#VJMEJOH
#VTJOFTT
3FTJMJFODF

Business Continuity Planning

Guide
Contents
5IF
DPNQSFIFOTJWF
BQQSPBDI
                              3FDPWFSZ                                                       

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
What is the comprehensive approach?. . . . . . . . . . . . . 1 Recovery Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Business Continuity Planning . . . . . . . . . . . . . . . . . . . . . . . . 1 Recovery strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Your Recovery Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1SFWFOUJPO
                                                      After the crisis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Key points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
What is risk? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Risk and business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 :PVS
#VTJOFTT
$POUJOVJUZ
1MBO
                          

What is risk management? . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Introduction
                                            20

Benefits of risk management . . . . . . . . . . . . . . . . . . . . . . . . . 3 Your Business Continuity Plan . . . . . . . . . . . . . . . . . . . . . 20
Identifying risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Rehearse, maintain and review . . . . . . . . . . . . . . . . . . . . 22
Analysing the risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Test your plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Evaluating the risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Why bother?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Treating the risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Continuous Improvement . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
The Risk Management Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Learning from the past . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Key points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Key points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Business Continuity Plan template . . . . . . . . . . . . . . . 23
1SFQBSFEOFTT
                                                

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Business Impact Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Key points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3FTQPOTF
                                                      

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Incident Response Management . . . . . . . . . . . . . . . . . . . 12
Examples of Business Crises . . . . . . . . . . . . . . . . . . . . . . . . 12
Characteristics of a crisis . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Putting together an Incident Response Team . . . . 13
Your Incident Response Plan . . . . . . . . . . . . . . . . . . . . . . . . 13
Key points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Disclaimer

This publication has been produced to provide a guide for people anticipating going into business and for business owners.
It should not be regarded as an exhaustive presentation on the subject. Whilst the Department of Employment, Economic
Development and Innovation believes this publication will be of great assistance to its readers, the Department expressly
disclaims all liability for errors or omissions of any kind whatsoever (whether negligent or otherwise) or for any loss, damage
or other consequence which may arise from any person relying on the publication.

The publication is issued on the understanding that the Department is not engaging in rendering any legal or other
professional service. If legal or other expert assistance in relation to the subject matter is required, the advice of a competent
professional should be sought.

©The State of Queensland (Department of Employment, Economic Development and Innovation) Year of Publication 2009

Inquiries should be addressed to the Manager, Small, Medium Enterprise Development, Department of Employment,
Economic Development and Innovation.

Version: 1 October 2009

5IF
DPNQSFIFOTJWF
BQQSPBDI
Introduction t
Response: As part of the whole process of
– Actions taken to respond to developing your Business Continuity
The comprehensive approach to Plan there should also be rehearse,
an incident in terms of
disaster management recognises maintain and review components
containment, control and
four elements of emergency/ where actions are taken to ensure
minimising impacts. This
disaster management – Prevention, your plans continue to meet the
element is largely covered by
Preparedness, Response and needs of your business over time.
Incident Response Planning.
Recovery (PPRR). PPRR is a
framework or model which has been t
Recovery: Depending on the size and nature of
used by Australian emergency your business, you may choose to
– Actions taken to recover
management agencies since the have separate Risk Management,
from an incident in order to
1980’s. The model anticipates crises Business Impact Analysis, Response
minimise disruption and
and utilises sequential planning and and Recovery Plans, or for a small
recovery times. This element
implementation of actions before, business, a single plan that
is largely covered by
during and after an event. incorporates all the above elements
Recovery Planning.
may be sufficient.
By following this approach you will
be able to develop a Business Business Continuity
Continuity Plan for your business. Planning
Business Continuity Planning is a
What is the process used to develop a practical
comprehensive approach? plan for how your business could
The comprehensive approach to recover or partially restore critical
emergency or disaster management business activities within a
incorporates the key components of predetermined timeframe after a
Prevention, Preparation, Response, crisis or disaster. The resulting
and Recovery (PPRR). plan is called a Business Continuity
Plan (BCP).
t
Prevention:
#VTJOFTT
$POUJOVJUZ
1MBOOJOH
1SPDFTT
– Actions taken to reduce or
eliminate the likelihood and/
or effects of an incident. This 1SFWFOUJPO
Risk Management Plan
element is largely covered by
Risk Management Planning.
t
Preparedness: 3FDPWFSZ 3FIFBSTF
NBJOUBJO
1SFQBSFEOFTT
Recovery Plan BOE
SFWJFX Business Impact Analysis
– Actions taken prior to an
incident to ensure an
effective response and 3FTQPOTF
Incident Response Plan
recovery. This element is
largely covered by Business
Impact Analysis.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
1SFWFOUJPO
Introduction These events can, and do, happen What is risk management?
to businesses all the time. They can
Prevention includes the directly affect your day-to-day
The risk management process
identification of risks, the operations or impact on profits and
consists of a series of steps that,
assessment of threats to life and result in financial losses that may
when undertaken in sequence,
property, and ensuring protective be serious enough to cripple the
enable continual improvement in
measures are in place to reduce business or even bankrupt it.
decision-making. They are:
potential loss of life, property and
business damage. Risk management It is not always easy to recognise
Step 1: Identify risks that could
largely captures the entire the hazards or threats that can lead
impact your business.
prevention aspect of the to adverse consequences. For
comprehensive approach. example, unless you have Step 2: Analyse risks to assess their
experienced a fire you may not impacts.
realise how extensive fire damage
What is risk? Step 3: Evaluate risks to prioritise
can really be. Damage to the
their management.
building and its contents are
A risk is the likelihood of something
obvious exposures, but you should Step 4: Treat risks to minimise their
happening as a result of a hazard or
also consider damage from smoke impact.
threat and the impact it will have on
or water, damage to employee’s
your business activity. Risk arises Step 5: Develop and review your Risk
property (personal belongings,
out of uncertainty. It is measured in Management Plan.
tools etc) and to property belonging
terms of the likelihood of it
to others (machinery and equipment
happening and the consequences if Risk management is not something
leased from other businesses).
it does happen. that you will do once – you will need
There is also the impact on the
to constantly monitor and review the
business during the time that it
strategies you are using to manage
Risk and business takes to get the business back to
risk. Risks do not always remain the
normal and the effect of customers
same. You may find that, over time:
Every business has risks. Just think and staff who may not return when
for a moment about the hundreds of you re-open the business. t
new risks are created
things that most business owners
t
existing risks are increased or
worry about. While a few are
decreased
predictable, others are not. You can,
however, plan for and control risks t
risks no longer exist
to a certain extent. Some of these t
the priority order of risks changes
could be changing salary costs,
t
risk treatment strategies are no
taxes, overhead expenses,
longer effective.
equipment and supply costs.

