Every Charity Needs a Business Continuity Plan. The Havoc Caused by Recent Storms Proves That.
My sympathy goes out to every charity in the UK which has been affected by flood damage after two consecutive weekends of storm. I know what it feels like, because a charity and community centre I used to be responsible for operated from a100-year-old former primary school building that got flooded. We carried out roof repairs and improved site drainage and yet, despite all our best efforts, the building remains vulnerable.
During one particularly bad rainstorm, our newly refurbished reception and offices were overnight flooded and wrecked. It was a horrible experience for staff, volunteers and clients, and the road to recovery was a long one. Yet it could have been so much worse. Thankfully we had a business continuity plan, which was updated without fail every year. Trust me, it made all the difference between a very bad situation and complete disaster.
That’s why I want now to share what you need to do to put your own plan in place. Flooding is, after all, just one of the many risks which a charity might face. You need to know what to do in the event the worst happens.
Why every charity needs a business continuity plan
Updating your organisation risk assessment and business continuity plan can seem like a faff. One of those jobs that many of us can all too easily put on the back burner, behind what appear to be more urgent tasks fighting for our attention.
Please don’t let this be the case. A key lesson I learned as CEO of a charity is that it’s a mistake to view your business continuity plan as a paper exercise. It isn’t. On the contrary, it is an essential go-to document for when the unexpected occurs and disaster threatens. This is important because whatever the nature of emergency your organisation faces at the time, everyone’s first reaction is inevitability one of disbelief and shock. Even strong leaders can struggle to think straight.
A business continuity plan helps you take control even as you inwardly reel under the pressure of anxious – perhaps panicking – staff, volunteers and clients. Its purpose is to provide a pathway to managing the effects of major incidents that are likely to have a high impact. A business continuity plan will also direct and assist staff at an earlier stage: in both managing and mitigating the risks you identify as pertinent to your organisation.
The following sets out what you need to do to create a good business continuity plan.
1. Impact Analysis
Table 1 – Areas of Activity and Service
Set out the main activities and services you provide in the first column. Then, in the next column and against each item, write the facilities that the activity or service relies upon. In the third column rate the likelihood of this facility becoming suddenly unavailable as ‘high’, ‘medium’ or ‘low’. Use the fourth column to describe the impact the loss is likely to cause, e.g. ‘total loss of operations’. In the fifth column, rate how much of a priority you give to that activity or service being available at all times. Use plain english column headings like ‘Activity/Service’, ‘Facilities needed’, ‘Likelihood’, ‘Impact’, and ‘Priority’.
Be as comprehensive as possible. Note that at this stage you are not trying to identify the nature of the risks, only your different areas of activity and how critical they are to your overall operations. Make sure to include key backroom tasks like finance and payroll, as well as frontline activities like project management.
Table 2 – Types of Major Incident
This time set out in the first column what might constitute a major incident. Obvious examples might be an electrical power failure, fire damage, flooding, loss of IT and related equipment, criminal damage or a cyber attack. You could also include fuel shortage, bad weather, a flu or other viral infection that could incapacitate several members of staff all at the same time. Might you also include strike action? A cash flow crisis? Or the unexpected resignation/loss of a key member of staff? The list is really up to you, but be prepared to spend some time pondering different scenarios that could potentially cause an emergency at your charity.
Against each item in the first column, rate the ‘Probability’ of the incident happening (high, medium or low), then the level of ‘Impact’ it would likely create (high, medium or low). Use the last column to guess the ‘Likely Duration’ of that impact (short term, medium term or long term).
These two tables together create your Risk Assessment. You will be able to see the emergency scenarios which pose the greatest and most likely challenge to your organisation. Your trustees and senior management now need to consider what preventative measures should mitigate and/or reduce the risk involved. Action may need to be taken.
The next part of the business continuity plan is all about recovery for when, despite the mitigating measures you have taken, a major incident occurs.
2. Recovery Plan
This section should set out all the information you will need in the event of a major incident.
2.1 The Recovery Team
The recovery team of any charity should include at least one trustee and also a senior manager. Other useful team members might be your office manager, site manager and your IT specialist. Their contact details must be included in the business continuity plan, and the inclusion of private details necessitates an appropriate privacy notice. If a major incident occurs, there should within any organisation be an obvious initial contact (usually the office manager), who has access to the business continuity plan and can alert the recovery team.
2.2 Burglar alarms and building access information
If passwords and entry codes change, the person responsible for the business continuity plan needs to ensure it is kept up to date each time that happens. Yes, this may seem a tiresome task, but consider the alternative: finding out a colleague couldn’t even get into a building to rescue important items from your flooded office because they tried an out-of-date entry code.
2.3 Taking action
This should include:
- identifying a temporary location for the recovery team to work from
- informing the organisation’s insurers and to request a visit by their loss adjuster
- notifying staff, trustees, volunteers and key organisations
- informing families of staff affected by the incident
- giving support to staff where loss of life or personal injury has occurred
- arranging for the building/office to be secured to protect assets
- surveying areas affected to assess staff working conditions
- surveying areas affected to assess loss of data and/or equipment
- issuing a press release if appropriate
Your initial objective is to re-establish the charity’s primary assets within an agreed timeframe. For example, you might set a deadline of three days in which to identify temporary alternative location if your charity office is unusable. Also to reinstate access to financial software, payroll and communications. Think about what else you would include specifically for your organisation.
You should then list secondary objectives within a slightly longer timeframe, and lastly a third list of actions leading to a ‘Return to normal business’ and how long you envisage that taking. You must include in this last list the action of making a written report for your next board meeting. It should contain recommendations for managing any implications of longer term impact (e.g. loss of a contract) and, where necessary, additional ways to mitigate or reduce future risk of a similar major incident happening again.
Your business continuity plan must be crystal clear about where responsibility lies at each point, including who is accountable for reviewing the plan annually and testing the assumptions within it. Those assumptions – for example, checking that office contents are appropriately insured – should be listed.
3. Contact details and other useful information
The last part of your business continuity plan is your list of key personnel and suppliers with their contact details. It goes without saying that keeping this up to date is essential. Fast communication can be the difference between being able to take control of an emergency and a situation turning into a disaster.
I hope this article is helpful and that, like me, you will learn to appreciate the huge value and relief a good business continuity plan can bring. I guarantee that you will get the rewards of your hard work one day when, almost inevitably, your charity suffers one kind of major incident or another. Be ready for it!
Send your feedback and opinion on this article
I would love to have your feedback on this article and hear any suggestions you might have to improve or add to it. Write to me at firstname.lastname@example.org and let’s continue this conversation.
About the Author – Jenny Hopkins is founder and content curator for The Boiling Frog. She also works as an adviser to small and medium-sized charities, specialising in strategy and business planning. Do get in touch to find out how she can help your organisation adapt to our changing world. Contact email@example.com
Share this story
I have been lucky enough to work with – and on – some good boards in the charity sector. That may surprise you, given that trustees generally come in for a lot of flak – not least from their own CEOs and senior managers. The thing is, good boards don’t happen overnight. You achieve them with patience, care and forethought.
Charities are no different to any other sector in that they are being challenged by the rise of digital. But their slowness to adapt means they face being left behind.
It once seemed that charities could do no wrong, but in recent years the misdemeanours of a high-profile few has put the whole sector on the back foot with the public.