Why You Should Build Your Business Continuity Plan 

40% of all all California businesses that have insurance in place and sustain a loss at their primary location are out of business for good! This is where your business continuity plan come into play!

Call Grant Davis at 888-991-2929, or click here to download you Business Continuity Plan!

The majority of the 60% that make it have one thing in common!  They had a disaster recovery plan in place.  So I thought I would just share a brief overview of what a plan looks like.

Of course your GDI Insurance Broker is here to help.  As you see just buying insurance is never the answer.  It is just part of the solution, but interestingly insurance is not the most important part of the plan!

What is Business Continuity Planning?

Business continuity planning is the process of creating a plan now, so that you will be able to recover the most vulnerable parts of your company after a business interruption occurs. Your company’s business continuity plan, in conjunction with business interruption insurance, form your business continuity management (BCM) program. Businesses with strong BCM programs are more resilient in the face of emergencies and disasters.

Why is Business Continuity Planning Important?

Despite growing evidence that preparation is key to surviving a business emergency, more than 60 percent of small businesses do not have a formal emergency response plan. A business continuity plan, if implemented and maintained, can be the difference between successfully recovering from a business interruption and going out of business.

How Do I Use This Guide?

The Business Continuity Planning Toolkit pairs with the Business Continuity Sample Plan, providing descriptions of the purpose of each section of the sample plan. This toolkit follows the same format as the sample plan, making it easy to use as guidance when piecing the sample plan together.

This toolkit is divided into six sections:

1. Direction and Control
2. Communication
3. Life Safety
4. Property Protection
5. Community Outreach
6. Recovery and Restoration
7. Implementation and Maintenance

Each section goes over the critical activities your organization needs to implement before, during and after a business interruption.

I didn’t include all the below.  But if you send me an Email Grant.davis@gdiins.com and ask I will send you this entire program in word so you can get started.   No cost or obligation other than to just know GDI can help your business big or small we have the programs to reduce risk and cut your insurance costs!

Table of Contents

Direction and Control

The system for managing resources, analyzing information and making decisions in an emergency is called direction and control. This section describes the configuration of your direction and control system, which will depend on the size of your company and your existing resources.

Business Mission Statement

A mission statement is a clear, concise declaration of your business’ goals and the philosophies underlying them. It distills what your business is all about for customers, employees and the market. It should reflect every facet of your business and is crucial to developing a comprehensive and meaningful business continuity plan.

Business Continuity Policy

A Business Continuity Policy (BPC) is a plan, supported by senior management, to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and supervise the continuity of operations through personnel training, plan testing and maintenance. The Business Continuity Policy should contain all the procedures necessary to continue business operations during or after an emergency.

A typical Business Continuity Plan should contain documents outlining the following:

• Duties of the Emergency Management Group
• Duties of the Incident Commander
• Location of the Emergency Operations Center
• Emergency Communication Procedures
• Notification procedures
• Warning procedures
• Confidentiality requirements
• Organizational chart
• Customer lists
• Utility provider information
• Suppliers and equipment providers

Emergency Management Group

The Emergency Management Group (EMG) is responsible for controlling all incident-related activities. The EMG allocates resources to a single Incident Commander, who oversees the technical aspects of the response. EMG members should be senior managers who have the authority to:

• Determine the short- and long-term effects of an emergency
• Order the evacuation or shutdown of the facility
• Implement the emergency management plan
• Determine response strategies
• Activate resources
• Oversee all incident response activities
• Declare that an incident has ended
• Interface with outside organizations and the media
• Issue press releases

Incident Commander

The Incident Commander (IC) is the spokesperson for the EMG and is responsible for planning and execution, managing the incident from the front line, determining whether outside assistance is needed, and relaying requests for internal resources or outside assistance through the Emergency Operations Centre.

The IC can be any employee, but a member of management with authority to make decisions is usually the best choice.

Team Processes and Procedures

All teams have workflows that they need to follow. In an emergency, you may need to outsource help to keep a team functioning. Make sure to attach the team processes and procedures (or provide a link to where they are stored) so any new employees know how to work on the team.

Because managers are not always present during times of crisis, clearly articulated processes and procedures for all team members are essential in order to avoid confusion and ensure business operations continue.