Others are unpredictable and

largely beyond your control such as
actions your competitors may take,
changing tastes and trends,
disasters, industrial accidents and
global economic factors such as
rising oil costs and increased costs
of raw materials.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Prevention

Benefits of risk Identifying risks t
Workplace Health and Safety

management t
Security (e.g. theft, fraud,
Risks can be both internal and
technology intrusion, IP,
Risk management processes are all external to your business. Risks can
terrorism, extortion)
about businesses reviewing all be hazard based (for example
areas of the business to evaluate chemical spills), uncertainty based t
Economic and financial (e.g.
possible risks and putting in place (such as natural disasters) or rising input costs, interest rates,
strategies for treating those risks. associated with opportunities product life cycle timeframe,
Sound strategies would assist in (taking them up or ignoring them). failure to pay)
producing the following benefits: Businesses often fail to look at risk t
Personnel (e.g. industrial
broadly enough and tend to relations, human error, inability
t
ensuring business continuity consider the most obvious things to fill vacancies)
t
reducing insurance premiums like fire, theft, and market
t
Supply chain (e.g. failure,
competition. The questions to ask
t
reducing your chance of being interruption)
yourself are:
sued in certain circumstances
t
Inputs (e.g. rationing,
t
reducing the time when the t
What could cause an impact? restrictions, removal of item
business may be unable t
How serious would that from supply)
to operate impact be? t
Market (e.g. changes in consumer
t
allowing for a plan to replace t
What is the likelihood of this preference, competition)
key personnel occurring? t
Political/civil unrest (e.g. from
t
reducing the loss/damage to t
Can it be reduced or eliminated? supplier countries or in countries
machinery and other equipment to which you export)
that is necessary for the efficient Some common risk categories are
t
Government policy changes (e.g.
running of the business listed below.
tax, industrial relations, carbon
t
strengthening your capacity to t
Natural disaster events footprint policy)
stay in business. (e.g. floods, storms, bushfire, t
Failure/interruption of utilities
drought, pandemic) and services (e.g. power, water,
There are also limitations with the
risk management processes that t
Legal (e.g. insurance, transport, telecommunications)
you should be aware of, including: liability, staff, safety,
warranties, contracts) Once you have established the
t
risk management will not categories of risk that could affect
t
Technology (e.g. failure, your business you need to identify
eliminate all risk – it is
obsolescence) the risks within each category. You
impossible to plan for and treat
all of the risks to your business t
Regulatory (e.g. water can do that in a number of ways,
restrictions, restriction on including brainstorming with key
t
accidents can and will happen,
operation time, quarantine staff members.
and this may lead to an incident
restrictions, carbon emission
t
your ability to manage risk will restrictions)
be influenced by your resources,
t
Property and equipment
budget, time and the
(e.g. fire, flood, vandalism)
information that you have
available to you. t
Environmental (e.g. chemical,
pollution)

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
1SFWFOUJPO
$BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ

Throughout this workbook we will The key assets of his businesses

be referring to a fictitious are:
business run by Bill Smith. Bill is
t
stock/inventory
34 years old, married with two
children. He is the Director and t
Intellectual Property
sole shareholder of “Bill Smith (saddle designs)
Saddlery” which he has owned t
factory premises.
and operated since 2000.
The main sources of income for
He has: his business are:
t
two stores (Warwick and t
sale of saddles and
Beaudesert) plus online sales accessories to the
t
one factory (at home) making recreational horse industry
saddles and other accessories customers

t
six staff (three full-time and t
sale of saddles to Queensland

three casual) saddleries (wholesale).

t
revenue $95,000 per month. His key resources are:

Let’s look at identifying the risks t
factory equipment

to his business that would affect
t
saddle materials.
his ability to continue to operate
and profit. Through the Listed below are three risks to his
identification of these risks Bill business that can be prevented:
will be able to develop a risk
t
loss of production
management plan that protects
his business from potential harm. t
loss of key supplier
t
insufficient cash to meet
expenses.

Listed below are three risks that

cannot be prevented:

t
loss of staff
t
natural disaster
t
loss of on-site records.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Prevention

Analysing the risks $BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ

Once you have identified the risks to
your business, you need to assess
the impact of those risks. You want Looking at the identified risks to
to separate minor acceptable risks
Bill’s business, the consequence
from major risks which must be
managed immediately. and likelihood of each risk
would be:
This involves deciding on the
relationship between the likelihood Identified risk Likelihood Consequences
(frequency or probability) and the
1. Loss of production L VH
consequences (the impacts) of the
risks you have identified. 2. Loss of key supplier M H
3. Insufficient cash to meet expenses L H
Risk = consequence x likelihood
4. Loss of staff H M
The result is a level of risk, often 5. Natural disaster M VH
described as low, medium, high or 6. Loss of on-site records M H
very high, that should be analysed
in relation to what you are currently
doing to control it. Remember,
control measures decrease the
level of risk, but do not always
eliminate it.

