Business Continuity Planning Assessment

Transcription

1 Business Continuity Planning Assessment

2 Every business is at risk of disruption from a variety of threats, as well as fire, these threats can include flood, loss of power or even loss of staff. 80% of businesses (without a business continuity plan) that are hit by a major incident either never re-open or close within 18 months. Almost 1 in 5 businesses suffer disruption every year. What would happen if your business, organisation or association was involved in an emergency or disaster? Business continuity provides a planned response combined with effective measures to reduce interruption and minimise losses. Without effective business planning, a natural or man-made disaster or, an internal or external service disruption could result in: A complete failure to your business. Loss of reputation and/or loss of customers. Financial, legal and regulatory penalties. Human resource issues. An impact on insurance premiums. If you do not have a Business Continuity Plan a short 10 minute assessment will outline the criteria you need to consider in order to help enable you to prepare for an emergency (internal or external) that may disrupt you business/ organisation. Business Continuity Planning is seen as a way of improving resilience within the community. Responsibilities under the Civil Contingencies Act 2004 require Local Authorities to promote Business Continuity to businesses and the Voluntary Sector. Reducing the threat of fire to your business can begin by having a suitable and sufficient Fire Risk Assessment of your premises. This is a legal duty which should be undertaken by the Responsible Person under the Regulatory Reform (Fire Safety) Order Details can be found here. firesafety/firesafetylaw/aboutguides/ Please complete the following 10 minute assessment to see if you are prepared for an emergency involving your business. This quick 10 minute assessment will enable you to evaluate how far you have gone with business continuity planning. 1

3 BUSINESS CONTINUITY - THE 10 MINUTE ASSESSMENT If you do not have a Business Continuity Plan this short assessment will outline the criteria you need to consider in order to help enable you to prepare for an emergency (internal or external) that may disrupt your business/organisation. This quick assessment will enable you to evaluate how far you have gone with business continuity planning. The assessment has been split into sections for ease of reference. (ideally you should have all of these criteria fulfilled) What do you do on a day-to-day basis? Yes No Don t Know Have you considered the impact of direct risks to your business (IT failure, mechanical failure, loss of power, staff absence, fire, supply chain failure, etc)? Have you considered the impact of external risks to your business (denial of access to your premises, theft, flooding, fire from adjoining property)? People are the greatest asset and investment to any business. It is important to consult with your staff throughout any business continuity process; it will fall on staff to lead on and carry out many of the tasks required for a business to survive should there be a crisis. Personnel: Yes No Don t Know Have you got a list of all employees telephone numbers? Have you made a list of all key contacts telephone numbers? Do you have an up to date and regularly reviewed job description and hierarchy chart for your company (include temporary and contract workers)? Do you have staff personal information on file i.e. communication with next of kin (include temporary and contract workers)? Are the above details held in more than one location (preferably off-site)? 2

4 Personnel: Emergency situation Yes No Don t Know Do you know where to go for advice/information (health & safety; fire prevention; security and crime prevention; news updates)? Do your staff know who is in charge in a time of a crisis? Do you and your staff know what to do in an incident? Have you made a list of all emergency key contacts telephone numbers? Have your staff been assigned specific roles to do in the event of a crisis? Do you have out of hours contact procedures for staff? Do you have members of staff with first aid or medical training? Have you considered alternative working arrangements office relocation, ability to work from home, etc? Do you have any particular staff with critical and unique skills? Are the above details held in more than one location (preferably off site)? Buildings and equipment are the greatest physical assets of any business or organisation. They provide the mechanical means to deliver your services or products. Procedures need to be put in place to protect these assets to better enable a business to survive a crisis. Building Facilities: Yes No Don t Know Do you have a floor/site plan to your building(s)? Does your building(s) require 24 hour 7 days access? Have you checked that all plumbing is in working order? Do you check that the heating and air conditioning is working on a regular basis? Do you carry out end of day inspections? I.e. to check everybody has left Do you make sure that all appliances are switched off? Do you check that all doors and windows are locked? Building Facilities: Emergency situation Yes No Don t Know Have you made a list of all emergency key contacts eg - telephone numbers for buildings/equipment maintenance, services problems (electricity, gas, water, telecommunications)? Have you familiarised yourself and your staff with the location of the mains switches and valves (ie for electricity, gas and water)? Do you have fire safety procedures in place? Do you regularly practice fire drills? Do you have evacuation procedures for your building? 3