Incident Commander Workflow

The IC needs to be agile and respond to an emergency immediately with a checklist of tasks to accomplish. Compile a list of what you want the IC to do immediately in the event of a business interruption. Specifying which tasks you want completed immediately will help your business stay nimble and minimize the negative effects of an interruption.

Emergency Operations Center

The Emergency Operations Center (EOC) serves as a centralized management center for emergency operations. Here, decisions are made by the EMG based upon information provided by the IC and other personnel. Every facility should designate an area where decision makers can gather during an emergency.

The EOC should be located in an area of the facility not likely to be involved in an incident and the EMG should designate an alternate EOC in case the primary location is not usable.

Each facility must determine its requirements for an EOC based upon its functions and the number of people involved. Ideally, the EOC is a dedicated area equipped with all the tools necessary to respond quickly and appropriately to an emergency.

EOCs must be stocked with:

• Communications equipment
• A copy of the emergency management plan and EOC procedures
• Blueprints, maps and status boards
• A list of EOC personnel and descriptions of their duties
• Technical information and data for advising responders
• Building security system information
• Information and data management capabilities
• Telephone directories
• Backup power, communications and lighting
• Emergency supplies

Communication

Communications are essential to any business operation. A solid communication system is needed to report emergencies, warn personnel of any danger, keep families and off-duty employees informed about events happening at the facility, coordinate response actions and keep in contact with customers and suppliers. This section describes your communication system during an emergency.

Emergency Considerations

Consider the functions your facility might need to perform in an emergency and the communications systems needed to support those functions. Consider communications between:

• Emergency responders
• Responders and the IC
• The IC and the EOC
• The IC and employees
• The EOC and outside response organizations
• The EOC and neighboring businesses
• The EOC and employees’ families
• The EOC and customers
• The EOC and the media

In an emergency, personnel will need to know whether their families are safe—taking care of loved ones is always a first priority. Make plans for communicating with employees’ families in an emergency.

Encourage employees to:

• Consider how they would communicate with their families in case they are separated from one another or injured in an emergency.
• Arrange for an out-of-town contact for all family members to call in an emergency.
• Designate a place to meet family members in case they cannot get home in an emergency.

Notification

Communication with employees in an emergency is crucial for establishing safety and ensuring business can continue.

Accomplish the following to ensure communication stays clear and open during an emergency:

• Establish procedures for employees to report an emergency.
• Inform employees of reporting procedures.
• Train personnel in specific notification tasks.
• Post emergency telephone numbers near each telephone, on employee bulletin boards and in other prominent locations.
• Maintain an updated list of key emergency personnel’s addresses and telephone numbers.
• Listen for tornado, hurricane and other severe weather warnings.
• Determine government agencies’ notification requirements in advance. Notification must be made immediately to local government agencies when an emergency has the potential to affect public health and safety.
• Prepare announcements that could be made over public address systems.

Warning

In the event of an emergency, it is imperative that employees are properly alerted of dangers they may face.

Establish a system for warning personnel of an emergency. The system should:

• Be audible or within view by all people in the facility,
• Have an auxiliary power supply, and
• Have a distinct and recognizable signal.

After implementing your warning system, accomplish the following:

• Make plans for warning people with disabilities, such as using a flashing strobe light to warn hearing-impaired people.
• Familiarize personnel with procedures for responding when the warning system is activated.
• Establish procedures for warning customers, contractors, visitors and others who may not be familiar with the facility’s warning system.
• Test your facility’s warning system at least on a monthly basis.

Confidentiality Requirements

Do you have any agreements with other companies you work with that require you to keep certain things confidential? Make sure to attach these agreements so you have a copy in an emergency.

Organizational Chart

Your organizational chart shows the hierarchy of employees and the chain of command. It is important to have this information on hand in an emergency. List your organizational chart or attach it here.

Customer Lists

Customers are the lifeblood of a business, so contact with them is a top priority. Without a list of customers to contact in the event of an emergency, you risk alienating past, present and future business contacts. Customers, especially those with pending orders, need to be contacted immediately and convinced that business will continue despite the emergency. Swift, confident communication to your customers following an emergency helps soothe current business partners and stop them from defecting to the competition. Attach (or write in) contact information about your key contact(s) at each company. Update this list at least quarterly.

Utility Provider Information

When a disaster strikes, utilities such as electricity and gas may be temporarily suspended. For the safety of your employees and the health of your business, it is imperative that you restore utilities as soon as possible. To do that, you need the contact information of your utility provider. Immediately contacting the emergency line of your utility provider can help you restore power, save money—and even save lives.