This risk analysis can be

documented in a matrix. Different
organisations use different ratings,
and you may want to tailor
something to suit your own
business. A simple example of a risk
matrix is given below.

Likelihood
Consequence
Low Medium High Very high

Low Low Low Medium Medium

Medium Low Medium Medium High

High Medium High High Very high

Very high High High Very high Very high

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
1SFWFOUJPO
Evaluating the risks Some decisions in this regard have
already been made for you such as
Once you have identified the risks to those required by law (eg workers’
your business and analysed them compensation) and others required
for their likelihood and by customers or clients (where
consequence, you need to evaluate lenders will finance a vehicle, but
your risks to determine whether require you to take out insurance
they are acceptable or require before they pass over the loan).
treatment. You may decide that
some risks are acceptable because As far as obtaining insurance is
the costs of treating the risks concerned, make time for a full
outweigh the benefits. discussion with an insurance
professional who will take you
Those risks that are not considered through all the methods of risk
acceptable or tolerable should be cover and put in place what the
treated or controlled, in order to business needs. If you are not
either reduce or eliminate negative already insured or your current
consequences, or to reduce the insurance cover has not been
likelihood of an adverse incident. reviewed recently you should
consider discussing your needs with
your insurance company or
Treating the risks your broker.
Risks may be treated in a number of
Aside from insurance, businesses
ways including:
can also treat risks through:
t
avoid the risk – make the
t
developing contingency or
decision to discontinue the
‘back-up’ plans
activities or processes giving
rise to risk t
quality control processes

t
reduce or mitigate the risk – take t
staff training

measures to reduce the t
implementing Workplace Health
likelihood or impact of the risk and Safety strategies
t
share the risk – transfer or share t
properly maintaining facilities,
a portion of the risk to reduce it plant and equipment
t
retain or accept the risk – make t
using appropriate security
a decision to take no action due devices
to a cost/benefit analysis.
t
establishing appropriate
Insurance is one method of sharing systems and controls
risk. You pay an insurance premium, e.g. segregation of duties
rather than run the risk of not being (cash receipting, banking
protected against the possibility of and accounting)
a much larger loss.
t
undertaking pre-storm
In business insurance you can and cyclone season
decide which exposures you preparedness checks.
absolutely must insure against and
which ones you can cover yourself.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Prevention

$BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ

In Bill’s case the risks identified It is often either not possible or

above could be treated as cost-effective to implement all
follows: treatment strategies. A business
owner should aim to choose,
1. Loss of production – purchase
prioritise and implement the
business interruption
most appropriate combination of
insurance and source
risk treatments. For example, in
alternative production site.
the case of ‘loss of production’
2. Loss of key supplier – above, the business may not be
identify alternate suppliers able to afford to purchase
and build working business interruption insurance
relationship with them. because the cost of the insurance
is greater than the potential
3. Insufficient cash to meet
financial loss. It may be more
expenses – introduce weekly
cost effective to source an
cash flow reviews and
alternative production site in the
quarterly forecasts to identify
short term.
when and how much cash is
required. Make adjustments
to spending to ensure there is
sufficient cash to meet
expenses when required.

4. Loss of staff – ensure all

staff are properly trained and
there is succession planning
in place.

5. Crisis/disaster – ensure
insurance is in place and the
business has a plan on how to
respond in the event of a
disaster, eg fire, severe storm.

6. Loss of on-site records

– ensure back ups of
computer records and
financial data exist and are
stored at a different location.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
 Risk management plan – Bill Smith Saddlery

3JTL
EFTDSJQUJPO 1SFWFOUBUJWF
BDUJPO $POUJOHFODZ
QMBOT

-JLFMJIPPE
1SJPSJUZ

$POTFRVFODF
t
1VSDIBTF
CVTJOFTT
JOUFSSVQUJPO
JOTVSBODF t
*NNFEJBUF
BDDFTT
UP
QFSTPOBM

Loss of production L VH M resources whilst waiting for
t
4PVSDF
BMUFSOBUJWF
QSPEVDUJPO
TJUF insurance payments
1SFWFOUJPO
The Risk Management Plan



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

t
*EFOUJGZ
BMUFSOBUF
TVQQMJFST
BOE
CVJME
XPSLJOH
SFMBUJPOTIJQ
XJUI
t
1VSDIBTF
GSPN
BMUFSOBUJWF
TVQQMJFST

Loss of key supplier M H M them or use suitable substitute products
collated and displayed in a table as shown:

t
*EFOUJGZ
TVJUBCMF
TVCTUJUVUF
QSPEVDUT

t
*OUSPEVDF
XFFLMZ
DBTI
nPX
SFWJFXT
BOE

XFFL
GPSFDBTUT
UP
t
*ODSFBTF
CVTJOFTT
XPSLJOH
DBQJUBM

Insufficient cash to identify when and how much cash is required from personal cash reserves
H VH VH
meet expenses t
.BLF
BEKVTUNFOUT
UP
TQFOEJOH
UP
FOTVSF
UIFSF
JT
TVGmDJFOU
DBTI

to meet expenses when required

t
&OTVSF
BMM
TUBGG
BSF
QSPQFSMZ
USBJOFE t
$POUBDU
SFDSVJUNFOU
BHFODZ
UP

source short term contract staff until
Loss of staff H M M t
1VU
TVDDFTTJPO
QMBOOJOH
JO
QMBDF suitable permanent replacement
t
-PDBUF
SFDSVJUNFOU
BHFODJFT
JO
ZPVS
BSFB staff can be sourced

t
&OTVSF
JOTVSBODF
JT
JO
QMBDF
t
*NNFEJBUF
BDDFTT
UP
QFSTPOBM

The results of this risk management process for Bill Smith Saddlery can now be

Natural disaster M VH H resources whilst waiting for

t
%FWFMPQ
B
CVTJOFTT
DPOUJOHFODZ
QMBO
PO
IPX
UP
SFTQPOE
JO
UIF
insurance payments
event of a disaster, eg fire, severe storm

