Three Chords & The Truth: Methods for Approaching Business Continuity Planning

(download The Business Continuity Planning issue of Risk Management Essentials, here.)

By Melanie Lockwood Herman

Many nonprofit leaders are seeking a clear, ‘best practice’ approach to creating a business continuity plan for their organization. Preferably a simple, straightforward approach that won’t take too much time. Or too much effort. Or rock the boat.

This article offers three pathways to creating a BCP for your organization. But fair warning: the actual process of drafting a plan takes time, effort, and perseverance. If you need some support or steady guidance, consider purchasing our web application, My Business Continuity Plan.

What You Need to Know about BCPs

A business continuity plan is a resource that helps you accomplish two vital tasks:

1. Identify mission-critical functions or activities that must continue during a period of sub-optimal operations. You won’t be able to operate ‘normally’ if your building is inaccessible, your staff can’t get to their customary work stations, or your clients are facing unusual amounts of stress.
2. Outline strategies and processes—essentially a roadmap—to support the orderly resumption of operations.

Now that you understand what a BCP should do, here are three possible ways to go about creating a BCP for your nonprofit.

Path #1 – Structure by Events

Structuring a BCP based on disruptive events—think hurricane, act of terrorism, power failure, COVID-19—is the most common way to build a BCP. A plan with this structure describes the steps and strategies an organization will take if one of these events occurs. What’s the downside?

First, things rarely turn out the way we expect they will. A Cat-5 hurricane may turn into a Cat-2. A novel coronavirus diagnosed on the other side of the planet could turn into a global, trillion-dollar event. Next, plans structured by events tend to be very duplicative: each section describes actions, people, roles, priorities, activities, and more that may overlap with the same strategies and functions used for another event. Finally, a plan structured by events includes the incidents we’ve experienced before or those we can envision. Every organization has now faced a situation—the global pandemic—that honestly, none of us previously imagined.

The upside of a BCP structured by events is that it is essentially a collection of mini plans that may feel highly relevant in the moment. Here’s a way to approach the development of a BCP structured by events.

Step 1

List the highly disruptive events that could negatively impact your nonprofit. For example:

• Weather events: hurricanes, earthquakes, tornadoes, severe storms, landslides, winter storms, extreme heat, and flooding. (Hint: don’t include weather events that aren’t relevant to your location!)
• Accidents: fire, explosions, car/bus accidents
• Systems failures: power grid failure, septic failure, water main break, information system corruption
• Human events: terrorism, workplace violence, civil unrest, cyberterrorism
• Disease/health: pandemic, epidemic, outbreak

Step 2

Create a one-page summary of key steps and strategies related to each type of disruptive event. Using a weather emergency for example: if your procedures are likely to be the same regardless of the ‘type’ of weather event, simplify with a one-pager covering all weather events. However, if your response to winter storms is entirely different from your response to a hurricane, you probably need separate summaries for each.

Consider whether it makes sense to create BCP ‘levels’ that correspond to the impact or potential impact of the disruptive event. For example:

Level 1: some systems, people, and functions are impacted; minor scaling back or shuttering of programs is necessary

Level 2: various systems, people, and functions are impacted; some programs and activities will need to be curtailed

Level 3: the entire agency is negatively impacted; only mission-critical programs and activities will continue; all other activities will be scaled back per this plan

Step 3

Identify your chain of command and decision-making approach for the BCP. For example:

• The Crisis Team is responsible for determining whether the interruption is a Level 1, Level 2, or Level 3 event.
• Once a Level has been announced, the plans associated that Level will begin
• Executive Team members are responsible for keeping the Crisis Team apprised about the implementation of the BCP, including any difficulties their teams are experiencing

Step 4

Create an Appendix with resources that will be helpful during a disruption. For example:

• Key points of contact for your facilities and systems
• Emergency services agencies and first responders
• Evacuation maps/diagrams
• Disaster/emergency kit contents lists
• Contact information for key personnel, especially those providing management and support during an interruption

Step 5

Review and discuss the draft BCP with a diverse team! In The Art of an Idea, John Hunt writes that:

“Working with people of different backgrounds doesn’t just give the group a different point of view, it makes you reassess your own. This is extremely powerful because we’re all trapped in what we’ve previously learnt. And ‘previously learnt’, often means what we’ve previously been told. And that’s usually not true or entirely accurate.”

