How to Create a Business Continuity Plan: A Human-Centered Approach

Emergencies are chaotic. System downtime has destroyed customer loyalty and employee confidence in company leadership. Documenting a set of procedures to follow when the worst happens helps alleviate a lot of discomfort.

When it comes to creating a Business Continuity Plan (BCP), it’s crucial to shift the core focus to a human-centered solution.

This guide will walk you through creating a BCP that not only safeguards your business operations but also prioritizes the well-being of your people – employees, customers, and the communities you serve.

We’ve created a Business Continuity Plan example document for you to see a completed version.

What is a Business Continuity Plan (BCP)?

A business continuity plan is a comprehensive document that outlines how a company will continue its critical operations during and after an unplanned disruption.

Does your business rely on any outside companies? What would happen if they had an outage? Would a key part of your service offering be gone? Would your customers be affected?

Do you operate in an area that has a large amount of natural disasters (earthquakes, hurricanes, etc.)?

A BCP is about keeping the lights on and the business running for a temporary amount of time until systems can return to normal.

Think of it as your business’s emergency response playbook.

It’s an integral part of any sound risk management strategy, designed to minimize downtime and maintain essential functions when the unexpected occurs.

In comparison, a Disaster Recovery Plan Document focuses on getting particular systems back to normal.

Key Components of a Business Continuity Plan

1. Purpose and Scope: This section defines the plan’s objectives and which parts of the business it covers.
2. Key Business Areas and Critical Functions: Identify the most important processes that need to keep running, no matter what.
3. Roles and Responsibilities: Who does what during a crisis? This part clarifies leadership and team member duties.
4. Communication Procedures: How will you keep employees, customers, and stakeholders informed during a disruption?
5. Data Backup and Recovery Processes: In our digital age, this is crucial. How will you protect and restore vital information?
6. Alternate Business Locations: If your primary location is unavailable, where will operations continue?
7. Key Contacts and Emergency Response Procedures: Who needs to be contacted, and what immediate actions should be taken?
8. Testing and Maintenance Schedules: A plan is only as good as its execution. Regular testing and updates are essential.

Why a Human-Centered BCP Matters

Reflect on a recent crisis your organization faced. Perhaps it was a major IT outage, a natural disaster, or even the global pandemic.

For many leaders, it’s not the technical glitches or financial implications that linger in memory, but the human elements. Perhaps it was the palpable stress in your team’s voices during emergency calls, the uncertainty in your customers’ emails, and hopefully, the collective sigh of relief when your team successfully navigated the crisis.

A well-crafted, human-centered BCP is more than just a document outlining procedures and protocols. It’s a demonstration of your commitment to your stakeholders and a roadmap for resilience.

It ensures that:

• Sarah in accounting can process payroll even if the office is flooded, so your employees don’t face the added stress of delayed paychecks during a crisis.
• David in customer support has the tools and authority to assist clients effectively during a power outage, maintaining trust and loyalty.
• Leadership can make informed, compassionate decisions under pressure, balancing the needs of the business with the well-being of your team and customers.

By prioritizing the human aspect in your BCP, you’re not just protecting your business operations – you’re fostering a culture of care, preparedness, and resilience that can become a significant competitive advantage.

Steps to Create a Human-Centered BCP

1. Start with Your People

The foundation of a human-centered BCP is built on insights from across your organization. Instead of relying solely on top-down planning, engage team members at all levels through:

• Cross-functional workshops: Organize sessions that bring together employees from different departments. Use techniques like scenario planning or design thinking exercises to uncover unique perspectives on potential risks and solutions.
• Anonymous surveys: Provide a platform for employees to share concerns or ideas they might be hesitant to voice in public settings.
• One-on-one interviews: Conduct in-depth discussions with key personnel to understand the nuances of their roles and the potential impact of disruptions.

Ask probing questions such as:

• “What aspects of your work keep you up at night?”
• “In a crisis, what would you need to keep doing your job effectively?”
• “Can you recall a past incident where our response was particularly effective or ineffective? What made it so?”
• “How do you think a major disruption would affect our customers or partners?”

This inclusive approach serves multiple purposes:

1. It provides valuable insights that you, as a leader, might not have considered.
2. It creates a sense of ownership and preparedness throughout the organization.
3. It can uncover hidden strengths or vulnerabilities in your current processes.

Your employees are your partners in building resilience. Their involvement from the start will significantly increase the effectiveness and adoption of your BCP.

2. Map Your Critical Functions to Real People

Move beyond abstract business functions and create a BCP that reflects the human structure of your organization. This approach makes the plan more relatable, actionable, and easier to update.