Suppliers and Equipment Providers

Where does your company buy the materials needed to produce its product or service? List your supplier contracts and their contact information here. To expedite recovery, find backup suppliers for each.

Life Safety

Protecting the health and safety of everyone in the facility should be your first priority during an emergency. This section describes your system for evacuation, accountability, shelter and preparedness during a business interruption, which is key for a successful business continuity plan.

Evacuation Planning

Establishing clear, easy-to-follow evacuation procedures is a basic requirement to ensuring your employees’ safety. In the event of fire, an immediate evacuation to a predetermined area away from the facility is necessary. In the event of a natural disaster, evacuation could involve the entire community and take place over a period of days.

To develop a thorough evacuation policy, accomplish the following:

• Determine the conditions under which an evacuation would be necessary.
• Establish a clear chain of command and identify personnel with the authority to order an evacuation. Designate “evacuation wardens” to assist others in an evacuation and to account for personnel.
• Establish specific evacuation procedures and a system to account for personnel. Consider employees’ transportation needs for community-wide evacuation.
• Post evacuation procedures in prominent locations so all employees can learn them.
• Designate personnel to continue or shut down critical operations while an evacuation is underway. They must be capable of recognizing when to abandon the operation and evacuate.
• Coordinate plans with the local emergency management office.

Evacuation Routes and Exits

Designate primary and secondary evacuation routes and exits that are clearly marked and well lit. Post signs and install emergency lighting in case a power outage occurs during an evacuation.

To facilitate a smooth, speedy evacuation, ensure your evacuation routes are:

• Wide enough to accommodate the number of evacuating personnel;
• Clear and unobstructed at all times;
• Unlikely to expose evacuating personnel to additional hazards; and
• Evaluated by an external expert.

Assembly and Accountability

Assembling and accounting for all employees in the wake of a disaster is crucial to quelling confusion and ensuring safety. But obtaining an accurate account of personnel after a site evacuation requires planning and practice. Follow these guidelines to improve the effectiveness of your assembly and accountability procedures:

• Designate assembly areas where personnel should gather after evacuating.
• Take a head count after the evacuation. The names and last-known location of personnel not accounted for should be compiled and given to the EOC. Confusion in the assembly areas can lead to unnecessary and dangerous search and rescue operations.
• Establish a method for accounting for nonemployees such as suppliers and customers.
• Devise procedures for further evacuation in case the incident expands. This may consist of sending employees home by normal means or providing them with transportation to an off-site location.

Shelter

In some emergencies, the best means of protection is to take shelter either within the facility or away from the facility in a public building. Determine the conditions that would force you and your employees to take shelter, and accomplish the following to guarantee you have access to suitable shelter:

• Identify shelter space in the facility and in the community. Establish procedures for sending personnel to the shelter.
• Decide what type of emergency supplies you need, such as water, food and first-aid kits.
• Designate shelter managers.
• Coordinate plans with local authorities.

Employee Training

A comprehensive evacuation plan means nothing if your employees do not know it. Train all employees in evacuation, shelter and emergency procedures. Conduct training sessions at least annually or when the following occurs:

• Employees are hired
• Evacuation wardens, shelter managers and others with special assignments are designated
• New equipment, materials or processes are introduced
• Procedures are updated or revised
• Exercises show that employee performance must be improved

To ensure your employees stay aware of emergency procedures all year long, provide them with checklists and evacuation maps. Post additional evacuation maps in strategic locations, and consider the informational needs of customers and others who visit the facility.

Family Preparedness

Since employees are your most valuable asset, consider the range of services that you could provide or arrange for after an emergency, including the following:

• Cash advances
• Salary continuation
• Flexible work hours
• Reduced work hours
• Crisis counselling
• Care packages
• Day care

Investigate ways to help employees prepare their families for emergencies. This will increase their personal safety and help the facility get back up and running. Employees who are prepared at home will be better able to carry out their responsibilities at work.

 Property Protection

Organizing a system for protecting facilities, equipment and vital records is essential to restoring operations once an emergency has occurred. This section describes your property protection plan.

