Business Continuity Planning: Taking it from the Backburner to Front and Center

A big thank you to Whitney Claire Thomey from the Nonprofit Risk Management Center for this guest post!

Certain aspects of the risk management discipline are more compelling than others. It’s easy to see how Enterprise Risk Management harnesses the power of your organization’s strategic initiatives and bolsters the opportunity for your mission to grow and succeed. Having candid conversations about daily risks can become a simple standard practice that helps keep preventable risks in check. And annual reviews of insurance policies are necessary and routine to protect the mission from liabilities.

However, business continuity planning (BCP) often feels like a burden and is an uncomfortable, time-consuming topic to discuss thoroughly. Therefore, it rarely receives the attention that it deserves. Instead of focusing on the negative implications that disruptions cause to your organization and your mission—which often leaves BCP stuck on the backburner—realize how having a clear plan to deal with business interruptions empowers and protects the vital work that your organization does to serve your community and constituents.

Why is BCP important?

The first step in moving your organization’s business continuity plan to the front and center is establishing its value to the organization. So, why is business continuity planning so vital to a mission-driven organization?

Know in advance the critical operations

From a power outage to a pandemic, disruptions never occur on a predictable schedule. Business continuity planning shifts your organization from a defensive state to an offensive one, making sure that nonprofit leaders won’t have to scramble to respond rapidly and improvise when unexpected outages pop up. Being able to pivot quickly can make or break stakeholder trust. A primary function of your business continuity plan is to establish which operations are mission-critical, which services and processes you can do without for a finite period, and which activities can be wound down or halted indefinitely.

When a disruption does occur, response time is crucial to ensure that indispensable services are available, allowing your mission to continue with minimal downside impact. Ideally, business continuity plans are created far in advance, under low-stress conditions, making it possible for cool heads to prevail during the disruption.

One-stop-shop for contingency information

Your business continuity plan collects all kinds of essential, necessary information that make it possible for vital operations to continue in the face of any type of disruption. And it’s likely that your organization already has many of the answers! However, it’s the potency of collation that makes a BCP so powerful. By taking the time to collect and catalog procedures, processes, and points-of-contact, you remove the stress associated with being able to quickly access required resources while also dealing with a crisis in real-time.

The hidden benefit

We have established that contingency planning helps identify in advance the operations and services that are mission-critical to your organization. You’ve seen that it can be leveraged as a one-stop-shop for essential resources and points of contact for your vendors and services. But did you know that there’s an inherent hidden benefit to contingency planning?

You might be surprised to learn that the true benefit of contingency planning lies not in quickly selecting Plan B or Plan C when a disruption occurs. The actual advantage lies in the process. When teams come together to execute planning exercises to brainstorm what disruptions might happen, how they will affect the organization, and what can be done to mitigate the damages they build resilience. Essentially, it flexes the muscles needed to make thinking on your feet a salient and normalized practice. Therefore, it’s not just the final plan but also the time spent discussing and preparing a business continuity plan that helps prepare your nonprofit.

Driven by diversity

If you’ve begun drafting a business continuity plan for your organization and watched it die on the vine or get back-burnered for a more pressing project, the temptation to go it alone is enticing. However alluring it might seem to sit down and hammer out all the details without the organizational drag of a committee, this is a suboptimal approach.

A practical business continuity plan examines the organization with a holistic view. No one department or managerial level has all the answers. BCP cannot be solely focused on information technology any more than it can only consider boots on the ground operations. As organizations move through business impact analysis exercises and begin identifying the crucial areas of service that must not be interrupted, diverse perspectives make all the difference. Establishing a team of individuals representing a variety of functional groups and with differing levels of responsibility will ensure that no stone is left unturned.

Getting buy-in

It might seem like an insurmountable task to find team members who will want to hunker down and run the marathon of creating a business continuity plan. However, don’t assume that your colleagues won’t be interested! Start by asking for volunteers. It’s human nature to worry, and uncertainty causes stress and anxiety. Being involved in an effort to establish plans for combatting risk has the potential to ease anxiety and make people feel better.

People decide whether to buy-in to things when they have a stake in the investment. Consider how accomplished you feel after completing a big DIY project! This is the concept of the “IKEA Effect.” Even if you only assemble something, you immediately have a sense of ownership and accomplishment. Asking staff members to help shape the plan allows their voices and concerns to be heard and safeguards responsibilities, programs, and services that are important to them.

Break the glass! Don’t keep your BCP a secret. There is a tendency to think of continuity planning, crisis management, and succession planning as organizational secrets. Nothing in your BCP should be embarrassing or contain information staff shouldn’t know. Making the plans public among your internal stakeholders will give them comfort and empowerment to be part of the process.

Get the word out

Knowing that the organization is prepared to weather difficult times can be comforting to staff, stakeholders (your board and funders), and the community you serve. An important piece of the business continuity planning process is sharing your plans with a broad audience. With that in mind, your communications should be targeted accordingly; the message that you send to staff about the plan and decisions for enacting it won’t be the same as what you share with your community funders.

When preparing messaging about your BCP, consider creating some criteria to help you group stakeholders to ensure that the right information gets to each person. You might ask questions such as:

• Does this person play an active role in our contingency plans?
• Will this person be directly, indirectly, or not at all impacted by a disruption to our organization?
• Is this person someone we would call on for temporary support during a disruption?

Insiders – Board, Management, Staff

Some staff and management may already be somewhat aware of your organization’s business continuity plan since they likely participated in the process on some level. However, everyone inside your organization should know that the plan exists, where it exists (whether there’s a hard copy or where the digital files can be found), and the steps for activating it when an event occurs. The final step is critical, as not every incident may warrant a deviation from “business as usual.” As we mentioned before, the plan shouldn’t be a secret; it’s an invaluable asset!