5 Building Facilities: Emergency situation Yes No Don t Know Do you have any staff trained in evacuation? Do you have a primary and secondary evacuation points? Do you have generator backup systems in place? Do you have an alternative building to use in an emergency? Company Equipment: Yes No Don t Know Do you have someone accountable for the assets of your company? Do you have controls over the movements of your company equipment? Have you completed a recent inventory of your company equipment? Do you have current maintenance contracts for your company equipment? Security, both internal and external, is important to the running of any organisation. Theft, malicious damage, physical abuse, etc can all have an effect on how a business functions. Simple measures for the examples below can be put in place and assistance is available from agencies such as Greater Manchester Police to ensure greatersecurity and awareness to the problems this issue can cause a business. Security: Yes No Don t Know Is there a security system installed? Do you have a security policy? Do you give any advice or training on security to your staff? Do you have an entry procedure policy for staff/visitors/customers/ contractors? Are contractors checked fully (i.e. company as well as each individual)? Do you check references fully? Do you regularly check the integrity of external fences and doors? 4

6 Information technology is central to most business/organisation success. The threats to computers and the systems controlled by them, are well documented and in most cases easily combated. It is important that staff are informed of the dangers and systems to protect your IT are put in place. Information Technology: Yes No Don t Know Are your IT systems critical to the running of your business? Do you regularly backup your information? Do you hold a copy of the backup information off-site? Do you have IT maintenance staff or a maintenance contract? Do you have a tested IT disaster recovery plan? Is your computer anti virus software up to date? Are computer errors and logs adequately monitored? Are documented IT security policies and procedures in place? Are all computer users fully aware of and internet usage policies? Do you know how many platforms/servers/applications or operating systems support critical business functions? Is your company system part of a larger network? Do you know how long it would take to recover IT functions? Many businesses/organisations maintain hard copy data. This data is vulnerable to loss or damage by fire, flood, theft, loss etc. As with electronic data, it is important to protect this information. Paper Documents: Yes No Don t Know Do you copy/backup your information? Do you store your paper documents in reinforced containers? Do you have copies of your files and accounts at a separate location? Is someone responsible for the upkeep of your files and accounts? Do you make sure that you have a clear desk policy? 5

7 A business/organisation can be affected by events out of their control, disruption to suppliers and customers can affect service delivery. This risk can be assessed and procedures put in place to minimise the effects of these disruptions. Alternatively if your business is involved in a crisis, good communications and liaison with suppliers/customers will enable you better respond to that crisis. Suppliers: Yes No Don t Know Do you have the correct contact details for all your suppliers? Are the above details held in more than one location (preferably off-site)? Have you identified alternative suppliers? Do your key suppliers have a business continuity plan? Customers: Yes No Don t Know Do you have the correct contact details for all your customers? Are the above details held in more than one location (preferably off-site)? Do you have any key customers who you will need to be in constant contact with during a crisis? Would it affect your business if one of your key customers went out of business? Do your customers have a Business Continuity Plan (they may require that in future if you have a Business Continuity Plan)? The location of your business can have a bearing on how you respond to a crisis, or how a external crisis affects you. Is your location part of a complex, Eg shopping centre, trading estate; is it near an industrial site; located in a flood plain, etc. Location: Yes No Don t Know Have you thought about the types of risk that might occur due to the actions/operations of other businesses near to you? I.e. industrial, sewage works, risk of pollution etc? Have you thought about the types of risk associated with environment? Eg. water, climate, forestry etc? Do you have regular contact with neighbouring businesses (Eg local business forum)? Do you have the contact details with businesses in your area? Are you aware of any emergency response procedures specific to your location (Control of Major Accident Hazard sites; shopping centre evacuation procedures; industrial estates, etc)? 6

