Business Continuity Planning (BCP)

A business continuity plan sets out who does what, in what order, when a disruption hits. It is built from the findings of a business impact analysis, which shows which activities cannot stop for long. The plan names alternatives: other sites, remote working, manual workarounds, spare suppliers and backup equipment. It lists contacts, decision rights and the point at which the plan is triggered. Plans are normally kept per department or site and are only useful if they are short enough to follow under stress, kept current and tested. Contingency planning is a close and often interchangeable term, although it can also cover a single risk event. BCP is one element within the wider management programme. Reviewers test a plan against a real scenario and look for stale phone numbers, closed sites and steps nobody can carry out.

A payments processor depends on one data centre and a team of twelve in a single office. Its plan says that if the office is closed, staff switch to home working within two hours using preloaded laptops, and that a secondary data centre takes over card authorisations. Managers hold a copy of the call tree on their phones, and the plan is reviewed every six months.