Business continuity and crisis management

Business continuity plans should be working documents. Once written, you should keep them up-to-date and test them regularly to see how well they are likely to perform in the event of an emergency. To make testing useful, it is advisable to test against credible, but challenging scenarios.

It may help to do a few things in advance of the test, such as:

• agree clear testing criteria and procedures
• agree how you will document the findings
• determine how and when you will correct problems identified during the test

Although by their nature crises are hard to simulate, there are many ways you can assess your business continuity plan against different crisis scenarios.

How to test business continuity plans

Common types of tests to help you assess the effectiveness of your plan include:

• checklist tests
• table-top exercises
• structured walk-throughs
• scheduled simulations
• full recovery / interruption tests

As well as running these tests, it's important to verify all the details contained in the plan. For example, check that the key contacts and phone numbers are correct. Having to find the right number in a crisis could use up valuable time and delay your response.

How often should you test your business continuity plan?

Many businesses test their continuity plans two to four times a year. How often you should do this depends on different factors, including the type of your business, the turnover of staff and the changes in processes and technology used in the business since the last round of testing.

Why should you test your business continuity plan?

Rigorous testing should verify that your plan is effective and fulfilling its purpose. It will also allow you to:

• train staff involved in the recovery of the business
• identify areas where you might need to strengthen your plan
• demonstrate the ability of your company to recover

See also the advantages of business continuity planning.

If you outsource certain functions in your business to a third party, you should assess the adequacy of their business continuity plan and its compatibility with your own plan.

Maintain your business continuity plan

Creating and initially testing your plan will require a good deal of effort and time. However, the work doesn't stop there. You will have to update your plan regularly to take into account the changing circumstances of your business. For example, if you move into new business premises you could face an entirely new set of risks. You'd need to draw up new maps for the emergency services and amend any contact numbers necessary.

It may help to review your business continuity plan annually and carry out this review alongside testing to ensure that your plan remains effective.

Business continuity standard

To get an accurate picture of how your continuity plans and procedures align with best practices, you may want to assess them against a relevant international standard. The ISO 22301 standard specifies the requirements for a management system to protect against, reduce the likelihood of, and ensure your business recovers from disruptive incidents.