Protection Systems

Protection systems safeguard your assets when you cannot. Determine what you need in order to install systems that detect abnormal situations, provide warning and protect property, such as the following:

• Fire protection systems
• Lighting protection systems
• Water-level monitoring systems
• Overflow detection devices
• Automatic shutoffs
• Emergency power generation systems

Mitigation

Explore ways to reduce the effects of emergencies, such as moving or constructing facilities away from flood plains and fault zones. Also consider ways to reduce the chances of emergencies from occurring, such as changing processes or materials used to run the business. Consider implementing the following physical measures to mitigate the effects of an emergency:

• Upgrade facilities to withstand the shaking of an earthquake or high winds.
• “Floodproof” facilities by constructing flood walls or other flood protection devices.
• Install fire sprinkler systems.
• Install fire-resistant materials and furnishing.
• Install storm shutters for all exterior windows and doors.

There are also nonstructural mitigation measures to consider, including those listed below:

• Install fire-resistant materials and furnishing.
• Secure light fixtures and other items that could fall or shake loose in an emergency.
• Move heavy or breakable objects to low shelves.
• Attach cabinets and files to low walls, or bolt them together.
• Place Velcro strips under tabletop computers and television monitors.
• Move work stations away from large windows.
• Install curtains or blinds that can be drawn over windows to prevent glass from shattering onto employees.
• Anchor water heaters and bolt them to all wall studs.

Facility Shutdown

Facility shutdown is generally a last resort but always a possibility. Improper or disorganized shutdown can result in confusion, injury and property damage. Some facilities require only simple actions such as turning off equipment, locking doors and activating alarms. Others require much more complex shutdown procedures.

Work with department heads to establish shutdown procedures. Include information about when and how to shut off utilities. Identify the following factors to improve the effectiveness of your shutdown procedures:

• The conditions that could necessitate a shutdown
• Who can order a shutdown
• Who will carry out shutdown procedures
• How a partial shutdown would affect other facility operations
• The length of time required for shutdown and restarting

Records Preservation

Vital records are essential to resuming business after an emergency. Vital records may include the following:

• Financial and insurance information
• Engineering plans and drawings
• Product lists and specifications
• Employee, customer and supplier databases
• Formulas and trade secrets
• Personnel files

Analyzing and prioritizing vital records is a difficult task that involves doing the following:

• Classifying operations into functional categories, e.g., finance, production, sales, administration
• Determining essential functions for keeping the business up and running, such as finance, production and sales
• Identifying the minimum information that must be readily accessible to perform essential functions, e.g., maintaining customer collections may require access to account statements
• Recognizing the records that contain the essential information and where they are located
• Distinguishing the equipment and materials needed to access and use the information.

After identifying your vital records, establish procedures for protecting and accessing them. There are many tasks to complete when protecting vital records, including those listed below:

• Labeling vital records
• Backing up computer systems
• Making copies of records
• Storing tapes and disks in insulated containers
• Storing data off-site where it would not likely be damaged by an event affecting your facility
• Increasing security of computer facilities
• Arranging for evacuation of records to backup facilities
• Backing up systems handled by service bureaus
• Arranging for backup power

Building Information

Attach all appropriate information pertaining to building and site maps that indicate the following:

• Utility shutoffs
• Water hydrants
• Water main valves
• Water lines
• Gas main valves
• Gas lines
• Electrical cut-offs
• Electrical substations
• Storm drains
• Sewer lines
• Location of each building (include name of building, street name and number)
• Floor plans
• Alarms and enunciators
• Fire extinguishers
• Fire suppression systems
• Exits
• Stairways
• Designated escape routes
• Restricted areas
• Hazardous materials (including cleaning supplies and chemicals)
• High-value items

 Community Outreach

Your facility’s relationship with the community will influence your ability to protect personnel and property and return to normal operations. This section describes ways to involve outside organizations in the emergency management plan.

Mutual Aid Agreements

To avoid confusion and conflict in an emergency, establish mutual aid agreements with local response agencies and businesses. Include these agencies in facility training exercises whenever possible. These agreements should:

• Define the type of assistance;
• Identify the chain of command for activity; and
• Define communications procedures.

Mutual aid agreements can address any number of activities or resources that might be needed in an emergency, such as the following:

• Providing for firefighting and HAZMAT response
• Allocating shelter space, emergency storage, supplies, and medical support
• Establishing which businesses will allow neighbors to use their property to account for personnel after an evacuation

Community Service

In community-wide emergencies, business and industry are often needed to assist the community with the following:

• Personnel
• Equipment
• Shelter
• Training
• Storage
• Feeding facilities
• EOC facilities
• Food, clothing, building materials
• Funding
• Transportation

While there is no way to predict what demands will be placed on your company’s resources, consider how the community’s needs might influence your corporate responsibilities in an emergency. Also, consider the opportunities for community service before an emergency occurs.

