Business Continuity Plan

This guide discusses emergency preparedness and business continuity planning for private employers. It addresses the Occupational Safety and Health Act of 1970 (OSH Act) and its corresponding general industry standards, steps for effective emergency planning, employment law considerations, and strategies for continuing business operations.

1. Form an Emergency Planning Team

  • Select a team of individuals from different levels and departments of the organization. To identify those best suited to emergency planning, consider individuals who:

o are committed to volunteering;

    o display an interest in planning for emergencies; and

    o would be effective in motivating others to develop and implement the plan.

    • Consider advisory members to ensure legal compliance, including compliance with any Occupational Safety and Health Act (OSH Act) requirements.
    • Ensure the team can solicit input from all of the employer’s departments and employees. This may include:

    o management;

    o non-management employees;

    o human resources;

    o maintenance or facilities;

    o safety;

    o health and environmental affairs;

    o security;

    o community relations;

    o sales and marketing;

    o legal; and

    o finance.

    • Designate a team leader or leaders. Employers should consider designating the chief executive officer or plant manager to lead the group to demonstrate management’s commitment to effective planning.

    2. Develop a Mission Statement and Establish a Budget for the Planning Team

    • Issue a mission statement to the planning team. At a minimum, the mission statement should:

    o define the purpose of the emergency planning team; and

    o identify the structure of the team and its authority.

    • Set aside a budget to the planning team. When establishing the budget, consider:

    o the time it will take to research and develop the plan;

    o the cost of printing and distributing the plan to the workforce;

    o the cost of training;

    o if applicable, the cost of outside experts; and

    o any other necessary expenses the employer may incur during the planning process.

    3. Analyze Current Capabilities and Potential Hazards and Emergencies

    • Evaluate the potential business impact of an emergency, keeping in mind the needs of employees, customers, and contractual obligations and considering:

    o the likelihood and effect of a company-wide shutdown or temporary interruption;

    o the departments that would be most affected.

    • Review the plans and policies already in place.

    4. Conduct a Vulnerability Analysis to Determine Planning and Resource Priorities

    • Assess how the employer functions by identifying critical products, services, and operations. Consider:

    o equipment needs;

    o the employer’s relationships with suppliers; and

    o critical services such as power, water, sewer, gas, telecommunications, and transportations.

    • Create a hazard vulnerability chart that lists potential emergencies based on:

    o historic information;

    o geography;

    o weather patterns;

    o technology;

    o human error; and

    o emergencies that could result from design or construction of the facility.

    • Consider the possible impact on regulatory requirements that could result from an emergency and include this information on the chart.
    • Assign each potential emergency a total rating based on the sum of individual ratings for each of the following areas, with one as the lowest probability or potential impact and five as the highest:

    o probability that the emergency will occur;

    o potential human impact of the emergency, including the possibility of death or injury;

    o potential impact of the emergency on the physical workplace, including cost to repair or replace the property and cost to set up temporary replacement, if applicable; and

    o potential business impact of the emergency, including loss of market share, losses due to business interruption and a displaced workforce, company violations in contractual agreements, imposition of fines, legal costs, and losses due to product distribution.

    5. Identify Applicable Regulations

    • Identify any applicable codes and regulations, including any general industry standards that apply, such as:

    ¨ Design and construction of exit routes (29 C.F.R. § 1910.36).

    ¨ Safeguards and maintenance of exit routes (29 C.F.R. § 1910.37).

    ¨ Medical services and first aid (29 C.F.R. § 1910.151).

    ¨ Portable fire extinguishers (29 C.F.R. § 1910.38).

    ¨ Employee alarm systems (29 C.F.R. §§ 1910.37 1910.66).

    ¨ Fire prevention plans (29 C.F.R. § 1910.39).

    6. Ensure Compliance with Any Applicable Laws

    • Consider the following legal issues:

    o Discrimination against employees who comply with emergency evacuation orders.

    o Compliance with the Uniformed Services Employment and Reemployment Rights Act of 1994.

    o Compliance with the Family and Medical Leave Act of 1993.

    o Compliance with the Americans with Disabilities Act of 1990.

    7. Identify Internal Resources for Handling an Emergency

    • Identify existing internal resources and capabilities, including:

    o critical back-up systems;

    o production capabilities;

    o customer services;

    o shipping and receiving;

    o payroll production;

    o information systems support; and

    o emergency power and recovery support.

    • Evaluate any vulnerabilities and where improvement is needed.

    8. Identify External Resources for Handling an Emergency

    • Coordinate with outside groups that may provide resources in an emergency, including:

    o Federal, state, and local government agencies.

    o Community organizations.

    o Utility companies that service the employer’s locations.

    o Insurance carriers.

    o Local hospitals and medical facilities.

    o Local emergency management offices.

    9. Draft the Emergency Preparedness Plan

    • Outline the major components of the plan, including:

    o the authority and responsibilities of key personnel;

    o the types of emergencies that may occur;

    o the location where response operations will be managed;

    o the physical location of the employer’s command center;

    o responders’ contact information; and

    o an out-of-state phone number for employees or families to call for more information in an emergency.

