The business continuity program checklist for manufacturers

The magnitude of the COVID-19 pandemic has caused manufacturers to strengthen their business continuity plans to protect against disruption at a global scale. Other catastrophes — natural disasters, fires, cyberattacks and prolonged power outages — also pose a serious threat to manufacturing operations.

Business continuity plans provide a map for navigating your response to a business disruption. They transform the “what ifs” — What if your shop is hit by a tornado? What if your network is compromised by ransomware? — into actionable plans to ensure continuity of key assets, technology and business processes.

The business continuity program process involves:

• Identifying what activities or processes are critical to your operations
• Defining and documenting procedures to respond, resume and recover the critical activities
• Testing and maintaining your plan

A strategic business continuity plan always addresses more than just IT recovery. It takes a holistic view of your entire organization and determines how you can continue business, even through the disruption of technology, location or people. As the pandemic clearly illustrated, some disruptions require a much broader response than IT alone can provide.

Your business continuity program checklist

Here’s how manufacturers can build a business continuity program that considers their full operational needs:

1. Conduct a business impact analysis

During this analysis, establish which processes are critical to your operations. To do so, identify what is impacted if you are not able to perform the process or function. Will the inability to perform the function affect your financial bottom line? Is the process or function critical to customer service?

This requires an end-to-end review of your operations, from the point that demand is triggered to the moment product goes out the door. It should also include a step-by-step review of your back-office functions; the inability to pay your employees or process invoices is also a risk to your operations.

After you identify your critical business processes and functions, determine how they are performed and what relationships exist between processes and technology.

In addition, define how long your operations can sustain a disruption. Maybe you can continue business for a short time without resources, but what about two weeks or even longer? Understanding the business impact to disruptions is key to designing your response so you can focus resources on critical operations.

The better defined your processes are, the easier it will be to identify vulnerabilities and alternatives. A recent survey of nearly 200 manufacturers by Wipfli found that few respondents have applied standardized systems to all of their processes. If your processes aren’t well defined or prioritized, the business impact analysis is a helpful tool. It results in a prioritized list of business functions that will allow your company to recover the most critical functions first. The resources associated with those functions can then be prioritized for recovery to ensure resources (e.g., technology, buildings, supplies, people) can produce plans that accommodate the recovery requirements.

2. Define and document procedures

After you complete the business impact analysis, develop contingency plans. The overall plan should include crisis or emergency plans, incident response plans, department and management continuity plans, and IT recovery plans.

The process involves identifying different responses related to the loss of technology, workplace and people. What happens if you lose access to your ERP for a sustained period? What if the shop gets flooded? What if another strain of COVID-19 strikes and a quarter of your workforce is out sick?

Disruptions occur, whether the resources you require to perform your functions are internal or external. Businesses can be impacted by events that are out of their control (a pandemic, as an example). The plans that you create should identify the continuity steps you would consider for each process even if you don’t have access to resources.

As you develop your recovery strategies, it’s essential to ensure you have the capabilities to support your plans. Don’t assume anything in terms of recovery, especially when it comes to your technology. As operations increasingly become digitized, your ability to respond to disruption could be shaped in large part by your underlying IT strategy.

For example, are you operating in the cloud, or are your operations dependent on on-premises hardware? If you’re dependent on on-premises technology, what happens if you lose your facility to a fire or flood? Are you backing up data every day, and are you confirming the back-up processes are working? Or will you need to rebuild digital files if there is a disruption? Do you even know where all of your data is located?

How quickly you can recover will depend on how current your backed-up data is — and how rapidly you can access and restore it.

3. Test and maintain your plans

The plan isn’t complete until it has been thoroughly tested. Tabletop exercises where all relevant team members gather to talk through different scenarios are one of the most successful ways to test continuity plans. Refine the plan as needed until you are confident it addresses how to respond to varying disruptions that could affect your business.

This is not a set-it-and-forget-it process. Successful business continuity plans need to grow and adapt along with your operations. At a minimum, your plan needs to be reviewed and tested on an annual basis for several reasons:

• It presents an opportunity to incorporate any business changes that may affect the plan — such as new equipment, added production lines or new technology capabilities.
• It ensures that your recovery strategies still work as intended.
• It familiarizes your employees with the plan. Roles and responsibilities change; turnover happens. The more that people know what is expected of them during a disruption, the less likely they are to panic or make rash decisions.

The right time to start is now

The entire business continuity planning process can take at least three to four months for a small to mid-size business. It can require even more time for larger businesses. To be sure, it’s difficult for most business owners to carve out time for strategizing responses to various sources of risk. But it can take even longer to recover from adversity if you don’t have a plan in place.

Wipfli can help your team develop a thorough and actionable plan that is aligned with your business recovery requirements. Our manufacturing and technology specialists know what questions to ask to find hidden vulnerabilities and uncover unexpected hurdles to your recovery. We dig into the details to thoroughly document processes, mitigate risk and develop a plan for recovery. We can even administer your business continuity program so that you can focus on more pressing business objectives.

Learn how we can help you manage the unpredictable with confidence so that you can build a more resilient business.

Next week, we’ll explore how you can turn resilience into a competitive advantage. Don’t miss out on that and our other thought-provoking articles just for manufacturing leaders. Sign up using the form on the righthand side of this page to receive articles and our manufacturing newsletter directly in your inbox.

Related content:

• Before you grow, know where you’re going: A guide to getting to the next best version of your manufacturing operations
• Why agility is at the heart of resilience in the manufacturing industry
• 5 benefits of having a business continuity and disaster recovery plan
• Business continuity planning post-pandemic. Keeping your program current and flexible
• What are RTOs and RPOs in business continuity planning