Thinking Ahead

Business Continuity Plans identify methods a company will use to continue operations after being affected by a major event. Such events can include a pandemic, natural disaster, theft of private business information or an accidental catastrophe. Specifically, the plan details what the company will do to remain in operation after the disaster until normal business operations can resume. When confronted with unexpected disruptions, organizations must react swiftly, methodically and successfully or risk significant financial loss. This level of response requires extensive continuity planning to ensure all aspects of the organization are evaluated and protected. FMs are responsible for the health and safety of employees so that they can effectively continue production, resulting in a different focus that other business units may have. Using the rationale that FM and human resources are more concerned with the employees of the company and not necessarily the business, the company may create a separate BCP devoted to those two departments.

FM business continuity consists of planning, preparatory and related activities to ensure that an organization’s critical employees can continue to operate despite serious incidents or disasters. BCP goals also should include resolutions that will enable the company to recover to an operational state within a reasonably short period. BCPs should be built with resiliency in mind. Critical business functions and the supporting infrastructure must be designed and engineered so they are materially unaffected by most disruptions, such as using redundancy and alternate work sites. Arrangements should be made to recover or restore critical and less critical business functions that fail for some reason. The FM organization must establish the capability and readiness to effectively cope with whatever major incidents and disasters occur.

Initial concepts

FM must ensure employees’ safety and protect property and assets. The department must help restore essential functions so the company can return to business as usual. BCPs provide guidance for ensuring that personnel can respond, resume and recover to a predetermined level of operation following a disruption.

An effective BCP is the cornerstone of effective resilience planning efforts and will frame an FM’s ability to assist the resumption of HR and facilities’ essential functions. Efforts to maintain continuous business operations bring value to all employees by providing the ability to continue with their jobs and keep the company afloat. Naturally, this would tie into the corporate plan, but with a diverse focus that would still resonate throughout the organization. FMs are trained to prepare for recovery from disruptions. FM plays a vital role in response and recovery activities, working with the recognition that these activities are part of their existing job duties. One integral step is assessing the company’s risks and exposures. Risk assessment entails a comprehensive evaluation of threats and their potential disruptive impact on the business. Working with the IT department to understand telecommunication recovery options is critical. A subsequent ranking of findings will assist in the development of a roadmap.

Business impact analysis

The key to a successful BCP is understanding the impact a disaster situation could have on a business and creating policies to respond. A business impact analysis (BIA) can identify the effect of an incident/disaster on the FM team’s operations. A BIA builds on the BCP’s foundation and identifies the essential functions, resources, personnel and suppliers of the facility to determine the minimum level of operation needed for business to continue during and after an emergency. Many FM teams are often not included in the corporate planning process, because BIA surveys normally focus on IT dependencies and financial impacts. FMs should try to maintain a significant role in business continuity – the people they care for represent the second largest and most important business assets on which day-to-day business operations rely. A sound, FM-focused BIA enables the department to determine their most critical business processes. During this phase, information is collected on recovery assumptions, including recovery point objectives (RPO) and recovery time objectives (RTO). Critical business processes and workflows should be documented, as well as personnel roles and backups, their skill sets, and primary and secondary contacts. This process also requires validation that the recovery times stated in the plan are obtainable and meet the objectives. These should be accessible and available to staff, so they will be ready should a disaster occur.

Business continuity plan

Using the BIAs, a BCP can be developed. Once executive sign-off of the BIA has been obtained, the risk assessment and BIA prioritization results can be merged to create an actionable and thorough plan.

FMs should have plans dealing with all departments, divisions and the overall site. They should review the plan with key stakeholders to ensure every aspect of the company has been addressed. They must leave no business function out of the plan, as FM is responsible for accommodating all employees’ needs. In that respect, FMs must understand the level of business risk to each department and how to keep them optimally operating. The BCP will reveal a disaster’s potential effect on employees and customers, and how to keep them content. It is important to incorporate many perspectives from various staff and all departments to map the organizational focus.

If an incident impacts the facilities, the recovery strategies should have been identified by the BIA and include continuing essential business activities. When the primary facility is not accessible, it will be necessary to relocate personnel to an alternate site, which is identified in the BCP. These alternatives are intended to be short-term relocations to continue essential functions only and are not meant for all department employees. In case of a long-term disruption, the company may pursue strategies that include the relocation of personnel and continuation of essential business activities of facilities in other locations.

The final critical BCP element is ensuring that it is tested and maintained on a regular basis. This includes conducting periodic table-top and simulation exercises to ensure key stakeholders are comfortable with the plan. Ideally, biannual plan reviews are executed, and BIAs are revisited annually.

Emergency response structure

Every organization needs a governance hierarchy that will be reflected in the BCP. This is where a BCP developed for the FM team strongly coincides with a corporate BCP. There are three major groups that should be created and informed of their roles. 

ERT (emergency response team)

In times of emergency defined as Level 3, the most serious of incidents, the ERT will be comprised of the senior executive committee (SEC) and representation from key business groups. The ERT will direct, support and monitor the initial response in the case of an event and dictate actions and the implementation of the BCP. The FM should assume the role of facilities business continuity lead, which has the responsibility of ensuring that the workplace is safe for employees and provide the ability to continue working on company business.

CERC (corporate executive response committee)

The CERC should include corporate executives who will direct, support and monitor the initial response in times of an emergency defined as a Level 2 event. 

CCC (crisis communication committee)

A communications plan should be put in place to alert all appropriate stakeholders of an incident (text, email, phone calls or whatever is available to broadcast a message). Incidents can include those that are affecting an entire organization or specific divisions. A spokesperson must be identified as the one and only dispenser of information. This executive will be responsible for the communication of accurate, effective and timely messages based on CCC input using the appropriate mass communication tool.

The primary function of the CCC is to ensure that messages truly represent the company through communications to stakeholders and to edit and distribute communication as required. 

The CCC provides the lead communicator with available information and counsel pertaining to the incident to ensure communication is accurate and effective. Subject matter experts (SMEs) may be added per relevant incident. Any business unit or corporate division wanting to send out a communication to a group of employees, vendors or customers resulting from or pertaining to one of the disruptive incidents must send their draft materials to the committee for review prior to distribution. 

All communication is developed by the CCC for both emergencies and non-emergencies. For all non-emergencies, the CCC will receive guidance from the CERC or ERT and develop the initial communications. The CERC or ERT would have the final approval before the communication is sent out to the appropriate stakeholders.

The role of FM

FMs are often overlooked as they are so ubiquitous as to almost be invisible. Senior management may not appreciate all that FM teams are doing until it is not getting done. The same could apply to business continuity. FMs have access to knowledge that others do not. They have established contacts with suppliers, vendors and trades that may be required following a disruption. They are responsible for critical support functions such as physical security, building integrity and familiarity with local emergency services. They also understand priorities for long- and short-term recovery strategies. 

FMs must place themselves in the conversation. Having their own BCP to take care of operations is a strong discussion point. FM is an invaluable and indispensable  resource in business continuity and incident management. Thus, it is incumbent upon FMs to develop a plan that augments the overall corporate plan but is specific to what the facilities department needs to do in case of a business disruption.

Planning for a business disruption is an essential part of FM’s mission to protect employees and company assets. FM’s value extends beyond reacting to situations; they have a holistic view of their company, so they can plan to support all departments through any event.

FMs are agile, resilient and adept at responding to challenges on a daily basis. Every business continuity management program should include an FMBCP. The FM team can help construct a high-level strategy with incident management plans. Much as the technical support provided by IT, FM staff possess skills and knowledge that can be of benefit before, during and after a disruption. It would be a disaster to ignore the assistance FM can provide.