Public Information

When site emergencies expand beyond the facility, the community will want to know the nature of the incident, whether their safety or health is in danger, what is being done to resolve the problem, and what was done to prevent the situation from happening in the first place. Determine the audiences that may be affected by an emergency and identify their information needs. Be sure to consider the needs of the following audiences:

• The public
• The media
• Employees and retirees
• Unions
• Contractors and suppliers
• Customers
• Shareholders
• Emergency response organizations
• Regulatory agencies
• Appointed and elected officials
• Special interest groups
• Neighbors

The community will want to know answers to the following questions:

• What does the facility do?
• What are the hazards?
• What programs are in place to respond to emergencies?
• How could a site emergency affect the community?
• What assistance will be required from the community?

Media Response

In an emergency, the media are the most important link to the public. Try to develop and maintain positive relations with media outlets in your area. Consider their particular needs and interests, and explain to them your plan for protecting personnel and preventing emergencies.

Determine how you would communicate important public information via the media in an emergency. Designate a trained and an alternate spokesperson. Set up a media briefing area and establish security procedures. When releasing information to the media, follow procedures for ensuring that information is complete, accurate and approved for the public. Prepare background information about your facility so you can control how the media and public perceive your organization.

When providing information to the media during an emergency, follow these guidelines:

• Give all media equal access to information.
• When appropriate, conduct press briefings and interviews. Give local and national media equal time.
• Try to observe media deadlines.
• Escort media representatives to ensure their safety.
• Keep records of information released.
• Provide press releases when possible.
• Avoid speculating about the incident.
• Never permit unauthorized personnel to release information.
• Do not cover up facts or mislead the media.
• Refrain from placing blame for the incident.

Local Emergency Information

Gather contact information and response plans from these local services:

• Fire
• Police
• Ambulance
• Hospital
• Poison Control

Have regular meetings with community crisis personnel to review emergency plans and procedures. Discuss what you are doing to prepare for and prevent emergencies and emphasize your concern for the community’s welfare. When meeting with community crisis personnel, accomplish the following to foster organization and communication:

• Look for common interests and concerns and identify opportunities for sharing resources and information.
• Conduct confidence-building activities such as facility tours.
• Involve community fire, police and emergency management personnel in drills and exercises.

Make sure to meet with your neighbors to determine how you could assist each other in an emergency. Communication begets organization.

Recovery and Restoration

Business recovery and restoration, or business resumption, goes right to a facility’s bottom line: keeping people employed and the business running. This section describes your plan during a business interruption for logistics, distribution, operations, product and service development, marketing, sales, management, human resources and more.

Procurement, Logistics and Distribution

Procurement, logistics and distribution are those activities associated with obtaining and storing inputs along with storing and transporting finished products to customers. This can include sourcing goods and services, purchasing those goods and services from suppliers, storing goods in warehouses, and transporting your finished products to customers.

Consider the crucial, time-sensitive tasks any departments involved in procurement, logistics and distribution need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your procurement, logistics and distribution functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Operations

Operations are those activities associated with transforming inputs into final outputs, which can include the processing, refining and packaging of your goods or services.

Consider the crucial, time-sensitive tasks any departments involved in operations need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your operations functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Product or Service Development

Product or service development is those activities associated with bringing a new, improved or redesigned product or service to market. This can include research, marketing analysis, design, and engineering.

Consider the crucial, time-sensitive tasks any departments involved in product or service development need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your product or service development functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Marketing, Sales, and Customer Accounts

Marketing, sales and customer accounts are those activities associated with informing existing or potential buyers. This can include promotion, advertising, telemarketing, selling, and retail management.

Consider the crucial, time-sensitive tasks any departments involved in marketing, sales and customer accounts need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your marketing, sales and customer accounts functions here.

Would you like more support? Download the Business Impact Analysis Template.

Customer or Aftersales Services

Customer and aftersales services are those activities provided to customers after they purchase your goods or services. This can include training, help-desk services, call-center services, and customer support for guarantees and warranties.

