Asia-Pacific

Economic Cooperation

Guidebook on SME
Business Continuity Planning

APEC Small and Medium Enterprise Working Group (SMEWG)

June 2013
 02 BCP Guidebook Brochure_2013

Business Continuity Plan Booklet

for Small, Medium Enterprises
Is your company prepared for disasters?
Intro- If you have not prepared for such incidents, you are (unconsciously)
duction preparing for a failure when a disaster or an accident hits your
company. An effective Business Continuity Plan (BCP) is your
solution to protect your business during a crisis.

The booklet will guide you through the following easy 10 steps to
build your company’s BCP. The 10 steps are based on ISO22301
Business Continuity Management Standard System.

Step 1 Determine BCP Purpose, Scope and Team p.02

10 Steps Step 2 Prioritized Activities and Recovery Time Objective p.03
for BCP
Step 3 What Do You Need to Resume Key Activities? p.03

Step 4 Risk Assessment- Know Your Disaster Scenarios p.04

Step 5 Do Not Forget Pre-Disaster Protection and Mitigation p.05

Step 6 Emergency Response to Disaster p.05

Step 7 BC Strategies to Early Resumption p.07

Step 8 Be Financially Prepared p.09

Step 9 Exercise Makes Your Plan Functional p.10

Step 10 Ongoing Review and Improvement p.12

 03 BCP Guidebook Brochure_2013

Step Determine BCP Purpose, Scope

1 and Team

1. Purpose
You should make the purpose clear as to why your company is going to
introduce BCP. BCP is to protect your business operation from disasters
and accidents. Your clear purpose will be a very important criterion in
determining priorities of your key products or services and selections of
your business continuity strategies. What is your BCP purpose? The first
priority is to protect people, your employees and visitors to your premises.
The second is to protect your business, fulfilling your contractual obligations
to your customers and users, meeting social responsibility and contributing
to the local society and economy. It will secure employment and protect
employees’ livelihoods.

2. Scope
The question is which section(s) of your company would you want to
introduce BCP? You can limit the scope to key sections (or departments)
which introduce BCP. For example, you can select the main factory which
manufactures the company’s top brand product or No.1 shop which sells
most. You can decide the scope of the BCP based on your business needs
and own circumstances. You have to include the core sections which are
very critical to your company’s survival.

3. BCP Leader
You need to appoint a BCP leader who takes the initiative in company-
wide BCP activities. BCP leaders should be given authority and
responsibility, which are necessary to carry out his or her role. BCP is the
company-wide activities that require active participation and cooperation
from the relevant sections. It is desirable to nominate a person who is
widely trusted in the company. If the company size requires it, a support
team should be selected to work under the direction of the BCP leader.
Management need to ensure the necessary resources, including a
budget which is available for the BCP leader and team to carry out their
duties. The SME owner (senior management) should demonstrate a visible
commitment to BCP activities and should know that only verbal instructions
are not enough to achieve successful results.
 04 BCP Guidebook Brochure_2013

Step Prioritized Activities and Recovery

2 Time Objective
In Step 2, you will consider what is your company’s lifeline product or
service? Which product or service should be recovered (be delivered) as the
first priority when a natural disaster (or an accident) disrupts the company’s
operations? Which business activity makes a top selling product? Which shop
sells most in your company? Those critically important business activities are
called Prioritized Activities (PAs). You have to identify the Prioritized Activities
of your company.

As the second step, you should know the impact (timeline) of total disruption
to the main activities listed. How soon would the total disruption of these
activities become unacceptable to your company. (This period is called
Maximum Tolerable Period of Disruption / MTPD). What must be done to get
your business operational again in the shortest possible timeframe, before
heading towards exiting the business or filing for bankruptcy?

Step What Do You Need to Resume

3 Key Activities?
Prioritized Activities are supported by various internal and external resources.
When disrupted, Prioritized Activities are going to be resumed and those
supporting resources should be available and ready. In Step 3, you need
to identify and list the necessary
resources. In the subsequent steps,
you will review risks to the listed
resources, and their vulnerabilities.
You will consider what measures
are necessary to protect, secure
availability, or prepare alternative
options. Therefore, this list is very
important and basic information in
your BCP planning.
 05 BCP Guidebook Brochure_2013

The first category is Internal Resources,

which are usually under your company’s
control. These include buildings, equipment,
machinery, tools, stock, materials, IT systems,
documents and drawings, etc. It is also
important that human resources be reviewed
from the perspective of employees’ special
skills and expertise.