8 Insurance: Yes No Don t Know Do you have sufficient insurance to pay for disruption to business, cost of repairs, hiring temporary employees, leasing temporary accommodation and equipment? Do you have copies of your insurance company's details in order to contact them immediately at the time of the incident? Are copies of your insurance policies and insurance contact details held off-site? THE NEXT STAGE DEVELOPING A BUSINESS CONTINUITY PACK By completing this checklist you will now have an insight into what may be required by your business/organisation to better enable it to survive an emergency. It is worth considering assembling a business emergency pack (crash box), in which you would keep the information you would require should there be an emergency at your premises. The pack can be customised to fit your business/organisation and it should provide you with sufficient information and basic equipment to enable you to start the recovery process should an incident occur. It is only an interim facility and ideally should be held in an easily accessible location and a duplicate held off-site. If you have been denied access to the premises or evacuated from your building this could prove invaluable. Business Emergency Pack: Yes No Don t Know Business recovery plan Emergency procedures for fire Fire Plans, contact/process details for emergency services List of employees with contact details Details of IT providers Contact details for clients and suppliers Building site plan Spare keys Computer back up discs/tapes First aid kit Stationery 7

9 If you haven t already, you might also want to include these useful items: Torch Megaphone Spare batteries Tape measure Message pads Coloured pens and pencils Mobile telephones (with credit) Dust masks Disposable cameras Yes No Don t Know Adapted from the London Prepared Assessment Forms THE FINAL STAGE The next stage of the process is for a business/organisation to write a Business Continuity Plan (BCP). The information compiled in completing the checklist has given you the areas that need to be addressed in order for them to recover far quicker and with fewer losses than a company who may disregard the process, thinking 'it would never happen to us.' A BCP combines all the elements of the checklist but is structured in such a way to give an overview of the complete process. This process details and co-ordinates how a business/organisation responds to crisis from management level down through the workforce. It outlines the responsibilities and actions of staff involved in a crisis and also through business impact analysis highlights the risks most likely to affect your business. Businesses should ideally have a BCM in place and the procedures detailed should be tested. Business Continuity can be seen as safety net for businesses. Even though there are costs involved, it is well worth having such plans as it can save a business during an incident and help it react in an ordered and timely matter. 8

10 ARSON AND FIRE PREVENTION ADVICE REMEMBER, ARSON CAN BE A DIRECT THREAT TO YOUR BUSINESS. PLEASE READ THE FOLLOWING ADVICE. As part of your Fire Risk Assessment, thought must be given to the protection of your buildings and limiting fire spread should they be ignited outside the normal hours of occupation. Approximately 46% of fires in non-residential property are attributable to arson attacks. Reduce the opportunity of an arson attack Waste materials within a building should be kept to a minimum. Accumulations of combustible materials near the building will form a danger. Skips should be conveniently sited for their use but also where fire would not spread to buildings. Storage of combustible waste and refuse bins need to be in a secure area away from the building. Avoid outbuildings, fences or any stepping stones which offer upper level entry via windows or roof. Minimise the number of doors, windows and vents on the ground and first floor. Provide specific robust ironmongery on doors. Avoid canopies that offer a place for young persons to congregate at nights. Deterrents Install CCTV Avoid re-entrant angles that will not be visible from security cameras Design out concealed recesses Design out concealed doors for entry or exit Design out concealed duct outlets Install external lighting as a deterrent where the premises are overlooked. Elsewhere it will assist persons breaking into a building Reduce or eliminate shrubbery that could conceal persons while they break into a building Building Designers and Managers should be aware of simple measures that can be taken to reduce the instances and impact of arson by: Reducing opportunity, Deterrents and Limiting fire spread. Limit fire spread Install fire sprinklers very effective and can attract insurance reductions. Most buildings have a fire alarm, many with automatic detection. Monitoring the fire alarm provides an early warning when premises are unoccupied, to alert a key holder. Maintain good housekeeping. Waste materials in a building should be kept to a minimum. Close internal doors and shutters especially when premises are unoccupied. Repairing and maintaining cavity barriers and fire resisting building compartmentation after any building and services work. There may be other measures that could be adopted to allow businesses and the surrounding community to work together to protect the environment from fire and crime. You should contact the Police and Fire Services for further information. 9

11 LOCAL AUTHORITY LINKS TO BUSINESS CONTINUITY WEBSITE PAGES Cheshire Fire and Rescue Service LOCAL AUTHORITY LINKS Cheshire East Council Cheshire West and Chester Council strategies_plans_and_policies/emergency_planning Warrington Borough Council business_continuity_advice OTHER ADVICE The Business Continuity Institute General business continuity advice : Preparingforemergencies/index.htm Business Continuity Advice Cheshire Fire & Rescue Service Headquarters Winsford Cheshire CW7 2FQ t: f: