Business Continuity Management for charities
Business Continuity Management is about identifying threats to your charity, analysing their potential impacts and then taking steps to prepare for them.
Business Continuity Management (BCM) is an important component of good charity governance: charities should have a process in place to identify risks and plan how to respond.
BCM: a definition
This is a commonly accepted definition of BCM:
BCM is a holistic management process that
a) identifies potential impacts that threaten your organisation
b) provides a framework for building resilience and the capability for an effective response that safeguards
- the interests of your beneficiaries and stakeholders
- your charity's reputation & brand
- your organisation's income-generating activities.
BCM brings together the disciplines of risk assessment, emergency response, disaster recovery and business continuity.
Why is BCM getting more important
- Climate change impacts: extreme weather events are occurring more often
- Terrorism: the Government has said that there is a sustained threat of terrorist events
- Pandemics: regular large-scale outbreaks of infectious diseases
- Supply chain complexity: longer supply-chains and outsourcing of services can mean that impacts can come from many sources
- Digital technology: greater reliance on any one resource - in this case, i.t. and data, can increase vulnerability to disruption
- Insurance: insurance companies increasingly want to see evidence of business continuity planning
- Governance: risk management requirements, trustees' awareness
- Stakeholders: your service-users may need additional support and safeguarding
How to set up a BCM framework
BCM is a process which needs to be managed and communicated across the organisation.
- Introduce: Discuss the need for BCM at senior level and assign responsibility. BCM will require staff time and may involve additional expenditures. A senior person should have ownership of the process and be able to assemble a small team to work on BCM.
- Assess risks: Identify risks and how a worst-case scenario would impact critical activities.
- Identify responses: For each risk, set out what action your charity would take. Prioritise critical functions.
- Plan: Identify what processes and resources your charity needs to put in place in order to achieve resilience and implement them. There may be additional costs involved, such as paying for backup services.
- Document and communicate: compile key information into a well-organised document, inform staff and stakeholders about it, train key staff.
- Test: don’t assume your plan will work, test your proposed measures. Testing can include regular fire drills, testing your emergency communications chains (eg a staff WhatsApp group) and "walking through" a specific risk scenario with a group of key staff to see how your planned response works.
- Maintain: new and different threats will keep emerging, review your BCM plans at least once a year and whenever new risks emerge or your charity undergoes significant changes.
What should be in your business continuity plan?
Your business continuity plan is designed to help your charity to prepare for a critical incident or major crisis. It should contain all the information necessary to get your charity operating again after such an event.
1. An assessment of risks
This risk assessment includes
- a review of potential threats to your charity's operations
- an assessment of the likelihood of these risks
- an analysis of the potential impacts
- a list of risks that need to be addressed, in order of priority
2. Critical operations / impact analysis
This section of your plan looks at which operations your charity must maintain to continue operating. It sets out:
- the activities which are critical
- the resources (including people and equipment) that are needed to keep critical functions operating
- the impacts if critical activities are interrupted.
The section sets out the actions your charity will take in response to a critical incident or crisis. It will set out how your charity will protect critical operations. For example, if a building becomes unusable, you might make arrangements to ensure that your charity always has access to contingency office space with functioning i.t.
A business continuity pack
You can combine all essential information into a business continuity pack which can be distributed to key staff in both hard copy and digital format. Ensure that at least one copy of this pack is stored safely and securely in an off-site location.
- A copy of your detailed business continuity plan
- Emergency contact details for all staff (home, mobile phone numbers and email addresses) and any emergency contact chains.
- A site plan with information the shut-off points for utilities
Emergency contact details and key details needed for:
Key contractors, eg plumbers, glaziers
Documentation and communication
A great plan is no use if nobody knows about it! Documenting and communicating BCM is essential if it is to be effective.
Communicate your business continuity actions to senior staff and the key people in each area of your charity. Ensure that they know about the processes which you have put in place, where to find critical information and what their next actions should be.
The Business Continuity Institute has a selection of resources on its website.
The London Resilience Partnership brings together over 170 organisations which have specific responsibilities for preparing for, and responding to, emergencies. Its website offers advice on protecting your organisation and planning for emergencies.
More on safety and risk: