Research Assignment

Working towards business continuity

Sample templates to help  Business impact analysis (BIA)

 Identify critical business functions

 Strategize for business continuity plans

Note: The sample templates provided only serve as a guide and companies should improvise the templates according to their organization needs where necessary. 2

 Business Impact Analysis and Identifying your Critical Business Functions/Processes Definitions

1. Critical Business Function (CBF) - Business activities and processes that shall not be disrupted such that they impact the ability of the organization to achieve its minimum business continuity objectives.

2. Business Impact Analysis (BIA) - An analysis to assess the quantitative and qualitative impacts of a loss of critical functions. Why do you need to do BIA? Having a comprehensive understanding of the various quantitative and qualitative impacts to your business will help you to zoom in on the critical functions/processes to look at and apportion your resources accordingly to your company’s best interests. This also ensures that you will not omit considerations for some of the critical functions which are not apparent. Sample Template for Business Impact Analysis (BIA)

How does this sample template help you? 1. Prioritize the various business functions/processes 2. Crystallize the possible impacts to your company should there be a crisis (e.g. flu pandemic) 3. Use the interdependencies of the particular function/process to identify the possible indirect causes of failure 4. Help identify the critical business functions based on above (1,2,3) considerations

How to use this sample template?

Department/Business Function: Examine 1 department or main business function

S/N Process Priority Quantitative

Impact Qualitative

Impact Process

Depends On Process is

required by

EG1 List sub-activities which support the department or business function, e.g. sales analysis, online sales portal, over- counter sales, export sales

Rate the criticality of this process to your business function – High/Medium/Low. E.g. should the unavailability of the process result in the inability for the unit to perform its business function, the priority would be considered “High”. If the process is a good-to-have and the loss of it does not disrupt your business function, it can be consider “Low”.

Estimate financial impact to the company such as revenue loss

List non- financial impact to the company, e.g. loss of customers, loss of reputation

List names of internal/external parties that is needed for this process to perform normal operations

List names of internal/external parties that depend on this process in order to perform normal operations

Note: The sample templates provided only serve as a guide and companies should improvise the templates according to their organization needs where necessary. 3

Example of a BIA for a food manufacturing company – Analysing impact on a specific business function (sales) should there be flu pandemic

Department/Business Function: Sales

S/N Process Priority Quantitative Impact Qualitative Impact Process Depends On Process is required by

S1 Sales through retail outlets (main source of revenue)

High - Loss of over-the- counter sales of $10k per day per outlet

- Possible closure of outlets should staff be infected - Loss to reputation

- 50 retail outlets - 50 retail outlets

S2 Online sales portal and home delivery of food items (secondary source of revenue)

Medium - Increase in revenue of $5k per day (due to consumers minimizing face-to-face contact)

- Lack of manpower due increase demand for delivery services and number of staff reporting sick - Delay in delivery, loss of reputation - Increased exposure of delivery staff to pandemic risks (delivery to people who may be quarantined)

- ABC IT Company (IT support by 3

rd party

vendor) - 2 separate warehouses - 10 man in-house delivery team

Nil

S3 Sales analysis Low Nil Nil - team of 10 sales executive

- Upcoming production output projections

Note: The sample templates provided only serve as a guide and companies should improvise the templates according to their organization needs where necessary. 4

 Strategizing for Business Continuity Definitions

1. Recovery Time Objective (RTO) - The time within which business functions must be restored at an acceptable level of operation to minimise the impact of an incident.

2. Minimum Business Continuity Objective (MBCO) - The minimum level of services and/or product that is acceptable to the organization to achieve its business objectives during an incident. MBCO is set by senior management of the organization and can be influenced, dictated and/or changed by current regulatory requirements or industry practices.

How to use this sample template?

1. Based on the BIA, the company management will shortlist the critical business functions/processes for which strategies and contingency plans will be created such that the business can continue operations in an event of crisis.

2. To create the relevant business continuity plans, the objectives (RTO and MBCO) must first be set so that the plans can be created to meet these objectives.

3. This sample provides helps you to strategize your business continuity plans based on a before-during-after crisis setting together with the DORSCON-FLU Alert level.

Sample Template for Business Continuity Strategies

Recovery Time Objective (RTO)

Minimum Business Continuity Objective (MBCO)

S/N Process

*Business Continuity (Contingency) Plans

Before Crisis – Prepare

During Crisis – Respond and mitigate

After Crisis – Recovery & Review

Green Yellow Orange Red Black

S1 Sales through retail outlets

*Note:

 There are different ways to consider your business continuity plans. For example, the response and recovery strategy could be based on the amount of time that has passed after the crisis occurrence.

 Companies can use the DORSCON-FLU Alert Levels as a guide for response planning and executive in the event of a flu pandemic.

 DORS (Disease Outbreak Response System) is a generic framework which enables MOH (Singapore Ministry of Health) to respond immediately to any outbreaks and serves as the nucleus to ramp up for a higher level of response.