How ready is your charity?
The COVID-19 pandemic has a significant impact on every organisation, and we are on high alert for every news concerning this pandemic. As we implement short-term measures to grapple with the uncertainties, it is also important to focus on how we can emerge stronger. The current situation has set organisations to reflect whether they can manage downtime and disruptions to their operations. Here is how charities can build resilience:
- Develop a robust and sustainable business continuity plan (“BCP”)
- Review feasibility of the BCP
- Explore technologies to facilitate a mobile and secure workforce during crises such as this circuit breaker period
- Share tips on how to be productive and safe when telecommuting
What is the difference between a Disaster Recovery Plan (“DRP”) and a Business Continuity Plan (“BCP”)?
A DRP is a sub-set of the processes in a BCP. It focuses mainly on restoring IT infrastructures and operations after a crisis. A BCP is a document that outlines how charities can continue to operate during an unforeseen disruption. It is more comprehensive than a DRP as it entails contingencies for work processes, fundraising, volunteer management, programmes, and human resource – every aspect of an organisation that might be affected.
Four-step plan to help create a BCP
- Step 1 – Identify and assess risks your charity faces
List and classify your operational, financial and physical risks. This step should include events related to natural disasters, man-made emergencies, pandemics, and technology-related incidents. These will help you to identify recovery strategies and resources required to recover from disasters within a predetermined and acceptable timeframe. Ascertain any dependencies between operation areas and functions such as communication with donors, beneficiaries and staff, working remotely, and selection of technology tools.
- Step 2 – Conduct an impact analysis
This Step includes evaluating the organisation’s processes to determine which are critical to the operations of the organisation. Important deliverables for this step are a Recovery Time Objective (“RTO”) and a Recovery Point Objective (“RPO”).
The Recovery Time Objective (“RTO”) is the timeframe (and service level) in which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in continuity.
The Recovery Point Objective (“RPO”) describes the time passes during a disruption before the amount of data that exceeds the BCP’s maximum allowable threshold or tolerance, is lost
Charities should also focus on short-term continuity:
- Improvement of cash flow
- Tap into reserves (sinking funds)
- Reach out and talk to significant donors on other platforms when face-to-face interactions are not possible
- Diversify donation streams by seeking new sources of funds or grants that are available during a crisis, for example MCCY, MSF and NCSS
- Availability of IT resources
Charities should also look into reducing cost/processes, and recognise that specific processes cannot be delayed (e.g. processing of payroll and offering support to beneficiaries).
- Step 3 – Explore and design strategies
After knowing the risks and impact on your charity, it is essential to understand how to react and recover. Charities should develop their plans and preventive strategies, including responding to disasters and restoring/rebuilding to the normal state of operation.
- Step 4 – Execute and implement
Charities should form a BCP committee, define their roles, intiate training for their employees and most importantly to test the BCP and verify its effectiveness. The management should have higher, unobstructed visibility and expectations on what the BCP should cover. Thus, the formation of a BCP committee is important when formulating a BCP. Another key consideration for the BCP committee is a disaster recovery strategy, as charities will (more likely than not) need to adopt technology transformation within the organisation. Such transformation may be eligible for grants or schemes to help defray cost incurred.
Sustain your charity with a well-developed BCP
A charity’s risks and requirements are dynamic. They change and adapt as the charity grows. Therefore, it is always a good practice to regularly test the BCP, making sure that it is practical and works. Also, always observe the results and make recommendations for improvements.
To sum it up, always keep the following pointers in mind before, during and after a crisis:
- The existence of a BCP is an investment and not a sunk cost
- Consider integrating the BCP into every business decision – this means to ask questions and find answers to avoid possible loss of key personnel and dependence on crucial customers or suppliers, which have direct impact on the survival of your charity
- Always consider a disaster recovery strategy in your IT plans even if it is a cloud application
- Exercise discipline to update the BCP documentation and commit to conduct BCP simulation test (BCP drill) annually
With a robust BCP in place, your charity will be able to better cushion the impact of any disruption and crisis and go on operating.