Business Continuity Plan

March 2020

GIVE YOUR SUGGESTIONS IN TIME

​There were several Amendment Bills came for a public comments this month. The latest one that have the last date on 28th March 2020 to register your comments is on draft Companies (Corporate Social Responsibility Policy) Amendment Rules,2020. Hurry up and give your expert advice to make the legislation better.

In this edition, we will be seeing about Business Continuity Plan (BCP). The most needed strategy for business owners, which we the professionals can guide them in creating a better plan. We will have our usual Legal terms and News Bites related to notifications by MCA, SEBI, RBI, IT and GST from this month whenever possible.

CEO CS Saranya Deivasigamani,

CEO

BUSINESS CONTINUITY PLAN (BCP) 

When a Company faces an expected or unexpected potential threat in continuation of business, a proper Business Continuity Plan (BCP) helps the Company survive in the turmoil.

A proper Business Continuity Plan enables the Company to protect it’s personnel and assets and ensure that they are able to function quickly in the event of disaster.

BCP typically contain a checklist that includes supplies and equipment, data backups and backup site locations. It also involves in identifying plan administrators and include contact information for emergency responders, key personnel and backup site providers. BCP is a document that provides detailed strategies on how business operations can be maintained for both short-term and long-term outages.

Anatomy of a BCP

The first step to start a BCP is to assess the business process, determining which areas are vulnerable, and the potential losses if those processes go down for a day, a few days or a week. This is essentially a Business Intelligence Analysis.

To develop a BCP there are six steps in general:

  1. Identify the scope of the BCP.
  2. Identify key business areas.
  3. Identify critical functions.
  4. Identify dependencies between various business areas and functions.
  5. Determine acceptable downtime for each critical function.
  6. Create a plan to maintain operations.

One common BCP tool is a checklist that includes supplies and equipment, the location of data backups and backup sites, where the BCP is available and who should have it, and contact information for emergency responders, key personnel and backup site providers.

Remember that the Disaster Recovery Plan (DRP) is part of the BCP, so developing a DRP e should be part of the process. If the organization already have a DRP, it need to be sure that restoration time is defined and “make sure it aligns with business expectations.”

As a process of creating BCP, the organization shall consider interviewing KMP in organizations who have gone through a disaster successfully. People generally like to share “war stories” and the steps and techniques (or clever ideas) that saved the day. Their insights could prove incredibly valuable in helping you to craft a solid plan.

Testing BCP

Testing a BCP is the only way to truly know it will work.

The organization have to rigorously test a plan to know if it’s complete and will fulfill its intended purpose. Many organizations test a BCP for two to four times a year. The schedule depends on the type of organization, the amount of turnover of KMP and the number of business processes and IT changes that have occurred since the last round of testing.

Common tests include table-top exercises, structured walk-throughs and simulations. Test teams are usually composed of the recovery coordinator and members from each functional unit.

A table-top exercise usually occurs in a conference room with the team poring over the plan, looking for gaps and ensuring that all business units are represented therein.

In a structured walk-through, each team member walks through his or her components of the BCP in detail to identify weaknesses. Often, the team works through the test with a specific disaster in mind. Some organizations incorporate drills and disaster role-playing into the structured walk-through. Any weaknesses should be corrected and an updated plan distributed to all pertinent staff.

It’s also a good idea to conduct a full emergency evacuation drill at least once a year. This type of test lets you determine if you need to make special arrangements to evacuate staff members who have physical limitations.

Lastly, disaster simulation testing can be quite involved and should be performed annually. For this test, create an environment that simulates an actual disaster, with all the equipment, supplies and personnel (including business partners and vendors) who would be needed. The purpose of a simulation is to determine if you can carry out critical business functions during the event.

During each phase of business continuity plan testing, include some new employees on the test team. “Fresh eyes” might detect gaps or lapses of information that experienced team members could overlook.

Review BCP

Much effort goes into creating and initially testing a BCP. Once that job is complete, some organizations let the plan sit while other, more critical tasks get attention. When this happens, plans go stale and are of no use when needed.

Technology evolves, and people come and go, so the plan needs to be updated, too. Bring KMP together at least annually to review the BCP and discuss any areas that must be modified.

Prior to the review, solicit feedback from staff to incorporate into the plan. Ask all departments or business units to review the plan, including branch locations or other remote units. If you’ve had the misfortune of facing a disaster and had to put the plan into action, be sure to incorporate lessons learned. Many organizations conduct a review in tandem with a table-top exercise or structured walk-through.

How to ensure BCP support, awareness

One way to ensure that the BCP is not successful is to adopt a casual attitude toward its importance. Every BCP must be supported from the top down. That means senior management must be represented when creating and updating the plan; no one can delegate that responsibility to subordinates. In addition, the plan is likely to remain fresh and viable if senior management makes it a priority by dedicating time for adequate review and testing.

At the emergency situation like this when the government requests employers to allow work from home option and other sudden inconvenient situations, BCP policy in an organization helps it to continue the business without any hurdles. Management understanding the importance of BCP and communicating the awareness with it’s employees will have a greater impact on all employees, giving the BCP more credibility and urgency.

As a professional advising the top management, we should be aware of the policy and guide the management in creating a best BCP suitable for their organization.

Legal Term

Aid and Abet

To aid and abet means to assist another person in the commission of a crime by words or conduct actively, knowingly, and intentionally. 

NewsBites

MCA Updates

Explore Zappy '