Business continuity procedure

Business continuity procedure template

Contents

• Immediate response
• Initial review agenda
• Secondary review agenda
• Press release
• Staff briefing

Immediate response

Step 1

Question: Does the crisis meet one of the following criteria?

• Major disruption to services
• Significant financial impact on organisation profits
• Major health and safety incident
• Significant damage to reputation
• Major regulatory breach
• National / International media involvement
• Fraud

Go to step 3

• Kidnap / Extortion

Go to step 2

___

Step 2

A threat to injure or kill personnel, damage goods or property or reveal information that could be damaging to your organisation’s reputation or a senior member of management.

UK Contact

Inform local Police force (999). The Police have contingency plans for dealing with such events.

Overseas Contact

• Identify the correct local law enforcement agency for extortion crimes
• Decide on the policy with liaising with the agency and instruct local staff how to act
• Decide the degree of liaison with local government agencies
• Assess the agency’s ability and experience in dealing with such crimes

Considerations

It is important to carry out a detailed assessment of any approach:

• Identify the target – [YOUR ORGANISATION] or a member of staff
• Motive, capability and likely intentions of the perpetrator(s)
• Reality and credibility of the threat

Detailed analysis of the threat:

• To kill, kidnap or injure personnel
• To sabotage, damage or steal equipment or property
• To damage the reputation of [YOUR ORGANISATION] or an employee
• Implications to [YOUR ORGANISATION] if the threat is carried out
• [YOUR ORGANISATION] ability to protect against, deflect the threat in both short & long term
• Information about any other existing or previous similar threats and their outcome
• Legal implications of conceding to demands
• The time available before a response has to be made

Options Open

Following your assessment of the situation, decide what action to take. The options are:

1. To ignore the approach in order to test the seriousness of the extortionist
2. To make a response, indicating that [YOUR ORGANISATION] are willing to enter into a dialogue, but are not willing to concede to demands immediately
3. To signal to the extortionist that [YOUR ORGANISATION] are willing to concede to demands

Administration

• Start an events log, noting developments, issues raised and decisions taken
• Ensure all documents are treated confidentially and stored securely
• Keep all originals for use in the event of court proceedings
• Ensure that the incident is not discussed with unauthorised personnel
• If applicable, contact insurers as specific insurance cover has been contracted

Media

• Prepare holding statement for any enquiries
• Decide media spokesperson and policy in the event that the incident becomes public knowledge

Security

• Review existing security measures
• Identify if any additional measures can be introduced to prevent the threats being carried out
• Decide whether to call in specialist consultants

___

Step 3

Select an option:

• Rendezvous location – go to step 4
• Contact Details – go to step 5
• Resource Requirement – go to step 6
• Continue to Initial Review Agenda – go to initial review agenda, next section

___

Step 4

Where people should rendezvous: [XXX]

___

Step 5

Who people should contact: [XXX]

___

Step 6

Following items should be sourced:

• PC’s/Laptops/Tablets
• E-mail & Internet access
• Fax & Direct phone lines
• Conference Call facility
• Whiteboards/Flip Carts
• TV
• Stationery

___

Initial review agenda

Step 1

Initial Review Agenda

• Impact Analysis – to step 2
• Organisation objectives – to step 3
• Communication – to step 4
• Legal – to step 5
• Insurance – to step 6
• Media & Information – to step 7
• Project Information – to step 8
• Secondary Review Agenda: Go to next section

___

Step 2

Imapct analysis:

• What has happened?
• What do we know?
• What is the scope of the problem?
• What are the implications?
• Is there more to come?
• Is this a threat to reputation?
• What is the worse case?

___

Step 3

Organisations objectives:

• What are the organisation objectives?
• Define & prioritise
• What are the timescales
• How long will the crisis run?

___

Step 4

Communication:

• Who should we tell?
• Define and prioritise
• What is the ‘core message’?
• Determination of any external bodies to be notified
• Determination of any internal communications that need to take place (Business Unit MDs, Owners, employees etc.)

___

Step 5

Legal: What legal action is required?

___

Step 6

Insurance: Is insurance cover available, and if so, how best to use the support it may provide?

___

Step 7

Media strategy to be implemented:

• What is the story? What is the deadline?
• Identification of major information gaps.
• Development of an investigative strategy.

___

Step 8

Project management:

• Actions required when?
• Specialist advisors required?
• Who to put on standby?
• What assistance could we provide immediately to the site/people affected by the crisis?
• Resources for the team – staff, meeting schedule.

___

Step 9

Initial Review Agenda No. 1 Review Checklist

Ensure you have considered all the following?:

• Command centre established
• IT support on site
• Business area staff at recovery site(s)
• Business area staff at other agreed site(s)
• Key IT systems etc. up and running
• Insurance contacted
• Communications to all staff

Secondary review agenda

Step 1

• Legal – go to step 2
• Reputation – go to step 3
• Organisation objectives – go to step 4
• Communication: Press release – go to step 5
• Communication: Staff briefing – go to step 6

___

Step 2

A legal perspective is designed to protect:

• The organisation from criminal prosecution
• The organisation from future liability
• Officers and employees
• The organisation position with insurers and regulators
• Documents

There may be a requirement for the advice on:

• A protocol on documentation for the all those involved in the management of the crisis – ‘legal advice privilege’ and ‘litigation privilege’
• Advice on press releases
• Liability
• Legal duties of Directors
• Making notifications to external regulators and prosecutors

There may be a requirement for the advice on:

• Breach of contract
• The implications on Governance standards for a proposed course of action
• Conflicts of interest within stakeholders (could be between directors, shareholders, employees, professional advisors and bankers).