Here are some question prompts to make your discussion productive:

• Will we know what to do—and who will do it—based on the contents of this plan?
• Do we feel more confident—or more uncertain—about our resilience with this plan?
• What are the strengths of this plan?
• What are the weak points?

Path #2 – Structure by Function

Another way to develop a plan is to draw on your existing functions and departments and ask each functional team to develop a mini BCP. The upside of this approach is that it doesn’t pit functions and activities against each other: each function determines what its top priority is and how it will scale back during an interruption.

Step 1

Consider creating a worksheet to help guide the BCP conversations of the functional teams. Here’s an example:

Step 2

Bring representatives of the functional teams together to discuss their mini BCPs. Discuss the implications of the plans developed by the teams. Here are possible discussion questions for that gathering:

• As you review the mini BCPs of the other functions, what questions do you have?
• Are the lists of mission-critical responsibilities reasonable given the potential stress we will be under during a significant interruption? (think COVID-19 or an extreme weather event that forces our main offices to close)
• As you take another look at your plan, are there any activities you would move from one category to the other?
• Are the “Actions if BCP Triggered” plans reasonable? Sufficiently detailed?

Path #3 – Structure by Impact

One of the powerful lessons the NRMC team has learned from our three decades as risk advisors is that myriad risk events have similar and sometimes overlapping impacts. If you reflect on the resources and capabilities needed to deliver your mission, it’s not hard to see how very different events could negatively impact those resources. For example:

• A fire/explosion, tornado, pandemic, or power grid failure could make it impossible to work from your headquarters office.
• School closures due to extreme weather, a pandemic, or power event could make it impossible for your staff who are parents to work from the office
• A hurricane, severe storm, or pandemic could make it unsafe for your team to travel to and work from your headquarters
• Any disruptive event could make it difficult or impossible to access systems and resources housed in your primary facilities.

Here are a few possible steps to develop a BCP that is structured by the impacts of the disruption on your organization.

Step 1

Form a small team to develop your BCP based on impacts. Make sure that your team includes participants with experience in all or most areas of activity in your nonprofit!

Step 2

Identify the critical impacts of disruptive events. Consider using a chart or ‘cheat sheet’ to get the ideas flowing!

Step 3

For each identified impact, brainstorm or ‘writestorm’* ideas to cope with that impact. Remember to examine potential strategies to resume operations as soon as practical. Consider using a chart or worksheet to support the process.

*writestorming is like brainstorming, except participants initially jot down their ideas instead of sharing them out loud. Once everyone has the prescribed number of ideas, the facilitator goes around the virtual or actual meeting room and asks each participant to share one idea. Additional sharing rounds continue until everyone has shared all of their ideas. Writestorming is especially helpful in groups where extroverts tend to dominate!

Step 4

Bring the BCP team back together to identify next steps. For example:

• Share the material created through the brainstorming exercise with the executive team
• Share the material created with the entire staff team; invite anonymous feedback and proposed changes by using a survey tool
• Ask each BCP team member to meet with their respective teams to share the results of the exercise and invite feedback

Step 5

Implement the preferred next steps identified in Step 4 and focus on getting your BCP in shape and ready to use. For example, share the results of the exercise and the contents of the BCP with all internal stakeholders. Identify external stakeholders who would benefit from knowledge of the plan. Choose a date or timeframe to review and update the plan, such as 12 months from the date it is adopted internally.

The Truth about Business Continuity Planning

There’s no one way or right way to develop a BCP for your nonprofit. The best news is that any plan you’ve created in advance of an interruption is likely to be helpful in the moment. Keep in mind that events are very unlikely to unfold as you imagine they will. Flexibility during a disruption is key to protecting your mission and keeping the momentum high for mission-critical activities. The most crucial next step is to get started. Don’t delay. Your mission and your community are too vital for your organization to be unprepared to act when the next disruption happens.

 Melanie Lockwood Herman is the Executive Director of the Nonprofit Risk Management Center. She welcomes your questions about business continuity planning and NRMC products and services at 703.777.3504 or Melanie@nonprofitrisk.org.