Business Continuity Management for charities

Business Continuity Management is about identifying threats to your charity, analysing their potential impacts and then taking steps to prepare for them.  

Medical personnel help each other don protective clothing.

Doctors put on protective gowns and facemasks as they prepare to treat patients with Ebola. A large-scale outbreak of a highly infectious illness could happen at any time. (Photo: CDC Global via Flickr, CC BY 2.0)

Business Continuity Management (BCM) is an important  component of good charity governance: charities should have a process in place to identify risks and plan how to respond.

BCM: a definition 

This is a commonly accepted definition of BCM:

BCM is a holistic management process that
a)  identifies potential impacts that threaten your organisation
b)  provides a framework for building resilience and the capability for an effective response that safeguards
   - the interests of your beneficiaries and stakeholders  
   - your charity's reputation & brand 
   - your organisation's income-generating activities.

BCM brings together the disciplines of risk assessment, emergency response, disaster recovery and business continuity.

Why is BCM getting more important

  • Climate change impacts: extreme weather events are occurring more often 
  • Terrorism: the Government has said that there is a sustained threat of terrorist events
  • Pandemics: regular large-scale outbreaks of infectious diseases
  • Supply chain complexity: longer supply-chains and outsourcing of services can mean that impacts can come from many sources
  • Digital technology: greater reliance on any one resource - in this case,  i.t. and data, can increase vulnerability to disruption
  • Insurance: insurance companies increasingly want to see evidence of business continuity planning 
  • Governance: risk management requirements, trustees' awareness
  • Stakeholders: your service-users may need additional support and safeguarding

How to set up a BCM framework

BCM is a process which needs to be managed and communicated across the organisation. 

  1. Introduce: Discuss the need for BCM at senior level and assign responsibility. BCM will require staff time and may involve additional expenditures. A senior person should have ownership of the process and be able to assemble a small team to work on BCM.
     
  2. Assess risks:  Identify risks and how a worst-case scenario would impact critical activities.
     
  3. Identify responses: For each risk, set out what action your charity would take. Prioritise critical functions.
     
  4. Plan: Identify what processes and resources your charity needs to put in place in order to achieve resilience and implement them. There may be additional costs involved, such as paying for backup services. 
     
  5. Document and communicate: compile key information into a well-organised document, inform staff and stakeholders about it, train key staff.
     
  6. Test: don’t assume your plan will work, test your proposed measures. Testing can include regular fire drills, testing your emergency communications chains (eg a staff WhatsApp group) and "walking through" a specific risk scenario with a group of key staff to see how your planned response works.
     
  7. Maintain: new and different threats will keep emerging, review your BCM plans at least once a year and whenever new risks emerge or your charity undergoes significant changes.

What should be in your business continuity plan?

Your business continuity plan is designed to help your charity to prepare for a critical incident or major crisis. It should contain all the information necessary to get your charity operating again after such an event.

1. An assessment of risks

This risk assessment includes

  • a review of potential threats to your charity's operations  
  • an assessment of the likelihood of these risks
  • an analysis of the potential impacts 
  • a list of risks that need to be addressed, in order of priority

2. Critical operations / impact analysis

This section of your plan looks at which operations your charity must maintain to continue operating. It sets out:

  • the activities which are critical
  • the resources (including people and equipment) that are needed to keep critical functions operating
  • the impacts if critical activities are interrupted. 

3. Response

The section sets out the actions your charity will take in response to a critical incident or crisis. It will set out how your charity will protect critical operations. For example, if a building becomes unusable, you might make arrangements to ensure that your charity always has access to contingency office space with functioning i.t. 

A business continuity pack

You can combine all essential information into a business continuity pack which can be distributed to key staff in both hard copy and digital format. Ensure that at least one copy of this pack is stored safely and securely in an off-site location.

Contents:

  • A copy of your detailed business continuity plan
     
  • Emergency contact details for all staff (home, mobile phone numbers and email addresses) and any emergency contact chains.
     
  • A site plan with information the shut-off points for utilities 
  • Emergency contact details and key details needed for:

    1. Emergency services

    2. Local authorities

    3. Utility companies

    4. Key contractors, eg plumbers, glaziers

    5. Travel advisors

    6. Insurance

    7. Banks 

    8. Legal advisors

Documentation and communication 

A great plan is no use if nobody knows about it! Documenting and communicating BCM is essential if it is to be effective. 

Communicate your business continuity actions to senior staff and the key people in each area of your charity. Ensure that they know about the processes which you have put in place, where to find critical information and what their next actions should be.

BCM guidance

The Government has prepared a Business Continuity Management Toolkit (PDF) which you can use to get started. 


The British Standards Institute has published the standard ISO 22301 for BCM


The Business Continuity Institute has a selection of resources on its website. 

The London Resilience Partnership brings together over 170 organisations which have specific responsibilities for preparing for, and responding to, emergencies. Its website offers advice on protecting your organisation and planning for emergencies.

More on safety and risk: 

How to do a risk assessment

Date published
2018-03-03