Investigate Strategies:

• What options exist for internal enquiry exist?
• Criminal or civil?

3 primary issues:

• Confirmation of the identity of the internal (if appropriate) and external target
• Identification of the nature, quality and quantity of evidence required to achieve objectives
• A determination of how evidence to be gathered – sources

Also consider:

• Compensation options including ‘ex-gratia’ payments
• Advice on the legal positions should employees leave the organisation during crisis
• Positions on defamatory press coverage
• Fraud
• Handling of any witnesses
• Advice on any course of action that involves litigation and outlining the potential implications for the organisation and Crisis Team
• The use of litigation as a tool – civil remedies – Orders
• Advice on timescales of legal process/possible actions

___

Step 3

Reputation & analysis of impact:

• What has happened?
• Could this call into question the reputation of the organisation, the group or the industry?
• Does it question our health and safety standards/record in this area?
• Is this an isolated incident – has this happened before – is there more to come?
• Is there anyone else (culpably) involved ?
• What is the worse case – how bad could it get?

Organisation Objectives:

• What are the organisation’s objectives?

Define and prioritise:

• Containment – can the crisis be contained – how can we put a cap on speculation and publicity?
• Refer to the geographical name of the location
• What are the timescales?
• How long will the crisis run?

Communications:

• What timescales are relevant?
• TV/Radio
• Print: daily, weekly
• Internet
• International wake-up time
• Is our holding statement sufficient?
• What are our audiences going to make of it? Segment and Define if not already done – prioritise communication
• Investor relations
• How quick and when can communication be established?
• Who are our allies – who could help us with the message? And delivery (trade associations, HSE, MPs etc)

Project Management

• Actions required when?
• Specialist advisors required?
• What assistance could we provide immediately to the site/people affected by the crisis to assist reputation management?

___

Step 4

Organisation objectives

Organisation crisis management objectives will vary according to the type of crisis. Remember the stated objectives of this plan:

• To save life
• To prevent the crisis/disaster escalating
• To relieve suffering (public, staff and relatives)
• To safeguard the environment
• To protect the reputation of [YOUR ORGANISATION]
• To minimise any significant potential loss of revenue to [YOUR ORGANISATION]
• To protect property
• To facilitate criminal investigation and judicial, public, technical or other inquiries
• To recover the business and restore normality as soon as possible
• When the team is invoked, these objectives need to be addressed in the light of the crisis event

___

Step 5

Communication: Press release

Ideally only staff that have been media trained should manage media releases. If you’re not media trained limit your focus on the facts.

Expect the following questions:

1. What happened?
2. How did it happen?
3. When and where did it happen?
4. Why did it happen?
5. Who is to blame?
6. What are you going to do about it? (how will you stop it happening again)

The media will expect you to address issues in the following order of priorities:

1. People
2. Environment
3. Property
4. Money

In Advance:

• Find out what the media deadlines are and manage expectations around them.
• Control events by issuing statements / interviews to according to your schedule.
• Should an impromptu interview be requested try and delay it to fit in with your schedule, if you accept the interview ensure you find out what are the requirements of the interview.
• Establish the known consequences
• Confirm what [YOUR ORGANISATION] is doing to remedy the situation
• Establish what [YOUR ORGANISATION] can say about developments

On first encounter with someone from the media find out:

• What the they understand has happened
• Seek to understand why they’re going to ask you questions
• Prepare the three key points you want to say
• Prepare for the three questions you do not want to be asked

Do:

• Record what you say
• Bring in expert advise if necessary
• Display concern – care about what has happened and be sympathetic
• Display commitment – to find out what happened and put it right
• Display control of the situation at the most senior level
• Be available and co-operative
• Be positive and truthful

Don’t:

• Admit liability
• Give graphic descriptions
• Refuse to answer any questions
• Blame another organisation for difficulties
• Repeat negative or inflammatory words used by a reporter

Don’t Forget:

• Do not speculate, focus on the facts
• Manage and control the release of information
• Consistency of response from [YOUR ORGANISAITON] is critical

___

Step 6

Communication: Staff briefing

Ideally only staff that have been media trained should manage media releases. If you’re not media trained limit your focus on the facts.

• Internal communication should be congruent with with any external communication
• Consistency of communication from and to all parties is essential.

In Advance

Staff may want to know:

• Next of Kin: Do they know employee status?
• Payment of salary: will payments be made as normal?
• Personal property: Are they safe?
• Next of Kin: Do they know their status?
• Job continuity: What are the implications of this incident on jobs?

Don’t Forget

• Staff may be traumatised by the incident and under pressure.
• It’s important these people are handled with sensitivity and that specialist advisors are contacted to deal with any psychological concerns.
• Even if nothing can be done to immediately to address staff concerns, recognise them.
• Give staff facts to ensure they feel valued and respected, they will help [YOUR ORGANISATION] survive and recover fully, keeping them up-to-date will help them stay loyal.

Show

• Concern, as your organisation cares about what has happened.
• Commitment to finding out what has happened.
• Control of the situation at the most senior level.

Do

• Be positive and truthful.
• Be consistent in your message.
• Support victims and extend help to families if appropriate.

Don’t

• Speculate – refer to the inquiry to follow.
• Cover up key facts about the incident.
• Don’t admit liability – insist matter needs further investigation.

Get in touch

Text & WhatsApp: (0) 7984 884404

Email: info@sirv.co.uk

Web Chat: Use the web chat pop-up