    • Identify key personnel, including their:

    o contact information, including email addresses and phone numbers; and

    o duties and responsibilities in the event of an emergency.

    • Develop emergency response procedures. These typically describe:

    o procedures for reporting emergencies;

    o procedures for assessing situations to establish the extent of the emergency;

    o escape routes from the facility for various types of evacuations;

    o procedures for employees who perform or shut down critical operations before an evacuation;

    o procedures to account for all employees;

    o a plan for protection of the employer’s property, including methods to protect equipment and vital records;

    o community outreach, including plans for coordinating with outside organizations such as local government personnel;

    o plans for business continuity, recovery, and restoration; and

    o plans for training employees.

    • Create support documents, including:

    o emergency contact lists;

    o building maps; and

    o lists of key personnel and external resources.

    • Prepare an executive summary that includes:

    o the purpose of the plan;

    o a list of potential emergencies;

    o a description of how the employer will respond to an emergency, including where response operations will be managed; and

    o key personnel, including their responsibilities.

    10. Implement the Emergency Preparedness Plan

    • Make the emergency preparedness and business continuity plan available to employees either electronically or by providing a hard copy. Consider making the plan available:

    o in a corporate newsletter;

    o in an employee handbook or manual;

    o on the intranet;

    o through an email attachment;

    o on a bulletin board; and

    o through social media.

    • Develop a plan for training employees and key personnel. Determine:

    o who should be trained;

    o how to train them;

    o when and where training will take place; and

    o how the training program will be evaluated, such as asking participants for feedback.

    • Consider using the following activities to train key personnel:

    o orientation and education sessions, which are regularly scheduled discussion sessions to provide information, answer questions, and identify needs and concerns;

    o tabletop exercises, which allow team members to discuss their responsibilities and how they would react in emergency scenarios;

    o walk-through drills, which enable response teams to perform their emergency functions;

    o functional drills, which test emergency notifications and communications procedures and equipment;

    o evacuation drills; and

    o full-scale exercises, which simulate emergency situations.

    • Conduct general training for all employees. Training should include:

    o roles and responsibilities;

    o information about threats, hazards, and protective actions;

    o emergency notification, warning, and communication procedures;

    o emergency response procedures;

    o evacuation procedures;

    o the location of emergency equipment and how to use it; and

    o emergency shut-down procedures.

    • Solicit feedback after each training session and implement any necessary changes.
    • Revise training if the emergency planning and business continuity plan is updated.

    11. Plan for Business Continuity

    • Provide for a smooth transition and continued operations following an emergency or a disaster by:

    ¨ Assessing how the employer functions, including:

    o determining which staff, materials, procedures, and equipment are absolutely necessary to keep their business operating;

    o reviewing the employer’s business process flowchart, if one exists, to understand how the business operates and which parts of the business could be impacted by an emergency;

    o identifying operations critical to survival and recovery, including emergency payroll, expedited financial decision-making, and accounting systems to track and document costs in the event of a disaster; and

    o establishing procedures for succession of management (including at least one person who is not located at the employer headquarters, if applicable).

    ¨ Identifying the suppliers, shippers, resources, and other businesses the employer must interact with daily. Additionally, employers should:

    o develop professional relationships with more than one company to use if their primary contractor cannot service their company’s needs (as a disaster that shuts down a key supplier can be devastating to a business); and

    o create a contact list for existing critical business contractors and others to use in an emergency. Keep this list with other important documents on file, in the emergency supply kit, and at an off-site location.

    ¨ Creating a continuity of operations plan and reviewing it annually. When developing the plan, employers should:

    o plan what they will do if a building, plant, or store is not accessible;

    o consider whether the business can function from a different location, remotely, or through the homes of employees;

    o develop relationships with other companies to use their facilities in case a disaster makes the employer’s location unusable; and

    o plan for payroll continuity.

    ¨ Defining crisis management procedures and individual responsibilities in advance. At a minimum, employers should:

    o make sure those involved know what they are supposed to do; and

    o train others for back-up purposes.

    ¨ Planning for communications with employees and relevant third parties. Two-way communication is central before, during, and after a disaster. Employers should consider:

    o including emergency preparedness information in newsletters, on the employer’s intranet, in periodic employee emails, and other internal communications tools;

    o setting up a telephone calling tree, a page on the employer’s website, an email alert, or a call-in voice recording to communicate with employees in an emergency;

    o designating an out-of-town voice message service where employees can leave an “I’m okay” message in a catastrophic disaster;

    o providing employees with quick, wallet-sized “cheat sheets” with important contact information, including the names, telephone numbers, and email addresses of key personnel;

    o maintaining open communications where employees can bring questions and concerns to the employer’s leadership;

    o meeting with other businesses in the employer’s building or industrial complex to share best practices and form relationships that can be beneficial in an emergency;

    o meeting with first responders, emergency managers, community organizations, and utility providers;

    o planning with suppliers, shippers, and others third parties with which the employer conducts regular business; and

    o sharing the employer’s plans and encouraging other businesses to set in motion their own business continuity planning.

    For more information on emergency planning, contact our business attorneys at