The second group is, Essential Utilities such as

electricity, gas, fuel, water and sewage etc.
Communication network (phone and internet)
and transportation network (roads, railroads
and ports) are included. These resources are provided by public entities.
They are not usually under your control. Typically, ordinary companies
cannot afford to arrange alternative sources for essential services, due to
the prohibitively high costs, and their availability. Therefore, these would
become a basic condition for resumption of your Prioritized Activities.

The third group is, your company’s Business Partners and your upstream and
downstream business chains. This group (direct and indirect partners) are not
only your suppliers, but also your customers. In the two catastrophic natural
disasters, the East Japan Earthquake and Thailand’s Floods which occurred
in 2011, many companies were seriously affected by disruption to their
supply chains. Many companies, which were not directly damaged by the
natural disasters were also seriously affected.

Step Risk Assessment- Know Your

4 Disaster Scenarios
In Step 4, you need to clearly identify risks which may seriously threaten
your company (or may lead to a catastrophic scenario). You list the kinds
of risks your company is exposed to. You analyze and evaluate those risks,
and select risks which your company needs to take measures with ‘high
priority’. You also need to analyze and estimate to what extent your critical
resources may be damaged by such risks, and how long it will take to restore
such damaged resources. You compare the estimated restoration period
 06 BCP Guidebook Brochure_2013

with your company’s Recovery Time Objective (RTO), set in Step 2, and
determine which resources are critical to avoid catastrophic scenarios.

The resources which need attention include those where the restoration
period exceeds the RTO and those that do not exceed it. If essential services
such as electricity, water, phone etc, take a longer period for the service to
be restored than your RTO, you may need to reconsider your RTO and wait
until such resources and services become available.

Step Do Not Forget Pre- Disaster

5 Protection and Mitigation

To successfully resume operations as planned, the damage to the

supporting resources should be contained, to the extent that early repair
and restoration would be possible.

If such important resources sustain very severe damage, your company may
fall into a disaster scenario, and be forced to give up the recovery effort, or
shut down for a long period of time. This would be the end of the business,
and therefore, the story! This is why pre-incident strategies of protection and
mitigation are very important.

Step
6 Emergency Response to Disaster
In Step 6, you consider immediate necessary responses to take, when the
incident occurs, to prevent the emergency situation from becoming an
uncontrollable crisis. It is called emergency response or incident response.
The first priority of emergency response is to protect and rescue people.
Stabilization, to remove harm and secure premises, ensure safety and
security of yourself, staff and customers, protection of assets, and prevention
of further damage. The potential for secondary disasters should also be
considered.

First, you should understand the general picture of emergency response.

As shown in Figure 6-1, there are a series of necessary activities in an
 07 BCP Guidebook Brochure_2013

emergency response. These activities have to be carried out, following

necessary timelines and without delay. “1) Evacuation and rescue” should
start immediately by individual people when an incident occurs. Emergency
Operation Center (EOC) should be called, if necessary, to take coordinated
measures under unified command in your company. The activities of 3) ~ 8)
are performed by the emergency operation center, if it is set up.

The main necessary activities are 1) Evacuation and rescue 2) Setting up

Emergency Operation Center, 3) Safety Confirmation of employees 4)
Stabilising the situation and prevention of secondary damage 5) Survey
of damage 6) Assets protection 7) Safety confirmation of employees’
commuting 8) Gathering and sharing information of incident/damage.

Evacuation
Emergency response to disaster
and rescue

Safety Confirmation Emergency Operation Center

of employees

Safety Confirmation of
employee’ s commuting

Stabilizing the situation and

prevention of secondary damage

Survey of damage

Assets protection

Gathering and sharing information of incident/ damage

strarting up continuity/ recovery strategy

Figure 6-1 Emergency response to disaster

 08 BCP Guidebook Brochure_2013

Step
BC Strategies to Early Resumption
7
In Step 7, you develop your company’s Business Continuity Strategy (BC
Strategies) for resumption of Prioritized Activities within Recovery Time
Objectives. You need to identify and prepare the internal and external
supporting resources that are necessary to resume those activities.

There are key concepts for planning your BC Strategies that you need to
consider to resume Prioritized Activities. In considering the concepts of
BC Strategies, you are going to make plans for your own BC Strategies to
achieve RTO of PAs.

