OVERVIEW
With the advent of increased natural disaster frequency, prevalence of cyber-attacks, and a global pandemic (COVID-19) that has plunged global marketplaces into precarious territory, organizations have more reason than ever to plan for unanticipated threats to their ability to conduct business and keep personnel and assets protected. Colleges and universities are no exception. Not only are enrollment cycles threatened but fundraising – ongoing and major campaigns – immediately began to see their investment portfolios and thus operating cash from endowments slide drastically while anticipated pledge payments started faltering.
Business Continuity Planning (BCP)[1] is the risk management strategic process by which an organization can set a system in place to respond quickly in the event of a disaster or other emergency. A business continuity plan should not be confused with a disaster recovery plan; the latter focuses primarily on recovering IT services after a disaster and does not address other issues faced by the entire organization.
Two of our client university Advancement organizations drafted the outlines of their business continuity plan within the first week and engaged their staff leaders in building out the scenarios as remote work plans were quickly implemented. Mission critical priorities identified included: gift processing (deposits and donor receipts); communication with alumni and donors; fundraising and donor cultivation and stewardship; alumni engagement; and accounts payable (including payroll). In one advancement office, each unit was required to map out a continuity plan for business operations during the remote term and anticipate alternate ways to serve their customers internally and outside the institution.
Others had developed plans in previous crises, like the one applied by the University of California-Davis in response to the global fears of an avian flu pandemic in 2005-2006 and McMaster University’s (Canada) Business Continuity Plan and Pandemic Influenza Business Continuity Planning guide in 2009[2] .
Anticipate is a critical concept. By establishing a BCP for your organization, you can quickly mobilize to address whatever threat is presented and minimize loss of revenue and productivity. Insurance, state and federal special funds and bailouts and other measures to relax financial processes during “normal” times likely will not cover all costs associated with an interruption your operations, nor will it ensure that customers and stakeholders stay close – or come back later. Uncertainty breeds confusion – and your best bet is to be prepared with a comprehensive framework on which to build and make modifications as needs change.
BCP DEVELOPMENT FRAMEWORK
The steps outlined below comprise the processes by which a BCP is established.
- Identify risk factors. Natural disasters, including weather-related events, fire, or flood; cyber-attacks or other technological threat; or health-related pandemic, such as the current COVID-19 crisis.
- Determine how each of the identified risks may impact business operations. Natural disaster impacts may include everything from loss of inventory to inability for employees to get to work; a cyber-attack could interrupt sales, communications, and other critical online services.
- Identify safeguards and mitigation strategies that will diminish risk. Develop procedures to follow in each identified scenario, such as implementing an online server to enable personnel to work remotely if necessary, or establishing an off-site data storage backup system for customer and institutional data.
- Test mitigation procedures to ensure that they will work. Look for weak points. Make adjustments accordingly.
- Set a schedule to review procedures to keep them current and up-to-date. Revise as new information and/or additional risks are identified.
BCP DEVELOPMENT PROCESS
In order to develop a successful Business Continuity Plan, the following procedures are recommended, based on industry standards and our client experiences:
- Perform a business impact analysis. This process will identify the critical services and functions that should be protected, with emphasis on financial and operational impacts. FEMA has developed an online business impact analysis worksheet, which can be accessed here.
- Obtain support and funding for the BCP. Allocate funding sources for each of the development, testing, and implementation components.
- Establish a continuity team. These personnel will be responsible for devising the response strategy and responding to any disruptions. “Essential personnel” should be defined for each unit. Continuity team members must be trained and tested to ensure response procedures are fully understood and can be implemented quickly. Disaster Recovery Institute International (DRI) offers a variety of business continuity education courses.
- Establish baseline operating standards. This will set ground rules for remote employee activities an interactions.
- Schedule regular staff meetings. This will set a structure for communications, work habits and productivity.
- Determine recovery processes. Develop procedures that will protect and recover critical business services.
- Develop an incident management system. Define organizational roles, lines of authority, and succession of authority.
- Create a checklist of key details. Checklists can include everything from emergency contact information and a list of supplies and equipment to locations of backup storage and important information to a list of resources that may be needed in the event of a disaster. Checklists may also outline steps to undertake for identified risk response procedures.
- Create a crisis communications plan. Provide a framework that will ensure timely, effective communication with internal and external parties.
- External agency coordination. Establish procedures for communicating and coordinating incident response activities with external agencies.
- Inform organization personnel. All employees should be aware of the BCP regardless of whether or not they are part of the continuity team.
ONLINE TOOLS & PUBLICATIONS TO DEVELOP YOUR OWN BCP
- Department of Homeland Security: Business Continuity Planning Suite, a free, scalable software program created to assist organizations of all sizes to develop a comprehensive BCP.
- National Fire Protection Association (NFPA) 1600: Standard on Continuity, Emergency, and Crisis Management, a standard adopted by the U.S. Department of Homeland Security as a voluntary consensus standard for emergency preparedness that is applicable to public, not-for-profit, nongovernmental, and private entities on a local, regional, national, international, and global basis.
- Disaster Recovery Institute International (DRI): Professional Practices 2017, an online framework of resources to assist in the development of a BCP (this entity uses the term Business Continuity Management/BCM).
- Federal Emergency Management Agency (FEMA): Continuity Guidance Circular 1 (CGC 1) Continuity Guidance for Non-Federal Entities, a guidance document to provide direction to non-federal organizations in developing continuity plans and programs.
- Institute for Business & Home Safety: Open for Business, a free online BCP toolkit.
CASE STUDIES
University of Houston Continuity of Operations Planning (Source: University of Houston Office of Emergency Management)
While not our client, we found the comprehensive procedural guidelines by the Office of Emergency Management at the University of Houston (UH) worth a mention, in addition to the UC Davis business continuity plan referenced above. As a university with multiple campuses and a student body of nearly 50,000 individuals, UH is charged with ensuring that all campuses, facilities, personnel, students, and programs have clear direction on what to do if disaster strikes and how to minimize the impact.
On its website, UH’s Office of Emergency Management has posted COOP (BCP) templates for colleges and departments, along with other forms for tracking personnel, emergency relocation information, and dependency form, along with a worksheet for critical interruption that identifies essential information about a department’s ability to function without power, with damaged equipment, without proper communication channels, etc.
The COOP templates serve to collect critical data from each college and department so that the Office of Emergency Management has the information it needs to ensure that critical operations and essential functions of the University can continue to be performed through an emergency scenario, in compliance with MAPP 06.01.02, the University’s Continuity of Operations Planning safety standard. These forms must be submitted annually to the Office of Emergency Management by each college and department so that emergency planning procedures maintain accuracy and relevancy.
As of March 2020, in response to the COVID-19 pandemic, UH publicized its COOP procedures for this emergency on its website, where all affected parties may find guidance and direction.
Footnotes
[1] Business Continuity Planning (BCP) may also be identified as Business Continuity Management (BCM) or Continuity of Operations Planning (COOP).
[2] University of California-Davis: Creating an Institutional Framework for Business Continuity. ECAR Case Study 3 by Judith A. Pirani and Bob Albrecht, EDUCAUSE Center for Applied Research, 2007; and McMaster University’s guides: https://hr.mcmaster.ca/app/uploads/2019/01/RMM-1206-Business-Continuity-Planning-Program.pdf and https://hr.mcmaster.ca/app/uploads/2018/11/Pandemic-Influenza-Planning-for-Managers-1-40.pdf
Authors: Catherine Smith and Janis Johnson