Instead of simply listing “Maintain IT Infrastructure” as a critical function, break it down and assign clear ownership:

• Cloud Infrastructure Maintenance: DevOps team led by Emily Chen
• Emily’s backup: Senior Engineer Alex Rodriguez
• Key responsibilities: Ensuring 99.99% uptime, managing failover processes
• Essential tools: Cloud management console, incident response playbooks
• Customer Support Continuity: Support team managed by Rahul Patel
• Rahul’s backup: Team Lead Sophia Lee
• Key responsibilities: Maintaining support channels, managing escalations
• Essential tools: CRM system, remote call center software
• Financial Operations: Finance department headed by Michael Thompson
• Michael’s backup: Senior Accountant Jamie Rivera
• Key responsibilities: Ensuring payroll continuity, managing cash flow
• Essential tools: Cloud-based accounting software, backup payment processors

This detailed mapping serves several purposes:

1. It clarifies responsibilities and chains of command during a crisis.
2. It helps identify single points of failure in your human resources.
3. It makes it easier to keep the BCP updated as people join, leave, or change roles.
4. It provides clear guidance for anyone who needs to step in during an emergency.

3. Conduct a Compassionate Business Impact Analysis

While traditional Business Impact Analysis (BIA) focuses on quantifiable metrics like financial loss and operational downtime, a compassionate BIA also considers the human cost of disruptions. This holistic approach ensures that your continuity strategies address both the operational and human aspects of your business.

When assessing potential disruptions, consider:

• Employee Well-being: How would a prolonged outage affect employee stress levels and work-life balance? Could it lead to burnout or decreased job satisfaction?
• Customer Trust: Beyond the immediate financial impact, how might a service interruption affect customer loyalty and long-term relationships?
• Community Impact: For larger-scale events, how might your business disruption affect the local community? Are there ways your BCP can incorporate community support?
• Psychological Safety: How can you ensure that employees feel secure in their jobs and valued by the company during and after a crisis?
• Long-term Reputation: How might your handling of a crisis affect your ability to attract and retain top talent in the future?

Example Compassionate BIA Matrix:

Disruption Scenario	Financial Impact	Operational Impact	Human Impact	Mitigation Strategies
Major IT Outage	$100k per hour	Critical systems down	– High employee stress – Customer frustration – Potential data loss concerns	– Robust IT redundancy – Clear communication plan – Employee support hotline
Natural Disaster	$500k per day	Office inaccessible	– Employee safety concerns – Displacement of local staff – Community assistance needs	– Remote work capabilities – Emergency relocation support – Community aid program
Data Breach	$2M + Fines	Trust recovery needed	– Customer anxiety – Employee job security fears – Reputational damage	– Enhanced security measures – Transparent communication strategy – Employee reassurance program

By including these human factors in your BIA, you’ll develop a more comprehensive understanding of potential impacts and create strategies that address both the operational and human needs of your organization.

4. Develop Realistic Continuity Strategies

Your continuity strategies need to be executable during stressful times. Develop practical, achievable plans that consider the human factor:

1. Remote Work Readiness:
   Instead of simply stating “Implement remote work,” provide detailed guidance:

• Ensure all employees have VPN access and have tested it quarterly
• Provide a checklist for creating an effective home office setup
• Offer stipends for necessary home office equipment
• Establish clear guidelines for secure remote work practices

2. Communication Protocols:
   Rather than a vague “Maintain customer communication,” specify:

• Empower support team leads to send pre-approved update emails to customers within 30 minutes of an incident
• Establish a tiered notification system for different severity levels
• Create scripts for various scenarios to ensure consistent messaging

3. Cross-training and Succession Planning:
   Go beyond “Ensure business function continuity” with specific actions:

• Implement a “shadow program” where each key role has a designated backup who regularly observes and learns the critical aspects of the role
• Conduct quarterly cross-training sessions for critical business functions
• Maintain up-to-date documentation for all key processes, accessible to designated backups

4. Mental Health and Well-being:
   Include strategies to support employee well-being during crises:

• Partner with an Employee Assistance Program (EAP) provider for 24/7 counseling services
• Train managers on recognizing signs of stress and burnout
• Implement flexible working hours during crisis periods to allow for personal and family needs

5. Customer Retention Strategies:
   Develop plans to maintain customer trust and loyalty:

• Create a customer communication team with representatives from support, sales, and product teams
• Develop a tiered compensation or make-good program for affected customers
• Establish a process for gathering and acting on customer feedback post-incident

These strategies will be executed by real people, possibly under stressful conditions. Regular training and simulations are crucial to ensure that these plans are not just documented, but internalized and actionable.