External – Community, Public

The people you serve and those who support your mission will take comfort knowing that the organization has a plan to sustain and continue mission-critical activities when the going gets tough. However, there’s no need to mire them down in the nitty-gritty details of how you will shift to Plan B when the need arises. A simple one-page document with clear contact information is what the public needs to know about your response. Start with messaging you have developed for any recent disruption and tweak it to be easily customized for other situations.

If a mid to wide-spread impact occurs that causes the nonprofit to radically alter services to your community or necessitates a fundraising campaign to help support during the time of need, you’ll need to communicate requirements and changes to this stakeholder group clearly. Consider distributing your message through a variety of sources, making it easily accessible to many people.  Consider these possibilities:

• Official press releases
• Banners or tickers on your homepage with important updates
• A dedicated page or collection of pages on your website to aggregate information related to your organization’s response to the disruption and any relevant outside resources
• Special editions of your email newsletter
• Social media posts

Vendors

Maintaining an open flow of communication with your essential vendors will ensure that expectations and obligations are met even when you can’t do business like you usually would. Involving your vendors in your BCP plans will make sure that services you rely on them for will be available and operating without impact during the disruption. Points of contact may change, or the types of services that your partners can provide could be altered. Therefore, an essential step in a good vendor relationship is to have clear, open communication!

Test the waters

Having a plan isn’t enough. BCPs should be rigorously and regularly tested. As with many risk management tactics, business continuity planning isn’t a linear “one time” event. It’s a cycle that should be refined and revisited repeatedly.

The best-laid plans…

Testing is a powerful step in the BCP cycle. It is during this phase that you breathe life into the pages of your contingency plans. Executing simulations strengthens the plans that you captured by verifying that they are functional and appropriate. Your tests allow you to calmly and systematically identify any weaknesses or gaps, confirm that the objectives are met, and improve upon the drafted systems and processes. Each time your BCP is put through rigors is an opportunity to update and improve as your organization evolves and adapts. Each time trials are conducted, team members can evaluate the response and develop proficiency for the contingency. The real beauty of testing comes in being able to deliver the developed response under ideal, no-stress situations.

You say tomato, I say tomahto

Options for testing your plans are as varied as there are missions and organizations. The variety of testing options and methods means that it’s easy to find a right-sized approach for your organization, team members, and plan. Finding the best fit makes testing a reality for all organizations and eliminates excuses.

You may choose one testing method or several so long as the approach ensures that objectives mentioned above—identifying weaknesses and strengthening processes, to name a few—are met. At a minimum, consider a plan review with team members outside of the initial drafting committee. Receiving feedback from staff who weren’t a part of the planning process will shed light on any areas that were omitted or misunderstood.

Executing more complete simulations through tabletop exercises, walkthrough drills, and full functional recovery tests will provide an added layer of credibility to the plans you’ve drafted. Tabletop exercises could be completed during team meetings for your organization’s functional groups, and simulation testing can a specially scheduled all-hands meeting. The amount of time needed for each of these different methods varies greatly, and therefore gives staff and volunteers an opportunity to thoroughly vet the processes and procedures in your organization’s BCP.

Lather, rinse, repeat

Analysis, evaluation, planning, and testing must occur on a regular schedule to be genuinely useful. Making testing and training routine will ensure that when a disruption occurs, your organization will be prepared to respond as seamlessly as possible.

Testing timelines, just like your plans, must be built to suit. Some factors that will impact how often testing should occur are the size of your organization, availability of personnel (paid staff and volunteers), resources at your disposal, and the maturity level of the business continuity plan itself. What’s right for an organization in your sector might not be right for your organization! Build a testing program that makes sense for you and you increase the likelihood of its success.

Consider various employment milestones as touchpoints for your testing process. Employee and volunteer onboarding are excellent times to communicate and train new stakeholders on the plan. Their unique perspectives may offer a fresh look at methods, so incorporating this feedback will help strengthen organizational resilience. Some organizations find it helpful to set aside time quarterly, annually, and bi-annually to conduct larger-scale run-throughs. Putting these on an organizational calendar will allow departments and staff to plan and secure needed time for these intense practice sessions.

Another way to test and review your plan is to examine the contingency operations any time a significant change is made to a process or system. The plan can be reviewed and tested in smaller, digestible chunks by examining points-of-contact, lists, and procedures when changes are made. If your organization goes through an annual vendor review, take that time to ensure all contact information in your plan is current and correct.

If you have outside vendors that provide mission-critical services, consider including them in your testing protocols. For example, if your nonprofit is a human services agency that contracts with a bus company to transport clients, this outside partner provides a critical service that should be part of your exercises. At a minimum, make sure you know they have a BCP and who your points of contact will be if there’s a disruption.

Don’t let this valuable organizational resource simmer forgotten on the stove. Bring the discussion to a full boil with staff, management, and your board. The powerful resource that results will ensure the protection and safety of your organization’s mission.

What a deeper dive into BCP? Download The Business Continuity Planning issue of Risk Management Essentials, here.

The views, information and opinions expressed herein are those of the author; they do not necessarily reflect those of the Council on Accreditation (COA). COA invites guest authors to contribute to the COA blog due to COA’s confidence in their knowledge on the subject matter and their expertise in their chosen field.

Whitney Claire Thomey

Whitney Thomey serves as Project Manager at the Nonprofit Risk Management Center (NRMC). Whitney’s diverse professional experience includes project management duties in local government, legal services, web & content development, human resources, and bicycle mechanics and tour operations. Her background in Anthropology and Ethnology brings a refreshing perspective to examining internal operations and processes. Whitney earned a Bachelor of Arts degree from the College of William and Mary.