Loss of on-site t
&OTVSF
UIFSF
BSF
CBDLVQT
PG
DPNQVUFS
BOE
mOBODJBM
SFDPSET t
6TF
CBDLVQ
EBUB
UP
SFTUPSF
MPTU
mMFT

M H H
records t
4UPSF
B
DPQZ
PG
BMM
EBUB
BU
B
TFQBSBUF
MPDBUJPO

Key: VH = Very high

H = High
M = Medium
L = Low
 Prevention

Key points Be realistic

Determine which risks you can
6OEFSTUBOE
ZPVS
CVTJOFTT accept and which ones you need to
You need to have a complete picture treat. Put strategies in place for
of the interactions inside your treating those risks. Ask yourself,
business and between you, your how much could you afford to lose if
customers and suppliers. Make sure a crisis prevented you from doing
that you also understand the business for days, weeks or
environment you operate in. months? How would suppliers,
customers and potential customers
Assess the risks to your react if your business received
adverse publicity because you were
business unprepared for a critical incident?
Every business has risks. You need
to identify and analyse the risks that Take a long-term approach
may have an adverse affect on your
Regularly review and update your
business and choose the best
risk assessment to keep up with the
method of dealing with each of
changes in the business and the
these identified risks.
variations in your risk. This is an
ongoing process otherwise it will
lose relevance. Ensure your staff
understands that risk management
is everyone’s responsibility.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
1SFQBSFEOFTT
Introduction $BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ
Preparedness involves:

t
taking action prior to an incident

occurring to ensure an effective The Department of Primary Critical business activities:
response and recovery Industries & Fisheries (DPIF) has
t
purchasing materials
t
being proactive and planning for declared an alert due to the
the likelihood of an event that suspicion of a series of Equine t
purchasing stock
has the capacity to interrupt Influenza (EI) outbreaks in t
manufacturing
your business operations
SE Queensland. The DPIF had
t
a personal commitment to dispel t
distribution.
previously been in an
any thoughts that “it won’t
investigation phase where it Description of critical business
happen to me”.
collected and collated disease activities:
Preparedness is all about being
proactive and planning. Business data. The DPIF has notified
t
purchasing of quality leather
Impact Analysis (BIA) largely (via an Industry Alert) relevant
and materials for production
captures the preparedness aspect stakeholders and key response
of PPRR. of saddles
staff have been placed on
standby. No restrictions are t
purchasing of stock for the
Business Impact Analysis store at the lowest price
currently in place.
Every business has numerous from suppliers
activities in its overall operations In preparing for a possible
t
manufacturing process of
but only a percentage will be key to outbreak of EI, Bill needs to
saddles
its survival. The purpose of a identify the key information
Business Impact Analysis (BIA) is to t
distribution of saddles to own
about his business.
gather information to determine
store and others for sale.
basic recovery requirements for your Key stakeholders:
business in the event of a crisis. Possible impacts:
It will show which parts of your t
bank
business will be most affected by t
Revenue and costs:
an incident and what effect it will t
landlord
have upon the business as a whole. – probable drop in sales by
t
leather supplier
In other words, a BIA is used up to $20,000 per month
to establish: t
equipment lessor
– inability to pay fixed costs
t
your critical business activities t
staff
and rent due to decreased
t
the resources required to t
customers. income.
support each activity
t
the impact of ceasing to perform
these activities.

As part of your BIA you should

assign Recovery Time Objectives
(RTO) to each activity. The RTO is the
time from which you declare a
crisis/disaster to the time that the
critical business activity must be
fully operational in order to avoid
serious financial loss.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Preparedness

Key points

Identify your critical

t
Staffing:
business activities
Take the time to identify the
– may be necessary to let
operations that are most critical to
some staff go the success of the business on a
day-to-day basis, and determine
– casuals would go first and
how long you can go with each of
a skeleton full time staff those activities not available.
would be kept to operate
the stores. Concentrate on the impact
not the incident
t
Product/service:
What will the impact of the loss or
– popular products, such as interruption to critical business
saddles may not sell activities be on your business?
Spend your time establishing
– apparel and clothing lines exactly how it will affect your
may continue to sell, business and what you need to do
to manage the situation. Identify the
but with a reduction in
immediate impacts and subsequent
sales numbers. consequences and get ahead of
them if you can.
Recovery Time Objectives:
6OEFSTUBOE
UJNF
GSBNFT
t
purchasing materials – 48 hrs
Assign a Recovery Time Objectives
t
purchasing stock – 1 week (RTO) to each activity. The RTO is
t
manufacturing – 2 weeks the time at which the activity must
be back in operation or impact to
t
distribution – 2 weeks. the business will result. Once an
RTO is established for each activity,
Priority of critical business a prioritisation of the activities can
activities (on a scale of 1 to 5 with take place.
1 being the most important and
5 being the least important)
6TF
ZPVS
#*"
UP
JOGPSN
ZPVS

