Disruption Happens. You Need a Business Continuity Plan.
Estimated Reading Time: 4 minutes
By Rachel Sams
Lead Consultant and Editor
Resource Type: Risk eNews
Topic: Business Continuity Planning
When a nonprofit colleague asks me what risk management step would benefit their organization most in times of uncertainty and frequent disruption, I often ask them, “Do you have a business continuity plan (BCP)?”
Often, the first response is a furrowed brow. Then I frequently hear a statement like, “We know we need to do that, but it sounds like a ton of work, and we have more pressing issues.”
We get it! It’s hard to imagine planning for something that hasn’t happened yet when what’s happening in front of you feels so all-consuming. Whether you want to believe it or not, some form of disruption to normal operations will happen—and it could happen soon. When it does happen, things will be intense enough that starting your planning from scratch will be painful.
The good news is that business continuity planning doesn’t mean creating a 100-page plan with detailed procedures to respond to every type of disruption imaginable. That’s not possible, necessary, or even helpful.
Focus on anticipating and planning for “impacts.” How would a period of disruption affect your ability to staff your programs? Deliver services? Access and operate facilities?
A simple BCP of 10 pages or less can help your nonprofit navigate:
- Cyberbreaches
- Natural disasters
- Major facility issues
- Public health emergencies
- And much more!
Here’s how to get started.
Identify Goals Related to Continuity and Potential Impacts
Identify a few simple goals for business continuity. Examples might be to keep essential operations running for clients, maintain staff safety, and minimize data loss during a data breach. Select the members of your planning team. Include any departments that would face a major impact during a business disruption and team members who have expressed an interest—or worries—about disruptions. Brainstorm what the biggest impact to your organization during a business disruption might be.
Establish General Principles
It’s good practice to start your BCP with any guidelines your team will want to consider in an emergency. This is a great place to outline or remind staff of daily policies that come into play in an emergency, like policies that all staff must provide a cell phone number that can receive text alerts during an emergency. Include your organization’s emergency notification phone chain, where emergency messages will be posted for staff, and any instructions for posting those messages.
Function and Contact Information
NRMC’s Business Impact Analysis form, available at nonprofitrisk.org, is a fillable PDF that prompts you to identify your organization’s key functions and the maximum acceptable downtime for each. Next, identify the recovery timeframe and strategies for each function. What will you need to do to bring each function back online in the designated timeframe? Who will be involved?
Congratulations! You’ve just completed a major part of the legwork of your BCP. The remaining steps will help you fully build it out.
Crisis Communication/Disaster Recovery Plans
Add any existing crisis communication or tech-related disaster recovery plans here. Even if you don’t have those plans, list all external vendors you might need to contact in an emergency, from payroll to external PR counsel to IT providers.
Practice, Train and Test
Plan a simple tabletop exercise with a couple of business interruption scenarios to allow your staff to practice how they’d carry out the plan. After any training exercise, hold a brief after-action review. What went well? What could your team improve on for the future and how?
Need More Support?
Sometimes, it’s helpful to have an outside perspective or external support to get a BCP to the finish line. For a more self-service option, consider our easy-to-use, collaborative My Business Continuity Plan web app at mybusinesscontinuityplan.org, available for $149 or $29 for NRMC Affiliate Members.
If your team needs more support, NRMC is debuting a new consulting offering that gives nonprofits train-the-trainer guidance on identifying essential functions and developing recovery strategies. We’ll also provide feedback on your draft BCP worksheets and pull all the information together to create your business continuity plan. Learn more here.
Rachel Sams is Lead Consultant and Editor at the Nonprofit Risk Management Center. She teaches business continuity planning to nonprofit professionals in NRMC’s Emerging Risk Leaders Certificate Program. Reach her with thoughts and questions about business continuity planning at rachel@nonprofitrisk.org or (505) 456-4045.
“One thing I love about the Risk Summit is the opportunity to connect and learn from other risk managers, nonprofit professionals, and NRMC staff. I have attended the Risk Summit multiple years and always look forward to connecting with returning attendees and meeting new people. The Risk Summit brings together a diverse and engaged set of professionals who are ready to learn, share, and connect.”
— Heather Chadwick
“I love the Risk Summit because I always learn something valuable, such as new approaches to the issues I’m grappling with. I always leave the Risk Summit with a notebook full of practical ideas. I also leave with an expanded network of professional acquaintances and a feeling it was the most useful conference I’ve been to in quite a while. I am in awe how such a topic as risk management can be artfully delivered.”
— Paul Doman
“One thing I love about the Risk Summit is the ability to see and feel the passion of nonprofit leaders as they learn and share together.”
— Michael Schraer
“One thing I love about the Risk Summit is connecting and learning from / with really great people.”
— Lisa Prinz
“First let me congratulate you on a conference well done. I had a great time at the Nonprofit Employee Benefits Conference and walked away with some valuable tools and questions that we’ll need to be addressing in both the short and long term. Thanks to you and your staff for all you do to provide us with quality resources in support of our missions.”
— Scott Brown, Mohonk Preserve
“BBYO’s engagement of NRMC to conduct a risk assessment was one of the most valuable processes undertaken over the past five years. Numerous programmatic and procedural changes were recommended and have since been implemented. Additionally, dozens (literally) of insurance coverage gaps were identified that would never have been without the work of NRMC. This assessment led to a broker bidding process that resulted in BBYO’s selection of a new broker that we have been extremely satisfied with. I unconditionally recommend the Center for their consultative services.
— Sidney Abrams, BBYO
“Melanie Herman has provided expert, insightful, timely and well resourced information to our Executive Team and Board of Directors. Our corporation recently experienced massive growth through merger and the Board has been working to better integrate their expanded set of roles and responsibilities. Melanie presented at our Annual Board of Director’s Retreat and captured the interest of our Board members. As a result of her excellent presentation the Board has engaged in focused review which is having immediate effects on governance.”
— Pamela Mattel, Basics Promesa Systems Inc
“The Nonprofit Risk Management Center has been an outstanding partner for us. They are attentive to our needs, and work hard to successfully meet our requests for information. Being an Affiliate member gave us access to so many time- and money-saving resources that it easily paid for itself! Nonprofit Risk Management Center is truly a valued partner of The Community Foundation of Elkhart County and we are continuously able to optimize staff time with the support given by their team.”
— Jodi Spataro, Community Foundation of Elkhart County
“The board and staff of the Prince George’s Child Resource Center are extremely pleased with the results of the risk assessment conducted by the Nonprofit Risk Management Center. A thorough scan revealed that while we are a well run organization, we had risks that we never imagined. We are grateful to know that we have now minimized our organizational risks and we recommend the Center to other nonprofits.”
— Marti Worshtil, Prince George’s Child Resource Center
Great American Insurance Group’s Specialty Human Services is committed to protecting those who improve your communities. The NRMC team has committed to delivering dynamic risk management solutions tailored to nonprofit organizations. These organizations have many and varied risk issues, hence the need for specialized coverage and expert knowledge for their protection. We’ve had Melanie speak on several occasions to employees and our agents. She is always on point and delivers such great value. Thank you for the terrific partnership and allowing our nonprofits to focus on their mission!