5. Create a Clear, Empathetic Communication Plan

Effective communication during a crisis can make the difference between losing or retaining customer trust and between a demoralized or united workforce. Your communication plan should be clear, empathetic, and adaptable to various scenarios.

Key components of an effective crisis communication plan:

1. Stakeholder Identification and Prioritization:

• Employees
• Customers
• Partners and vendors
• Board of Directors
• Media
• Regulatory bodies
• Local community

2. Communication Channels:
   Identify primary and backup channels for each stakeholder group. For example:

• Employees: Company email, SMS alerts, internal messaging app
• Customers: Email, website banner, social media, support ticket system
• Media: Press releases, designated spokesperson interviews

3. Message Templates:
   Develop pre-approved templates for various scenarios, ensuring they are:

• Clear and concise
• Empathetic and human
• Informative without overpromising
• Aligned with company values

Example template for a service outage:

   Dear [Customer],

   We understand that you rely on [Service Name] for your critical business operations, and we take that trust seriously. We're experiencing [brief description of the issue] that is impacting our service.

   Our team is fully focused on resolving this as quickly as possible. We expect to have an update for you within [timeframe].

   We appreciate your patience and understand the inconvenience this causes. We're committed to not only resolving this issue but also to learning from it to serve you better.

   For real-time updates, please visit our status page at [URL]. If you have any urgent concerns, our support team is standing by at [contact information].

   Sincerely,
   [Name]
   [Position]

4. Spokesperson Preparation:

• Designate and train primary and backup spokespeople for different types of crises
• Provide media training, including practice sessions for difficult questions
• Create briefing documents with key messages and Q&A for each crisis scenario

5. Feedback Loops:
   Establish mechanisms to:

• Gather incoming questions and concerns from various stakeholders
• Rapidly develop and approve responses to new issues
• Monitor the effectiveness of communications and adjust as needed

6. Post-Crisis Communication:
   Plan for ongoing communication after the immediate crisis is resolved:

• Provide a detailed post-mortem to relevant stakeholders
• Share lessons learned and steps taken to prevent future incidents
• Express appreciation for your patience and support during the crisis

In times of crisis, good communication helps manage an incident and support people through a challenging time. Your messages should inform, reassure, and reinforce your company’s commitment to its stakeholders.

6. Invest in Engaging Training and Awareness

A BCP is only effective if your team knows how to use it. Instead of dry, forgettable training sessions, create engaging experiences that build real preparedness:

1. Scenario-Based Workshops:

• Develop detailed, realistic scenarios relevant to your business
• Conduct tabletop exercises where teams work through these scenarios in real-time
• Rotate roles so employees understand different perspectives

2. Gamification:

• Create a “Crisis Response Challenge” with leaderboards and rewards
• Develop a mobile app with quick quizzes on BCP procedures
• Use virtual reality simulations for immersive training experiences

3. Regular Drills:

• Conduct announced and unannounced drills to test specific aspects of the BCP
• Include external stakeholders like key vendors in some drills
• Always follow up with debriefing sessions to capture learnings

4. Continuous Learning:

• Share case studies of real incidents (internal or external) and how BCP helped
• Invite guest speakers from companies that have successfully navigated major crises
• Encourage employees to contribute to the ongoing evolution of the BCP

5. Accessibility:

• Ensure the BCP is easily accessible to all employees (consider a dedicated mobile app)
• Create quick-reference guides and checklists for critical procedures
• Use multiple formats (text, video, infographics) to cater to different learning styles

6. Cultural Integration:

• Incorporate BCP awareness into new employee onboarding
• Make continuity planning a regular part of team meetings and strategy sessions
• Recognize and reward employees who contribute to improving organizational resilience

The goal is to build “muscle memory” so that when a crisis hits, your team’s response is almost instinctive. Regular, engaging training ensures that your BCP is a living part of your organization’s culture, not just a document on a shelf.