recovery planning
t
purchasing materials – 2 Your BIA will help you to determine
t
purchasing stock – 3 the strategies or actions you need
to include in your recovery plan.
t
manufacturing – 1
t
distribution – 1.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
3FTQPOTF
Introduction t
Terrorist attack t
key people will be busy and
t
Industrial accidents unable to do normal duties
The Response phase of PPRR occurs
t
Computer tampering – crises can make it difficult
as the incident happens and
or even impossible to carry
immediately after. It covers actions t
Systems failure out your normal day-to-day
taken to respond to an incident in
t
Product defects/recall activities
terms of containment, limiting loss
to life and property and preventing t
Hazardous material leak t
external support may be required
incident escalation. Response t
Explosion – you may need to consult
generally involves an operational, with the Police and/or
t
Economic downturn
management and communications Emergency Services
response. Incident Response Of course, each business will have
Management largely captures the t
lack of quality information,
their own vulnerabilities and it is
response aspect of PPRR. answers and time
important that you spend time
identifying those that could – during the first few hours of
significantly affect the running of a crisis you may not know
Incident Response
your business. Take a hard look what to say, what to do or
Management what’s really happened –
at your business, examine
A crisis can be defined as anything potential vulnerabilities from every activate your Incident
that has a negative impact on your angle, and seek out potential Response Plan to avoid
business. Incident Response problems in your dealings with your making rash decisions
Management is a business plan customers, your employees, and t
media and stakeholder interest
of action that is implemented even your suppliers. will be intense
quickly when such a negative
– activate your communications
situation occurs.
Characteristics of a crisis plan immediately a crisis is
Although crisis events are often established – your
There are some common
unpredictable, they are not always communications with
characteristics of all crisis events.
unexpected. Typically, these crises authorities and stakeholders
They include:
have the capacity to have negative must be open, honest, timely
financial, legal, political, t
possible physical danger and accurate
or governmental repercussions on
– physical safety and t
news travels fast
the business, especially if they are
protection should always be – when a crisis develops,
not dealt with in a prompt and
your first priority during prompt and proactive
effective manner.
a crisis communication is essential
Examples of Business Crises t
confusion, friction, pressure and – the hours and days
stress will exist immediately following a crisis
Hundreds of threats exist for every are often the most important
business. Crises can take many – when a crisis hits, take a few
in shaping public perception
forms including: moments to stop and think
of the event
– try to keep calm, issue
t
Natural disasters clear instructions, and send
t
Pandemics for assistance if you need to
t
Extortion or embezzlement



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Response

Putting together an t
A spokesperson Your Incident Response

Incident Response Team – The spokesperson should be Plan
the one voice responsible for
When a crisis hits time is a all internal and external Your Incident Response Plan should
luxury you never have. Before a communications and should be simple without being simplistic.
specific crisis occurs, you need to be trained in dealing with Although you will never be able to
put together an Incident Response plan your response in detail for every

2–Prevention
the media. Your
Team with the expertise to spokesperson must create possible event, remember that
understand and evaluate the and build the perception that people need to be able to react
specific crisis and come up with the the business is under quickly in an emergency – stopping
solutions that can help your control; that the company to read lots of detail may make that
business cope with it. Team knows and understands more difficult.
members should have a backup and what is happening; and that
everyone must be clear about their it will resolve the situation. Your plan should include:
roles. To be effective, an Incident
t
Others t
clear direct instructions for the
Response Team should include:
crucial first hour after a crisis hits
– Depending on your business,
t
Team leader t
a list of the personnel who
you may also include
– The team leader should be personnel from departments have the authority to invoke
someone who knows the such as HR, IT, security and the plan and under what
business inside and out, other specialists who have circumstances this should occur
and who can take full specific expertise regarding t
a list of Response Team members
responsibility for the your business. and their backups as well as a
ongoing management of a detailed explanation of their roles
crisis incident. During a crisis do not burden your
Incident Response Team members and functions in response to
t
Response team with other duties. The crisis should a crisis
– This team, or individual in be their top and only priority. t
checklists that people can
a small business, must be easily follow
able to make decisions, t
an evacuation plan
approve recommendations
t
a ‘GO pack’ – an emergency kit
and provide direction in the
containing critical documents
event of a crisis.
and equipment which can be
t
Assessors picked-up and quickly and easily
– Assessors, along with their carried off-site
backups, are responsible for t
contact lists for both internal and
assessing the business external personnel
interruption impact and
t
an Event Log to record
providing feedback to the
information, decision and
entire Incident Response
actions in the period immediately
Management Team.
following the critical event
or incident.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
3FTQPOTF
$BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ

The Department of Primary The top 5 things he could do His stakeholders who would
Industries & Fisheries (DPIF) has immediately would be: require management during the
now confirmed an outbreak of EI crisis period would be the bank,
1. Obtain as much reliable
in South East Queensland. his staff, his suppliers and
information on the outbreak
his landlord.
t
Several horses have already so informed decisions can
succumbed to the disease. be made. He should also consider the
t
Containment areas have been situation where his current cash
2. Review and invoke his
declared and all movement of reserves do not meet his current
Business Continuity Plan,
horses in SE Qld has been bills by:
including his Incident
suspended for a minimum of Response and Recovery t
collecting all accounts
four weeks. plans. receivable (debtors) as soon
t
In addition, a case of EI as possible
3. Assess cash reserves and
has also been confirmed in t
identifying any assets that
determine the cash needs of
NSW, with authorities also could be sold
the business.
implementing strict
t
identifying any new markets
movement restrictions in 4. Cancel or reduce orders of
where demand for product
that State. stock for the next month.
exists
This crisis could impact Bill’s 5. Inform staff of likely effect on
t
reducing costs where possible
business in a number of ways. business and possible
and consider reducing staff or
reduction in work hours.
t
revenue for at least the next staff hours
month would likely be down t
making new arrangements
t
he would have a potential with stakeholders for
build up of stock payment such as extended
terms of trade, larger
t
he might also need to use
discount for early payment or
his cash reserves to meet
accepting some stock lines
bill payments.
on consignment.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Response

Key points Assume worse case and

that the situation will
Define the real problem escalate
and determine strategy What is the worst thing that can
accordingly

3–Preparedness
happen to your business? How will
Examine the situation quickly, you deal with it? If there is even a
confirm the precise details of the slight chance that it could happen,
incident and decide on the assume that it will and develop
appropriate action. strategies to deal with it.

