step 6
- Continue to Initial Review Agenda – go to initial review agenda, next section
___
Step 4
Where people should rendezvous: [XXX]
___
Step 5
Who people should contact: [XXX]
___
Step 6
Following items should be sourced:
- PC’s/Laptops/Tablets
- E-mail & Internet access
- Fax & Direct phone lines
- Conference Call facility
- Whiteboards/Flip Carts
- TV
- Stationery
___
Initial review agenda
Step 1
Initial Review Agenda
- Impact Analysis – to step 2
- Organisation objectives – to step 3
- Communication – to step 4
- Legal – to step 5
- Insurance – to step 6
- Media & Information – to step 7
- Project Information – to step 8
- Secondary Review Agenda: Go to next section
___
Step 2
Imapct analysis:
- What has happened?
- What do we know?
- What is the scope of the problem?
- What are the implications?
- Is there more to come?
- Is this a threat to reputation?
- What is the worse case?
___
Step 3
Organisations objectives:
- What are the organisation objectives?
- Define & prioritise
- What are the timescales
- How long will the crisis run?
___
Step 4
Communication:
- Who should we tell?
- Define and prioritise
- What is the ‘core message’?
- Determination of any external bodies to be notified
- Determination of any internal communications that need to take place (Business Unit MDs, Owners, employees etc.)
___
Step 5
Legal: What legal action is required?
___
Step 6
Insurance: Is insurance cover available, and if so, how best to use the support it may provide?
___
Step 7
Media strategy to be implemented:
- What is the story? What is the deadline?
- Identification of major information gaps.
- Development of an investigative strategy.
___
Step 8
Project management:
- Actions required when?
- Specialist advisors required?
- Who to put on standby?
- What assistance could we provide immediately to the site/people affected by the crisis?
- Resources for the team – staff, meeting schedule.
___
Step 9
Initial Review Agenda No. 1 Review Checklist
Ensure you have considered all the following?:
- Command centre established
- IT support on site
- Business area staff at recovery site(s)
- Business area staff at other agreed site(s)
- Key IT systems etc. up and running
- Insurance contacted
- Communications to all staff
Secondary review agenda
Step 1
- Legal – go to step 2
- Reputation – go to step 3
- Organisation objectives – go to step 4
- Communication: Press release – go to step 5
- Communication: Staff briefing – go to step 6
___
Step 2
A legal perspective is designed to protect:
- The organisation from criminal prosecution
- The organisation from future liability
- Officers and employees
- The organisation position with insurers and regulators
- Documents
There may be a requirement for the advice on:
- A protocol on documentation for the all those involved in the management of the crisis – ‘legal advice privilege’ and ‘litigation privilege’
- Advice on press releases
- Liability
- Legal duties of Directors
- Making notifications to external regulators and prosecutors
There may be a requirement for the advice on:
- Breach of contract
- The implications on Governance standards for a proposed course of action
- Conflicts of interest within stakeholders (could be between directors, shareholders, employees, professional advisors and bankers).
Investigate Strategies:
- What options exist for internal enquiry exist?
- Criminal or civil?
3 primary issues:
- Confirmation of the identity of the internal (if appropriate) and external target
- Identification of the nature, quality and quantity of evidence required to achieve objectives
- A determination of how evidence to be gathered – sources
Also consider:
- Compensation options including ‘ex-gratia’ payments
- Advice on the legal positions should employees leave the organisation during crisis
- Positions on defamatory press coverage
- Fraud
- Handling of any witnesses
- Advice on any course of action that involves litigation and outlining the potential implications for the organisation and Crisis Team
- The use of litigation as a tool – civil remedies – Orders
- Advice on timescales of legal process/possible actions
___
Step 3
Reputation & analysis of impact:
- What has happened?
- Could this call into question the reputation of the organisation, the group or the industry?
- Does it question our health and safety standards/record in this area?
- Is this an isolated incident – has this happened before – is there more to come?
- Is there anyone else (culpably) involved ?
- What is the worse case – how bad could it get?
Organisation Objectives:
- What are the organisation’s objectives?
Define and prioritise:
- Containment – can the crisis be contained – how can we put a cap on speculation and publicity?