7. Plan for Post-Incident Support

A truly comprehensive BCP extends beyond the immediate crisis. Include provisions for supporting employees and customers in the aftermath:

1. Employee Support:

• Offer counseling services for employees affected by the incident (for example – post-9/11)
• Provide additional time off or flexible working arrangements if needed
• Conduct post-incident health and well-being check-ins

2. Workload Management:

• Develop plans for redistributing work if team members need time to recover
• Consider bringing in temporary support to prevent burnout
• Prioritize tasks to focus on critical operations during the recovery phase

3. Customer Care:

• Create a specialized support team for handling post-incident customer concerns
• Develop a customer recovery program (e.g., credits, extended services, personal outreach)
• Provide extra resources to account managers for personalized follow-ups

4. Financial Assistance:

• Establish an emergency fund for employees facing hardship due to the incident
• Consider salary advances or low-interest loans if the incident has broader financial implications

5. Learning and Improvement:

• Conduct a thorough post-mortem analysis involving representatives from all affected areas
• Share lessons learned transparently across the organization
• Update the BCP based on insights gained from the incident

6. Community Engagement:

• If the incident affected the local community, consider ways to provide support or aid
• Engage in community rebuilding efforts if applicable

7. Recognition and Appreciation:

• Acknowledge the efforts of employees who went above and beyond during the crisis
• Consider company-wide recognition events to boost morale and reinforce team spirit

Understand that how you support your stakeholders after a crisis can have a lasting impact on loyalty, morale, and your company’s reputation.

8. Regular Reviews with a Personal Touch

To keep your BCP relevant and top-of-mind, schedule regular reviews that are engaging and personalized:

1. Quarterly BCP Check-ins:

• Host “BCP Breakfast” sessions where teams discuss recent near-misses or potential risks over a casual meal
• Conduct “Day in the Life” exercises where employees role-play crisis scenarios

2. Annual BCP Summit:

• Organize a company-wide event focused on continuity and resilience
• Invite external speakers, showcase internal innovations, and recognize contributors

3. Success Story Sharing:

• Create a “Resilience Spotlight” series highlighting how elements of the BCP helped in real situations
• Share these stories through company newsletters, all-hands meetings, or a dedicated internal blog

4. Continuous Feedback Loop:

• Implement a simple system for employees to submit BCP improvement ideas year-round
• Offer rewards for the most impactful suggestions

5. Executive Involvement:

• Have C-level executives “sponsor” different aspects of the BCP and report on them regularly
• Include BCP effectiveness as a metric in executive performance reviews

6. Benchmarking and External Review:

• Regularly compare your BCP against industry best practices
• Consider bringing in external consultants for an unbiased review every 2-3 years
• Participate in industry groups or forums focused on business continuity to stay current on trends and challenges

7. Technological Integration:

• Use project management or GRC (Governance, Risk, and Compliance) tools to track BCP tasks and updates
• Implement automated reminders for review deadlines and testing schedules
• Consider using AI-powered tools to analyze incident data and suggest BCP improvements

8. Scenario Expansion:

• Regularly brainstorm new potential crisis scenarios based on current events and emerging risks
• Update your BCP to address these new scenarios
• Conduct “red team” exercises where a group actively tries to find weaknesses in your current plan

By making these reviews engaging and personal, you ensure that your BCP remains a living, evolving document that grows with your organization and stays relevant to your people.

Conclusion: A Living, Breathing Plan

As we wrap up this extended guide, it’s crucial to remember that a truly effective Business Continuity Plan is never finished. It’s a living, breathing entity that grows and evolves with your organization.

Key takeaways for creating and maintaining a human-centered BCP:

1. People First: Always prioritize the human element in your planning. Your employees, customers, and community are your most valuable assets.
2. Inclusive Planning: Involve people from all levels of your organization in the BCP creation and review process. Diverse perspectives lead to more comprehensive and effective plans.
3. Realistic and Actionable: Ensure your strategies and procedures are practical and can be executed under stress. The best plans are those that people can actually follow when it matters most.
4. Clear Communication: Develop a robust, empathetic communication plan. In times of crisis, how you communicate can be just as important as the actions you take.
5. Continuous Learning: Treat every incident, drill, or near-miss as a learning opportunity. Regularly update your BCP based on these lessons.
6. Cultural Integration: Make business continuity a part of your organizational culture, not just a document or a compliance checkbox.
7. Holistic Impact Assessment: Consider both the operational and human impacts of potential disruptions in your planning.
8. Post-Crisis Support: Extend your planning beyond the immediate incident to include support for recovery and growth.
9. Regular, Engaging Reviews: Keep your BCP relevant and top-of-mind through regular, interactive reviews and updates.
10. Leadership Commitment: As leaders, demonstrate your commitment to the BCP through active participation and by exemplifying a culture of preparedness.

As executives and IT leaders, our role extends beyond steering the ship – we’re responsible for caring for our crew and passengers. A well-crafted, human-centered BCP helps us fulfill this responsibility.

As you create or revise your BCP, keep in mind that this is more than a risk management exercise – it’s an expression of your commitment to your people and your mission.

Let that commitment guide you in crafting a plan that truly serves and protects what matters most in your organization.