Respond quickly and Cultivate and call on subject

effectively matter experts and allies
The first hour is vital. If a critically Depending on your business and
injured person is treated within one the type of crisis, you may need
hour, their chances of survival specialists in public relations, legal,
increase significantly. Pretty much management, personnel, or
the same applies to crisis security. For example, if you have
management. If your crisis response the possibility of a chemical spill,
is quick, your chance for business ideally a chemist ought to be on the
survival increases. team so you know what risks the
chemical does or does not pose to
6OEFSTUBOE
UIF
DIBOHJOH
the general public.

situation and manage

information effectively
Keep on top of the crisis and
communicate changes in the
situation as quickly as you can.
There is often no way to tell how
long your particular crisis will last,
so regularly assess the momentum
of the situation.

#VTJOFTT
$POUJOVJUZ
1MBOOJOH | Guide 
3FDPWFSZ
Introduction Recovery strategies t
Be prepared for the possibility of
broken or damaged equipment,
Recovery includes actions taken to Your recovery strategies should machinery and systems. Know
recover from an incident (this may demonstrate a clear understanding who can fix them and have their
not always be possible). Recovery of your business’s recovery contact details at hand. Consider
can be broadly divided into: objectives and reflect what the renting or borrowing equipment
business needs to continue. if possible.
t
Resumption (continuity) of
You should:
business activities t
Plan for disruptions to electricity,
t
Establish a Recovery Team, gas, water, sewerage and
t
Restoration (recovery)
assign backups and ensure telecommunications systems.
of resources.
that all are aware of their Are backup systems available?
roles and functions in the Are there alternatives that can
Recovery Planning recovery process. be used?

t
Establish a disaster recovery t
Be prepared for cashflow

Whilst Incident Response is
location where employees may emergencies. Keep enough cash
concerned with events as they
work off-site, when necessary, on hand to handle immediate
unfold during a crisis or emergency,
and are able to access critical needs and consider setting up
recovery planning is a proactive
back-up systems, records and internet banking services.
approach to getting the business
back on its feet in the shortest supplies. This may be a room or
possible time after such an event. space at another business Your Recovery Plan
It is vital that you take recovery location or at a hotel or home.
planning seriously. It is not a task t
Determine which assets, Your Recovery Plan should contain
that can be left until you can including documents, are information relating to planning
find enough time to deal with it – essential for recovery and for recovery and resumption of
a serious incident can occur at therefore require protection. critical business activities after a
any time. Make sure essential crisis or emergency has occurred.
documentation is safely stored It should include:
As with all of your plans, the
off-site or in fireproof cabinets. t
strategies to recover your
more work done during the
planning process, the better your t
Make sure that you have contact business activities in the
business’s chance of recovery. lists of all people who may be quickest possible time
Not only does the planning process affected by the incident,
t
resources required to recover
get everyone thinking about the including staff, key customers
your operations
needs of the business during a and suppliers and your
critical event, it also puts people in insurance company. You may t
your previously identified
the right mindset for preparing for need to let your customers and Recovery Time Objectives
the unexpected. suppliers know of alternative
methods of contacting you or t
the people who have
placing orders and what to responsibility for each task/role.
expect from your business in the
event of a lengthy outage.
t
Develop relationships with more
than one supplier, so that if one
is affected by an incident your
business can continue as usual.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Recovery

After the crisis t
Keep staff informed throughout

the recovery process. They may
Once the incident is over, there are a be concerned about:
number of steps that you need
– colleagues who may be
to take:
injured
t
Assess the extent of the damage – what is expected of them
caused during the crisis. Record:
– whether they should turn up
– injury to any people,
for work the next day
including staff, clients and
other members of the public – whether they will still have
a job.
– damage to buildings,
equipment, company t
Look into the possibility of
vehicles and stock applying for government support
programs to assist the recovery
– impacts on your business
of your business after a
functions
critical incident.
– damage to your reputation t
Each crisis provides an
t
Conduct a critical incident opportunity for learning to occur
debrief and plans to be revised. As part
of this process you need to
– Within 48 hours, preferably
ensure that you record what you
within 24 hours, following a
have learnt, update your plan
critical incident, hold a
accordingly and conduct a
meeting for debriefing
critical incident review after
employees. The purpose of
every incident. The questions
the critical incident
asked should include:
debriefing is to help
employees understand some – What went well and
of the reactions they may what didn’t?
have, by encouraging – What key lessons were
employees to gain support learned?
from each other, and by
allowing them an – What changes do we need to
opportunity to verbalise their make to our business
thoughts and feelings. processes?