Consider the crucial, time-sensitive tasks any departments involved in customer and aftersales services need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your customer and aftersales services functions here.

Would you like more structure? Download the Business Impact Analysis Template.

General Management and Firm Infrastructure

General management and firm infrastructure are those activities associated with corporate governance. This can include accounting, building services, management and administrative support.

Consider the crucial, time-sensitive tasks any departments involved in general management and firm infrastructure need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your general management and firm infrastructure functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Human Resource Management

Human resource management are those activities associated with managing your employees. This can include recruiting, hiring, training, compensating and dismissing personnel.

Consider the crucial, time-sensitive tasks any departments involved in human resource management need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain my reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your human resource management functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Technology and Process Development

Technology and process development are those activities associated with technical knowledge and maintenance. This can include automating, designing or redesigning equipment, hardware, software and procedures.

Consider the crucial, time-sensitive tasks any departments involved in technology and process development need to complete. To help you identify these crucial tasks, ask yourself the following questions:

• Which business functions are critical and time-sensitive? Which can wait?
• Which functions are high-priority? Which functions are low-priority?
• How much downtime can each business function tolerate?
• Which business functions are required to fulfill my legal and financial obligations and keep cash flowing?
• Which business functions are necessary to maintain a good reputation and market share? Which business functions are necessary to adjust to changed circumstances?

For each function you enter, be sure to include:

• Recovery time objectives (how long your business can survive without the function before it goes under)
• Short-term plans to recover the business function
• Long-term plans to restore the function to its pre-emergency level

Attach any raw materials and supply lists that are necessary to recovering your technology and process development functions here.

Would you like more structure? Download the Business Impact Analysis Template.

Implementation and Maintenance

It is extremely important to keep your plan current by exercising, maintaining and reviewing it. You should be integrating your plan into company workflows and training employees on their roles. This section describes your plan implementation and maintenance.

Integrate the Plan into Company Operations

Implementation means more than simply exercising the plan during an emergency. It means acting on recommendations made during the vulnerability analysis, integrating the plan into company operations, training employees and evaluating the plan.

Emergency planning must become part of the corporate culture. Look for opportunities to build awareness, train personnel and test procedures. Be sure to involve all levels of management, all departments and the community in the planning process. Make emergency management part of what personnel do on a day-to-day basis. Test how completely the plan has been integrated into your company operations by asking the following questions:

• How well does senior management support the responsibilities outlined in the plan?
• Have emergency planning concepts been fully incorporated into the facility’s accounting, personnel and financial procedures?
• How can the facility’s processes for evaluating employees and defining job classifications better address emergency management responsibilities?
• Are there opportunities for distributing emergency preparedness information through corporate newsletters, employee manuals or employee mailings?
• What kinds of safety posters or other visible reminders would be helpful?
• Do personnel know what they should do in an emergency?
• How can all levels of the organization be involved in evaluating and updating the plan?

Business Interruption Insurance

Most companies discover that they are not properly insured only after they have suffered a loss. Lack of appropriate insurance can be financially devastating. Ask your insurance advisor the following questions to determine your individual needs:

• How will my property be valued?
• Does my policy cover the cost of required upgrades to code?
• How much insurance am I required to carry to avoid becoming a co-insurer?
• What perils or causes of loss does my policy cover?
• What are my deductibles?
• What does my policy require me to do in the event of a loss?
• What types of records and documentation will my insurance company want to see?
• To what extent am I covered for loss due to interruption of power? Is coverage provided for both on- and off-premises power interruption?
• Am I covered for lost income in the event of business interruption because of a loss? Do I have enough coverage? For how long is coverage provided? How long is my coverage for lost income if my business is closed by order of a civil authority?
• To what extent am I covered for reduced income due to customers’ not all immediately coming back once the business reopens?
• How will my emergency management program affect my rates?

Conduct Drills and Exercises

Conduct periodic drills and exercises to ensure emergency preparedness that involve community responders. After each training activity, review what worked and what needs improvement. Involve both personnel and community responders in the evaluation process.