Strategy 1:
Resume PA at the damaged/affected site

Strategy 2:
Resume PA at an alternative site (either in-house or external facility)

Strategy 3:
Resume PA by alternative methods (or workaround methods)

Your BC Strategies might be a combination of the above three strategies.

In the very early stage of your recovery planning, you have to decide
where your company will restart critical operations (or PA). One strategy
is to resume at the damaged or affected site, another is to resume at an
alternative site. Both strategies are necessary. Your company should be
prepared for a scenario when the main facility, such as, headquarter
building or main factory are not usable. For SMEs that have limited resources,
it might be very hard to prepare an alternative site. SMEs may only have
one option to prepare a BC Strategy - to restore damage and recover
at the affected site. You should remember that your company will be
defenseless if your key facility is damaged to the extent that it becomes
unusable. In the mid to long term, you should consider how to deal with this
challenge. This process is not simply a paper exercise. The owner and/or
senior management has to make business decisions as to how and where to
recover prioritized activities from the disruption.

Let’s start with BC Strategy to resume at the damaged/affected site.

09 BCP Guidebook Brochure_2013

Strategy 1:
You have to restore the damaged resources. The buildings and
equipment/machinery may be damaged, and assistance by external
construction company and machinery experts may be necessary.
Essential services such as electricity, gas and water are necessary
to resume disrupted operations. Recovery of such essential services
to your company may become the key to your company resuming
operations. Therefore, you should estimate how soon those public
companies are able to resume services. You may need to review your
BC Strategy based on essential service restoration periods.
The next strategy is to resume at an alternative site.

Strategy 2:
You need to consider the location of the alternative site, and see if it is
sufficiently distant from the current site and therefore is less likely to have
been impacted/damaged by the same disaster. You should make sure
that the essential services your company needs, are not be affected and
will be available. This strategy requires that all necessary resources, for
example, building, equipment and machinery are available at this site.
You also need to consider how to transfer the workforce, and that supplies
of materials and parts are transported to this site. It will be important
that you have built relationships with your suppliers, as you will need to
find other sources of assistance and seek also corporation from external
partners.

This Strategy is to resume PA by the alternative method.

 10 BCP Guidebook Brochure_2013

Strategy 3:
This strategy can be used in Strategy 1: damaged site recovery and
strategy 2: alternative site recovery. For example, old reserve equipment is
used to replace the damaged, newer equipment. Manual work by human
hand replaces disrupted IT systems. Your company selects what alternative
methods that fit your company’s operations. You also need to identify
what kind of assistance is necessary from external partners.

External business partners can have significant impact on your business

operations and BC Strategies. You cannot control your business partners.
Therefore, what can you do with external partners in your BC Strategies?
This will depend on your business relationships, but here some measures
you can take to help mitigate the risk. First of all, you can check their
preparedness levels in disaster management and BCP. Are they supportive
of these matters or not interested at all? If they are interested, it is
recommended to exchange what you and your partners have been
doing in disaster management and BCP. It would be more desirable that
you and your partners have periodical meetings and plan joint meetings
or exercises.

Step
8 Be Financially Prepared
Can you survive financially if your operation is disrupted for one or two
months? The objective of Step 8 is to recognize the financial conditions
of your company in case of an emergency, and to prepare appropriate
measures in advance, to avoid bankruptcy even if income is suspended.

If your company’s operation

is suspended, your company Disaster
will lose revenue but still be
required to pay ordinary Revenue
expenditure such as, payroll
and rent. And if your facilities Expenditure

are damaged, you will

need cost recovery of your
Deficit
Need to prepare
measure to fulfill
damaged facilities. What the shortage
you need to do in Step 8,
is to estimate how much
Resumption

Figure 8-1 Deficit Occurs After Disaster

 11 BCP Guidebook Brochure_2013

money will be needed if your company sustains damage by a disaster; and

consider measures that could be taken to fulfill any shortage. Key factors to
consider in your financial analysis include.

- Understand how much revenue will decrease due to business disruption.

- Estimate how much the recovery costs will be to resume your business
operations.

- Recognize how much ordinary expenditure will be incurred during

disruption.

- Calculate the level of funds needed to fulfill the shortage.

Note: It is recommended that a company should reserve cash and deposits

equivalent to its one-month revenue.

Step Exercise Makes Your Plan

9 Functional
In Step 5, 6 and 7 your company has made various plans of BC Strategies.
Below are questions related to some of those plans.

How confident can you answer “Yes “ to the following questions?