- Refer to the geographical name of the location
- What are the timescales?
- How long will the crisis run?
Communications:
- What timescales are relevant?
- TV/Radio
- Print: daily, weekly
- Internet
- International wake-up time
- Is our holding statement sufficient?
- What are our audiences going to make of it? Segment and Define if not already done – prioritise communication
- Investor relations
- How quick and when can communication be established?
- Who are our allies – who could help us with the message? And delivery (trade associations, HSE, MPs etc)
Project Management
- Actions required when?
- Specialist advisors required?
- What assistance could we provide immediately to the site/people affected by the crisis to assist reputation management?
___
Step 4
Organisation objectives
Organisation crisis management objectives will vary according to the type of crisis. Remember the stated objectives of this plan:
- To save life
- To prevent the crisis/disaster escalating
- To relieve suffering (public, staff and relatives)
- To safeguard the environment
- To protect the reputation of [YOUR ORGANISATION]
- To minimise any significant potential loss of revenue to [YOUR ORGANISATION]
- To protect property
- To facilitate criminal investigation and judicial, public, technical or other inquiries
- To recover the business and restore normality as soon as possible
- When the team is invoked, these objectives need to be addressed in the light of the crisis event
___
Step 5
Communication: Press release
Ideally only staff that have been media trained should manage media releases. If you’re not media trained limit your focus on the facts.
Expect the following questions:
- What happened?
- How did it happen?
- When and where did it happen?
- Why did it happen?
- Who is to blame?
- What are you going to do about it? (how will you stop it happening again)
The media will expect you to address issues in the following order of priorities:
- People
- Environment
- Property
- Money
In Advance:
- Find out what the media deadlines are and manage expectations around them.
- Control events by issuing statements / interviews to according to your schedule.
- Should an impromptu interview be requested try and delay it to fit in with your schedule, if you accept the interview ensure you find out what are the requirements of the interview.
- Establish the known consequences
- Confirm what [YOUR ORGANISATION] is doing to remedy the situation
- Establish what [YOUR ORGANISATION] can say about developments
On first encounter with someone from the media find out:
- What the they understand has happened
- Seek to understand why they’re going to ask you questions
- Prepare the three key points you want to say
- Prepare for the three questions you do not want to be asked
Do:
- Record what you say
- Bring in expert advise if necessary
- Display concern – care about what has happened and be sympathetic
- Display commitment – to find out what happened and put it right
- Display control of the situation at the most senior level
- Be available and co-operative
- Be positive and truthful
Don’t:
- Admit liability
- Give graphic descriptions
- Refuse to answer any questions
- Blame another organisation for difficulties
- Repeat negative or inflammatory words used by a reporter
Don’t Forget:
- Do not speculate, focus on the facts
- Manage and control the release of information
- Consistency of response from [YOUR ORGANISAITON] is critical
___
Step 6
Communication: Staff briefing
Ideally only staff that have been media trained should manage media releases. If you’re not media trained limit your focus on the facts.
- Internal communication should be congruent with with any external communication
- Consistency of communication from and to all parties is essential.
In Advance
Staff may want to know:
- Next of Kin: Do they know employee status?
- Payment of salary: will payments be made as normal?
- Personal property: Are they safe?
- Next of Kin: Do they know their status?
- Job continuity: What are the implications of this incident on jobs?
Don’t Forget
- Staff may be traumatised by the incident and under pressure.
- It’s important these people are handled with sensitivity and that specialist advisors are contacted to deal with any psychological concerns.
- Even if nothing can be done to immediately to address staff concerns, recognise them.
- Give staff facts to ensure they feel valued and respected, they will help [YOUR ORGANISATION] survive and recover fully, keeping them up-to-date will help them stay loyal.
Show
- Concern, as your organisation cares about what has happened.
- Commitment to finding out what has happened.
- Control of the situation at the most senior level.
Do
- Be positive and truthful.
- Be consistent in your message.
- Support victims and extend help to families if appropriate.
Don’t
- Speculate – refer to the inquiry to follow.
- Cover up key facts about the incident.
- Don’t admit liability – insist matter needs further investigation.