#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide 
3FDPWFSZ
$BTF
TUVEZ
°
#JMM
4NJUI
4BEEMFSZ

It is now four weeks after the What practical recovery activities t
He also needs to test and
initial alert of EI. The Department could he be doing? review his plan on a regular
of Primary Industries & Fisheries basis to ensure that it
t
Hold sale of old stock to
(DPIF) has moved to the stand- continues to meet the needs
increase cash.
down phase of their response of his business.
due to no additional reported t
Set new sales targets to
t
He needs to ensure that he
cases of EI. Most DPIF increase cash reserves.
understands his business
investigative and operational t
Manage landlord and set up a both financially and non-
activities have ceased and most repayment agreement. financially. To do this he must
restrictions on horse movements spend more time looking over
t
Advise staff of position and
have been lifted. the accounts and planning his
new sales targets.
Bill has assessed his financial t
Engage in direct and cheap cashflow.
position: marketing. t
He must relate the possible
t
Identify where the business changes in the market and
t
he knows that his current
will sit in the market post his customers to the financial
cash reserves will only last
the crisis. effects on his business so
three more weeks and
he can proactively run
therefore he must increase What lessons can he learn and
his business.
sales or find other sources how can he incorporate these
of cash back into his business?
t
his inventory is still high and
t
Planning is essential as it
expenses have been reduced
gives him a framework to
to a minimum
keep his business going
t
he has missed one lease should another crisis occur.
payment. He must continue to set goals
and have a continuity plan for
his business at all times and
not just when a crisis exists.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Recovery

Key points Identify alternate suppliers, Do not forget the human

facilities, processes aspect of crisis recovery
Continue to communicate t
The crisis may be affecting Keep a watchful eye on
with all key stakeholders your suppliers. Determine personnel after a critical incident.
Conduct periodic debriefing how you would source Allow employees to discuss any
sessions with recovery teams to alternative supplies. feelings which have come up since
monitor progress and determine t
Think what you would do in a the critical incident debriefing and
problem areas. Keep the lines of crisis if your premises couldn’t monitor their progress.
communication open with clients be used.
and suppliers as well. Effective and
t
If you use vital pieces of
proactive communication will create
equipment, you may want to
and build the perception that the
cover them with maintenance
business is under control, that you
plans guaranteeing a fast
know and understand what is
emergency call-out.
happening and that the situation
will be resolved.
Make sure that you have
Ensure staff understand and adequate insurance
collectively work towards coverage
recovery efforts. You should have coverage for when
your supplier/s are affected by a
It is vital that everyone on your staff
crisis and can not deliver necessary
takes the development and
supplies as well as coverage for the
maintenance of the recovery plan
loss of income you would incur if
seriously and demonstrate a clear
customers affected by the crisis
commitment to establishing and
stop ordering your product or
maintaining an effective recovery
service. Ensure that you also have
planning process.
appropriate insurance to cover other
related issues such as on-site
injuries to staff or visitors or for loss
of your customers’ goods or
materials.

#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide 
:PVS
#VTJOFTT
$POUJOVJUZ
1MBO
Your Business Part Content Purpose
Continuity Plan
Distribution list and Detail: Lists the personnel who
associated are to receive that plan and
Introduction documents
t
who is to receive a copy of
the documents you may
the plan
t
other associated plans need to refer to. eg.
Your Business Continuity Plan (BCP)
Response Plan, emergency
should contain all of the information t
checklists
evacuation procedures,
required to ensure that your t
policy and procedures.
Recovery Plan, etc.
business is able to resume critical
business activities in the event of Introduction/ Broad description of the plan Provides an overall picture of
a crisis. executive summary to be executed, including what is to occur in order to
priorities, opportunities, and maintain business continuity.
Depending on your business, you assumptions.
may choose to have separate Risk
Management, Business Impact Objectives Clear and concise statement of Provides guidance to team
Analysis, Incident Response and the objectives of the plan. members on the objectives
Recovery Plans, or for a small of the plan which will allow
staff to work to that intent
business, a single Business
and make decisions in
Continuity Plan, which incorporates changing situations.
all the above elements, may
be sufficient. Glossary Lists terms used in the Provides an explanation of
document. terms, definitions and
acronyms that are used
Your Business Continuity throughout your BCP.
Plan
Risk management Details: May be a separate plan or part
Alongside is a suggested structure
t
identified risks of your BCP. Allows you to
for a Business Continuity Plan plan to minimise risks by
t
their likelihood
incorporating all of the above putting mitigation strategies
t
their consequences.
elements. This should be used only in place.
as a reference to get you started.
Business impact Details: Identifies the effect of
analysis t
comprehensive list of different external and
business activities internal impacts upon the
t
their affect on operations various parts of your
business in times of crisis.
t
resource requirements
Identifies the time that your
t
critical activity priority
business can survive without
list.
critical activities.

Incident response Documents the tasks that will May be a separate plan or
plan be required to manage the part of your BCP. Provides all
initial phase of an incident the information the
and the individual responsible organisation needs to ensure
for each task. that it can manage the
immediate incident.

Plan activation Clear statement of Sets out the process for

circumstances when plan mobilising and standing down
should be invoked and the list the relevant teams.
of personnel authorised to
invoke the plan.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Your Business Continuity Plan

Part Content Purpose

BCP teams List: Identifies and lists the

t
all personnel with a role members of your planning,
t
explanation of roles response and recovery teams
and their roles as well as a
t
list of backup personnel
suitable backup should the
for each role.
primary be unavailable.

Communications List: Guides all internal and

t
key stakeholders, external communications in
priorities, categories and regards to the incident
communication modes response to ensure that
t
reporting arrangements communications match
incident needs.
t
control and coordination
arrangements
t
key timings.

Contact lists Detail: Provides easy access to all

t
internal contact lists contact numbers, including
t
emergency services team members, emergency
contact lists personnel, staff, suppliers
and key customers that could
t
external contact lists.
be required in a crisis.

