Office of the Fire Marshal Emergency Building Measures A Guide to Strengthen Emergency Management of High-Rise and High-Risk Buildings

Appendix B: Business Continuity Planning

Why should a business have a plan for emergencies?

Part of the emergency planning for any organization should include ensuring the ability of the organization to continue to function with the minimum of disruption after a disaster. In the context of business continuity planning, a disaster is any event that could cause a period of total or partial interruption to normal business operations. This could be a fire or explosion or could be a much less dramatic event such as loss of power or telephone service. With the increasing emphasis in industry on maintaining low inventories and “just in time” delivery schedules, even short interruptions can have a significant effect on business.

In addition to the direct costs resulting from an incident, such as damage to the building or equipment, there are also many indirect costs. These could include loss of important data or business records, negative media coverage, loss of market share, dissatisfied customers or clients or legal action by regulatory agencies. Insurance may partially compensate for some of the direct costs, but it will never cover all of the costs to an organization. It may also take many months or even years before the insurance claim is settled.

Although developing a business continuity plan does require some expenditure of time and financial resources, this expenditure should be looked at as an investment rather than as an expense. In the long term, an effective continuity plan can save an organization a great deal of money and emotional stress.

How should a business continuity plan be developed?

It is essential that senior management support the development of the continuity plan. Although outside consultants can assist in the preparation of a plan, managers from all departments in the organization must also be involved. They are intimately familiar with the operations and functions of the organization and are most likely to be aware of any weaknesses or vulnerable areas.

The first step in developing a continuity plan is to assess the various risks to which the organization might be exposed. These could include, but are not limited to, any of the following:

• fire (both internal and external), explosion,
• flooding (both internal and external),
• earthquakes, tornadoes, hurricanes, snow or ice storms, high winds,
• interruption or failure of electrical power, natural gas, water supply, telephone service, heating or ventilation,
• gas leaks, chemical spills (both on and off-site),
• computer failure,
• criminal acts such as bomb threats, biological or chemical contamination, robbery, vandalism, civil unrest, and
• death, injury or serious illness of key management or technical personnel

After determining what risks need to be considered, each risk must be evaluated to determine the probability that it will occur and what impact it would have on the organization. The probability of occurrence and the impact can be assigned point values or just a more general rating of high, medium and low. This will allow management to determine how much resources should be expended in guarding against the various risks.

Management then needs to develop strategies for addressing each of the risks. The first goal is to prevent the risk from occurring. Since not all risks can be prevented with 100 per cent certainty, the second goal is to minimize the impact on the organization if the event does occur. At all times the safety and protection of employees must be the primary consideration.

How should the plan be communicated?

The plan must be in writing and every person who could be expected to exercise any part of the plan must have a copy. New employees must be made aware of their role in exercising the plan. Careful consideration should be given to the release of confidential and sensitive information in the plan.

The president, plant manager, etc. may not be available at the time an incident occurs and someone else may have to start exercising the plan. At least one copy should be kept off-site and well as a back-up copy of any data or information which is critical to the operation of the organization. Prior arrangements should be made with outside agencies or companies such as the Public Utilities Commission, private contractors, structural engineers, plumbers, electricians, fire restoration companies, etc. whose assistance may be required to normal operations. The plan should include phone numbers where critical people can be reached 24 hrs/day.

What equipment and supplies are needed to support the plan?

The plan should include provision for maintaining an adequate supply of emergency supplies, such as chemical spill kits, and that all emergency equipment, such as generators or fire pumps, is maintained and tested as required. Some events may need to be simulated to ensure that all equipment and procedures work as intended. This is particularly important where there are sophisticated automated systems such as smoke control systems or systems for shutting down industrial processes. When conducting simulations, care must be taken to ensure that a simulated disaster does not become a real disaster.

Does the plan need to be changed from time-to-time?

The creation of a business continuity plan is not a one-time event. It must be regularly reviewed and up-dated to ensure that it reflects any changes to the facility or operations.

For more information see:

Emergency Management Guide for Business and Industry (FEMA) http://www.fema.gov/business/guide/index.shtm

Disaster Recovery Journal
http://www.drj.com/new2dr/newbies.htm (subscription required)