Training can take many forms, including those listed below:

• Orientation and education sessions: These are regularly scheduled discussion sessions to provide information, answer questions and identify needs and concerns.
• Tabletop exercises: Members of the emergency management group meet in a conference room setting to discuss their responsibilities and how they would react to emergency scenarios. These exercises are a cost-effective and efficient way to identify areas of overlap and confusion before conducting more demanding training activities.
• Walk-through drills: During these drills, the emergency management group and response teams actually perform their emergency response functions. This activity generally involves many people and is more thorough than a tabletop exercise.
• Functional drills: These drills test specific functions such as medical response, emergency notifications, warning and communications procedures, and equipment—though not necessarily at the same time. Personnel are asked to evaluate the systems and identify problem areas.
• Evacuation drills: Personnel walk the evacuation route to a designated area where procedures for accounting for all personnel are tested. Participants are asked to make notes of what might become a hazard during an emergency, such as stairways cluttered with debris or smoke in the hallways. Plans are then modified accordingly.
• Full-scale exercises: Full-scale exercises simulate real-life emergency situations as closely as possible. These exercises involve company emergency response personnel, employees, management and community response organizations.

Train Employees

Employee training is crucial to ensuring a speedy evacuation and minimizing injuries and damage. General training for all employees should address the following:

• Individual roles and responsibilities
• Information about threats, hazards and protective actions
• Notification, warning and communications procedures
• Means for locating family members in an emergency
• Emergency response procedures
• Evacuation, shelter and accountability procedures
• Location and use of common emergency equipment
• Emergency shutdown procedures

The scenarios developed during the vulnerability analysis can serve as the basis for training events.

Everyone who works at or visits the facility requires some form of training. This could include periodic employee discussion sessions to review procedures, technical training in equipment use for emergency responders, evacuation drills and full-scale exercises.

Assign responsibility for developing a training plan. Consider the training and information needs for employees, contractors, visitors, managers and those with an emergency response role identified in the plan.

Determine the following for a 12-month training period:

• Who will be trained?
• Who will do the training?
• What training activities will be used?
• When and where will each session take place?
• How will each session be evaluated and documented?

Annual Plan Audit

To ensure the plan is relevant at all times, conduct a formal audit of the entire plan at least once a year. There are many issues to consider when auditing your plan, including the following:

• How can you involve all levels of management in evaluating and updating the plan?
• Are the problem areas and resource shortfalls identified in the vulnerability analysis being sufficiently addressed?
• Does the plan reflect lessons learned from drills and actual events?
• Do members of the emergency management group and emergency response team understand their respective responsibilities? Have new members been trained?
• Does the plan reflect changes in the physical layout of the facility? Does it reflect new facility processes? Are photographs and other records of facility assets up to date?
• Is the facility attaining its training objectives?
• Have the hazards in the facility changed?
• Are the names, titles and telephone numbers in the plan current?
• Are steps being taken to incorporate emergency management into other facility processes.
• Have community agencies and organizations been briefed on the plan? Are they involved in evaluating the plan?

In addition to conducting a formal audit of the entire plan at least once a year, evaluate and modify the plan at these times:

• After each training drill or exercise and after each emergency
• When personnel or their responsibilities change
• When the layout or design of the facility changes
• When policies or procedures change

Remember to brief personnel on changes to the plan every time it is modified.

 Appendix

Business Continuity Planning – Vendor Questionnaire

As a key supplier of , it is important that we understand your level of readiness in the event of a disaster. To assist us with our business continuity planning, please fill out the information below.

Company name:

Company address:

City, state and zip:

Disaster recovery contact:

Contact’s work phone:

Equipment, supplies, materials, goods or services provided:

Please answer the following questions (circle either “yes” or “no”):

1.    Do you have a formalized business continuity program?	Yes        No
2.    Do you have a recovery plan?	Yes        No
3.    Is your recovery plan documented?	Yes        No
4.    Have you tested your recovery plan?	Yes        No
5.    Do you conduct employee disaster recovery training regularly?	Yes        No
6.    Do you maintain a copy of your recovery plan off-site?	Yes        No
7.    Do you back up critical data on a regular basis?	Yes        No
8.    Do you send your backups off-site on a regular basis?	Yes        No
9.    Do you have a formalized process to update your recovery plan?	Yes        No

Briefly describe your business continuity program:

Return completed questionnaire to:

[Insert Vendor Name]

[Insert Vendor Street Address]

[Insert Vendor City], [Insert Vendor State] [Insert Vendor Zip]

Dear [Insert Vendor Contact Name]:

is currently developing a formal Business Continuity Plan to provide for the recovery and/or continuation of our business functions following a disaster event. As part of that process, we have identified your company as a critical supplier to ’s day-to-day operations.