- Can all employees (and customers) evacuate promptly and safely,

following your evacuation plan?

- Can all employees call your emergency phone number to report safety
confirmation?

- Can EOC members gather properly and immediately at the meeting place
and undertake their designated role?

Planning and executing plans are different tasks. Your company’s Business
Continuity Plans should effectively work in the case of an emergency as
planned. The purpose of Exercise is to ensure that your company’s plans
work effectively and achieve its objectives. Exercise is intended to not only
test its performance, but also to empower employees and provide them
with education and training to enhance their knowledge and expertise.
12 BCP Guidebook Brochure_2013

Some examples of the main exercises are listed below.

- Evacuation Drill: test and practice safe and prompt evacuation to the
designated location.

- Safety Confirmation Exercise: test and practice employees’ emergency

calls and safety confirmation.

- Launching EOC Exercise: test and practice starting up EOC launch and
conducting designated roles by EOC members.

- Backup Data Recovery Exercise: test and practice recovery by backing up

data.

- Re-starting Operation Exercise: test and practice resuming operations after

disruption.

- Launching Alternative Site Exercise: test and practice starting up operations

at an alternative site.
 13 BCP Guidebook Brochure_2013

Step Ongoing Review and

10 Improvement

Business Continuity
Management System PDCA- Continuous Improvement

Business Continuity Management is your

Act Plan company-wide activities to establish
Maintain and Establish capability to resume critical operations
improve
(Prioritized Activities) after disruption caused
BCM by an incident. It is not easy to establish
Business Continuity such capability in a short period of time but
Management
it is essential to continuously improve and
enhance your capability like ascending
Check Do spiral staircase. It is highly recommended
Monitor and Implement that you utilize the PDCA Cycle (Plan, Do,
review and operate
Check, Action) Model for your company’s
continuous improvement of BCM.
PDCA cycle

You have already gone through the first two phases (Plan and Do) of four
phases. In Step 10, you finish the remaining Check (monitor and review) and
Act (Maintain and improve) phases.

(1) Review and Check your BCP

To make your company’s BCP most effective, you should monitor and
review your company’s BCP activities. Your entire BCP activities- before,
during and after an incident - should be reviewed.

You should ask the following questions for the review of each step.

- Are BC activities (which have been decided and planned) effectively

done?

- Are there any tasks and problems for improvement?

- Are there any changes to internal and external circumstances which are
needed to be considered?

- Are there any areas or items which were not included in your BCP, but
should be included?
14 BCP Guidebook Brochure_2013

This review and check process should be conducted periodically, at least

once per year.

If there is any business environmental change in your company such

as, change of partner companies (suppliers or vendors), core business
operations (products or services), IT system or M & A, location changes
etc., you should pay attention to possible effects of these changes. These
factors may have not been considered or may have been omitted in
your reviews, and therefore, you may need to reconsider and make the
necessary changes to your BCP activities. It is important to periodically
review and not miss the opportunity to update your BCP. These internal
reviews are usually done by BCP teams, lead departments and internal
audit departments.

(2) Management Review

In addition to the above Review and Check processes, senior
management have to proactively initiate a review of the company’s
BCP at least annually, and ensure that your company’s BCP has been
managed effectively and the PDCA cycle is working. It should be
understood that management review works as strong drive to circle PDCA
cycle.
15 BCP Guidebook Brochure_2013

BCP Checklist
Answer
No. Question Steps
Yes- Yes
No
Partially Done
Has a BCM Manager been appointed and has a
1
budget for BCM activities been allocated?
1 0 2 4

Are the BCM purpose, scope and leader well known

2
throughout your company?
1 0 2 4

Does upper management take a visible leadership

3 role in BCM activities and show its commitment to 1 0 2 4
BCM to employees?

Does your company understand what the impacts

4 would be if the company's operations were to be 2 0 2 4
disrupted for one week? One month?

Does your company understand how soon it would

have to resume operations after a disruption to
5
avoid severe impacts that would threaten the
2 0 2 4
company's survival?

Has your company identified which businesses

6 should be given top priority for the recovery and 2 0 2 4
resumption of operations?

Has your company identified important internal

7 resources or outside essential services that might 3 0 2 4
create a bottleneck for business resumption efforts?

Has your company already identified necessary

8 materials or parts which are supplied by a single 3 0 2 4
supplier?
16 BCP Guidebook Brochure_2013

Has your company researched the disaster history

or risk information (such as hazard maps) that have
9
been published by your local government or other
4 0 2 4
organization?