Recovery plan Detail: Provides the overall strategy

t
recovery steps to maintain or recover critical
t
RTO’s business operations, recover
property losses, and resume
t
dependencies
normal operations. Should
t
restoration steps.
include the time up to which
serious business impact or
loss will occur.

Testing and Detail: Outlines the specific training

maintenance t
schedule of testing to be requirements necessary for
performed carrying out the response and
t
review/update timetables recovery activities as well as a
and deadlines schedule defining the
frequency and types of drills
t
BCP revision history.
and exercises to be
conducted. Also defines when
and how the program will be
reviewed and evaluated.

#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide 
:PVS
#VTJOFTT
$POUJOVJUZ
1MBO
Rehearse, maintain and This type of exercise is particularly In monitoring and reviewing your
review useful for training purposes and plans it pays to keep your eye on the
provides an important tool for big picture, that is the business
A deceptive and dangerous embedding Business Continuity environment around you.
assumption is the idea that once a Management in your organisation’s
t
What actions would you take in
plan is written it is complete. Plans culture. It is also effective as an
your business if interest rates
require constant reappraisal and initial validation of a new plan.
rose? Are sales likely to go up
revision as flaws and omissions in
Scenario testing is another useful or down?
the plan will always be revealed
way of validating plans and t
How would you respond to higher
during exercises. At the same time,
rehearsing key staff. A scenario fuel, power, and water costs?
changes in organisational structure
works by simulating a live event
necessitate regular revision and
and allowing staff to make decisions
updating of the plan and, of course,
as the scenario unfolds in very Continuous Improvement
more training.
much the same way they would in
It cannot be over-emphasised that
the event of a real incident. When
Test your plan planning is a long-term commitment,
writing scenarios, think about
not just something that you do once
the risks to your business that
Your plans cannot be considered and forget about. Whatever its size,
you identified in your Risk
reliable until they have been tested every business needs to develop
Management Plan.
and proved to be workable. Testing plans to deal with crises. In today’s
involves: environment long term planning no
Why bother? longer exists and is fast being
t
validating plans replaced by re-planning; making
Why bother reviewing and testing strategic plans never-ending and
t
rehearsing key staff
your plan? There are a number of always evolving.
t
testing your systems. very good reasons, including:
You can maximise your chances of
The frequency of testing will depend t
To strengthen your business. success by adopting a continuous
on your business, but should take Businesses need to live, grow and regular planning cycle that keeps
into account changes in your and change, and plans must your plans up-to-date. This should
business and outcomes of any live, grow and change with include regular planning meetings
previous testing (in particular if those needs. which involve key people from the
weaknesses were identified and
t
To protect your investment. business to monitor and review
changes made to the plan). As a
You’ve put a lot of your time, progress and to identify ways in
minimum, test plans annually.
effort and money into which planning and operations could
Not all aspects of your plan can be your business. be improved.
tested, but some elements can. For t
To maximise your return
example, you will be able to test on investment.
evacuation procedures in the event
t
To ensure you have the ability
of fire. Another way to test the plan
to respond to and recover from
is to have planning meetings to
whatever adverse situations
bring staff together to inform them
may occur.
of the plan and their individual
responsibilities. You should also t
To enable you to remain in
examine the plan as a group to control of your business.
identify problems and solutions.



#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide

 Your Business Continuity Plan

Key questions that should No matter which system model Ensure your staff understand
be asked include: you select, you must ensure it
and collectively work
is implemented to guide the
t
Do you have a Business continuous improvement process towards the plan
Continuity Plan that is when reviewing and testing If employees don’t understand the
up-to-date and complete? your plans. plan, it will fail. They need to know
t
Do your employees know and how to initiate action, how to work to
support your plan? Key Points the plan, what to do in case any
element of the plan doesn’t work,
t
Have you practiced and tested
and where to go for additional
the plan to expose any Make sure you undertake information.
weaknesses, overlooked the planning process
aspects or problems?
A carefully thought-out plan will 6OEFSTUBOE
MFHBM
BOE

Continuous improvement is about make coping in a crisis easier and compliance requirements
making constant enhancements enable you to minimise disruption
towards excellence. Looking for t
Make sure that you understand
to your business and its customers.
ways to make things better, do and comply with all regulatory
things a little easier, a little faster, a It will also prove to customers, and ethical requirements.
little bit cheaper, tweaking it or suppliers and investors that your
t
Adopt a continuous improvement
polishing it. business is robust enough to cope
process
with anything that might be thrown
at you – possibly giving you the t
You will no doubt put a lot of time
Learning from the past edge over your competitors. and effort into developing your
Business Continuity Plan. Protect
Businesses who are serious about
Commence planning early your investment by regularly
continuous improvement review
reviewing and updating your plan
their plans to see what they can Give staff the opportunity to to reflect the changing
learn from them. They use the past familiarise themselves with all of environment.
to improve the future. Reflecting on your plans to provide confidence
what they’ve done and how they’ve that the teams, technology, and
done it helps to manage the next procedures are capable of working Business Continuity Plan
incident better. You can follow any when they need to. template
one of the numerous continuous
improvement models that are The Department has developed a
readily available. One of the more Business Continuity Plan template
popular models is: which you can download from our
website at www.business.qld.gov.au

Business operators should use it

as a guide only to developing a
Business Continuity Plan.
Plan Do
Customise it to suit your
business needs.

Act Check

#VTJOFTT
DPOUJOVJUZ
QMBOOJOH | Guide 
With a statewide network of Department of Employment,
Economic Development and Innovation centres, use the
contacts below to find one near you.




*OUFSTUBUF
DBMMFST
t





XXXCVTJOFTTRMEHPWBV

10/07
SD4396 10/09
SD5799