To assist us in our planning, it is important that we understand your ability to respond to a disaster event. Please fill out the attached questionnaire. It will take just a few minutes to complete and your prompt reply will be greatly appreciated.

Return completed questionnaire to:

,

,

Upon review of your reply, we reserve the right to contact you to further discuss your business continuity program.

Thank you in advance for your assistance.

Sincerely,

For:	Area:
Conducted by:	Date:

In the aftermath of a man-made or natural disaster, you and your company will have a number of concerns to account for as you prepare to reopen for business. Follow this checklist to ensure that you take the proper steps to recover after a disaster strikes.

Recovery Steps	COMPLETE
Decide with your partners or co-owners to dissolve your business entity. Document the decision with a written agreement.
Contact your insurance provider(s) to start the claims process.
Assess damage: –   Make note of any structural damage to building(s). –   Note any damage to equipment, machinery or company vehicles. –   Note any lost or damaged inventory (both materials for business use and products for sale).
As they come to your attention, compile a list of concerns that must be addressed before you are able to reopen.
Contact employees, suppliers and customers to inform them of any disruptions in operation and an expected date when they can anticipate it to resume.
If you have concerns that damage to a building could pose a safety hazard to employees or customers, have the building professionally inspected.
Properly secure the building while repairs are being made or if relocation of business activity is necessary.
Ensure utilities are restored and in safe working order before resuming business operations.
Properly repair and clean facility to ensure the environment is free of any safety hazards before resuming business operations.

Financial Considerations	COMPLETE
File a claim with your business interruption insurance provider.
Determine the amount of lost income the disaster has caused.
Compile the following information to share with you insurance adjuster:
–    Sales records and history
–    Profits and loss statements or income tax forms
Consider any financial responsibilities you may have, such as payroll or scheduled payments to creditors.
Keep detailed records of all expenses incurred during the recovery process.

This checklist is not intended to identify all hazards, or reflect all requirements of federal, state or local law. Additional measures may be required beyond those identified by this checklist.

Business Impact Analysis

Definitions:

–    Business Impact Analysis (BIA): examines the potential result of disruption to key business functions and collects the information necessary to determine short-term and long-term recovery objectives. A BIA includes analysis of both operational and financial impacts that could stem from the loss of key business functions. The following negative outcomes should be considered as part of a BIA:

• Personnel impacted (potential for outsourcing, overtime labor)
• Lost or delayed sales
• Regulatory fines
• Financial and relationship penalties for not fulfilling contractual obligations
• Customer dissatisfaction
• Customer loss
• Delay of new business plans

–    Business Function: an operation or process that is necessary to the ongoing success of an organization. Examples of business functions include:

• Customer service call centers
• Print and web advertising plans
• Maintenance of relationships with suppliers
• Employee recruitment

–    Recovery Time Objective: the time within which a business function must be restored after a business interruption occurs in order to prevent irreversible damage.

How to use this document:

Every business has distinct business functions in place in order for the company to operate and thrive. Some businesses will identify just a few key functions, while others will identify many. Copy and paste the table on page 2 onto subsequent pages as needed. When complete, reorder the pages by priority, with the highest priority business functions listed first. Delete this initial direction page prior to saving.

How to save this document:

It is recommended that this document be added to your Business Continuity Plan as a PDF to discourage readers from modifying the content. To do this, go to File>Save As. In the “Save as Type” menu, select “PDF.”

Save an editable version to a safe location as well.

Business Impact – Key Function Priority 1

Business Function:	Recovery Time Objective:
Business Category (delete all that do not apply): Procurement, Logistics and Distribution Operations Product or Service Development Marketing, Sales, and Customer Accounts Customer and Aftersales Services General Management and Firm Infrastructure Human Resource Management Technology and Process Development
Departments Affected:	Key Personnel:
Lost Sales and Income: One week estimate: One month estimate:	Regulatory Fines:
	Contractual Penalties:
Short-term Recovery Plans:
Long-term Recovery Plans:

California’s leader in Insurance and Risk Management

As one of the fastest growing insurance agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more.

With locations across the heart of California’s Central Valley and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our client’s know how much we value and appreciate their business.

At GDI Insurance Agency, Inc. we believe that “Our Sole Purpose is to Help Our Clients Achieve and Secure Their Dreams!”

You can download this document here!