Is your company able to withstand the type of

10 natural disaster (with extensive impacts) that has a 4 0 2 4
higher probability of occurring than other disasters?

Has your company identified which necessary

resources might sustain severe damage as a result
11 of the natural disaster identified above (question 4 0 2 4
10), thus becoming an obstacle for early business
resumption?

Has your company planned and implemented pre-

disaster protection (prevention) and mitigation
12
measures to protect the safety and welfare of your
5 0 2 4
employees from expected disasters?

Has your company planned and implemented pre-

disaster protection (prevention) and mitigation
13 measures to protect your company's assets from 5 0 2 4
disasters (earthquake, floods, typhoons) and
accidents?

Has your company prepared an emergency

14
contact list of employees?
6 0 2 4

Has your company decided on the framework for

an Emergency Operation Center, such as where to
15
gather, what members are to be called, and the
6 0 2 4
criteria for mobilization?

Has your company made a contact list of

16
customers, business partners, and authorities?
6 0 2 4

17 Does your company periodically backup its data? 7 0 2 4

Does your company have an alternate site in place
18 in case its headquarters or main business location is 7 0 2 4
shut down?

Does your company have alternative or temporary

measures in place to replace main equipment
19
(or other resources) in case primary equipment
7 0 2 4
becomes unusable?

Does your company know the disaster management

20 and business continuity status of suppliers that 7 0 2 4
supply its essential materials and parts?

Do you know how much funding you would be short

21 of if your company's operations were to be totally 8 0 2 4
disrupted for one month?

Have you checked what kinds of disaster support

22 programs are available through your local 8 0 2 4
government or other public organizations?
17 BCP Guidebook Brochure_2013

Have you set aside a cash reserve equal to one

23
month of revenue for disasters?
8 0 2 4

Does your company conduct periodic evacuation

24
drills?
9 0 2 4

Does your company conduct exercises to test

25 that data can be safely recovered from backup 9 0 2 4
systems?

Does your company conduct exercises to practice

26
mobilizing the Emergency Operation Center?
9 0 2 4

Does your company periodically review its disaster

27 management and business continuity plans and 10 0 2 4
implement improvement measures if necessary?

Does upper management proactively engage in

28
the periodic review of BCM activities?
10 0 2 4

Total Score

Your Tota
Your BCM Status Level
Score

Your company is defenseless against disasters and accidents. If a disaster

strikes, your company is very likely to sustain severe damage which may cause
long-term disruption. Your company needs to know the risks that threaten it 0 - 36
and to start considering what can be done to minimize the potential damage
that might be caused by such risks.

Your company is aware of the risks to which it is exposed and has taken some
necessary preparatory measures. However, the expected results of those
measures may be limited. Your company is still exposed to severe damage 37 -74
because of the weakness of your BCM activities. Be sure to prioritize BCM
activities to make your BCM more effective.

Your company has almost established BCM and has implemented measures
that would probably be effective if the risks are within your estimates.
Continue following the PDCA cycle in your BCM activities to enhance your 75 - 112
business continuity preparedness and ensure that you will be able to respond
effectively to an unexpected incident or disaster.
18 BCP Guidebook Brochure_2013

Note
APEC Project: M SCE 02 11A

Produced by
APEC SME Crisis Management Center
3F, No. 16-8, Dehuei St., Jhongshan District, Taipei 10461, Taiwan
Tel: (886)-2-2586-5000 # 364 Fax: (886)-2-2598-1122
Email: [email protected] Website: www.apecscmc.org

Small and Medium Enterprise Administration, Ministry of Economic Affairs, Chinese Taipei
3F, No. 95, Sec 2, Roosevelt Rd., Taipei 100, Taiwan
Tel: (886)-2-2368-6858 Fax: (886)-2-2367-3914

In Collaboration with
Asian Disaster Reduction Center
Shin-Yurakucho Bldg, 12-1 Yurakucho 1-Chome, Chiyoda-Ku, Tokyo 100-0006 Japan
Tel: (81)-3-6269-3792 Fax: (81)-3-6269-3799
Email: [email protected] / [email protected]

For
Asia Pacific Economic Cooperation Secretariat
35 Heng Mui Keng Terrance Singapore, 119616
Tel: (65) 68919 600 Fax: (65) 68919 690
Email: [email protected] Website: www.apec.org

©2013 APEC Secretariat (summary of)APEC#213-SM-03.1