Much is written about the components of an effective strategic plan and how best to develop one. The headlines, filled with debates on pandemic preparedness and potential terrorist threats, highlight the need to define and align key communication and business corridors in the event of a catastrophe. From this debate, Business Continuity Planning has emerged as a central component to overall corporate well-being that all sectors of business recognize.1But with the globalization of our business practices comes greater probability for business disruption, as organizations attempt to align cultures, languages, and customs into cohesive business entities.

Previously, we discussed how current FDA and ICH guidance — and the push to manage risk — has triggered a shift in thinking in terms of product and process development in many business sectors. Yet, despite the use of time-proven methodologies, such as Balanced Scorecards and Strategy Maps for strategic planning, many organizations have not integrated Business Continuity Planning into their overall strategic thinking. While no one hopes for a disaster, defining the problem and taking steps to keep your organization in business can make the difference between surviving to fight another day and becoming a casualty. This column takes a deeper look at laying out a Business Continuity Plan for your organization.

ELEMENTS OF A BUSINESS CONTINUITY PLAN (BCP)
To develop and manage an effective Business Continuity Plan (BCP), we’ve isolated four major activities, each of which focuses on key elements that drive your business (Figure 1).

Business Impact Analysis (BIA)
The first step in moving toward an effective BCP is to conduct a Business Impact Analysis (BIA), based on your organization’s long-term strategic goals that accounts for the key elements of your organization. A BIA will help you focus on identifying the effect of non-specific events on your businessprocesses and customers.

This analysis should not be done in a vacuum. You may integrate this activity with other analysis tools such as a SWOT (Strengths, Weakness, Opportunities, and Threats), Johari window, and market analysis exercises to ensure all critical aspects of the business are addressed.

Consider the categories listed below when calculating your organization’s risk in the face of a catastrophic event. As you evaluate each category, study the possible risk to each organizational element, estimate the maximum time allowable to recover, and analyze the cost of being out of operation. From this analysis, you can articulate a recovery roadmap and set milestones as part of the tactical rollout. While this constitutes the “heavy lifting” of the exercise, the basic components of any organization can be distilled intothe following seven elements:

• Facilities
• People
• Communication (IT)
• Supply Chain
• Equipment
• Vital Records/Documentation
• Intellectual Property

1. Facilities: Identify points of failure within the facility’s design and infrastructure. For instance, if the facility is an aseptic operation, what would be the impact of a breach to the sterile core? Is there a geographically separate facility available that could support the products manufactured in the facility?