Business continuity plan for workplace safety: how to build one

A business continuity plan (BCP) sets out how your business keeps people safe and keeps running during and after an emergency. It covers the risks you face, the functions you cannot afford to lose, what people do in the first minutes, how you communicate, and how you recover. Most plans focus on IT and supplies. A workplace safety BCP puts the health and safety of workers first at every stage.

You build it by working through a small number of steps: assess the risks, identify critical functions, write response procedures, plan communication, plan recovery, then train people and test the plan with drills. Start with the risks most likely to hurt someone at your site, and build outward from there.

What is a business continuity plan?

A business continuity plan is a documented strategy for keeping the business operating through a disruption. It usually includes IT systems, suppliers and essential services. The safety part is easy to overlook, but it is the part that protects people while the rest is being restored.

A safety-focused BCP does three things. It tells people what to do to stay safe, it limits the damage an incident can cause, and it tells the business how to restart work without putting workers at risk. It also supports your duties under the Work Health and Safety Act 2011, because a plan that has been thought through is easier to show an inspector than one that has not.

A general emergency plan covers the immediate response, such as an evacuation. A BCP goes further. It covers how the business keeps going, and how it returns to normal.

Step 1: Identify the risks

Start by listing the events that could disrupt your site and hurt someone. No two businesses face the same list. Common examples include:

• natural events such as bushfires, floods, storms and extreme heat
• health emergencies, such as an outbreak of an infectious disease
• power, water or gas failures
• chemical spills, fires, equipment failure and structural damage
• security incidents, including violence at work
• IT failures and cyberattacks that affect safety systems, such as alarms, access control or plant controls
• disruption to deliveries of goods that are needed to work safely

Ask the people who do the work what could go wrong. They often know the hazards better than anyone. Then rate each risk by how likely it is and how badly it could hurt someone. Use your risk management plan or risk register to record the results, so you can see which risks need a plan first.

Step 2: Identify critical functions

Next, work out which parts of the business you must keep running safely. A critical function is one where a failure would cause harm, stop safety controls from working, or make the business unable to operate.

Ask:

• Which services or processes cannot stop, even briefly?
• Which people, systems or equipment are needed to keep those services safe?
• Which suppliers would stop the work if they failed?
• Which safety systems, such as ventilation, fire detection or emergency lighting, must keep working?

Here is an example. A cold store depends on refrigeration. If the power fails, the problem is not just lost stock. Food safety, and the safety of staff working in the cold, may both be at risk. Another example: if only two people on site are trained to handle a hazardous chemical, a plan that leaves them out of the response leaves a gap.

For each critical function, record how quickly it must be restored, sometimes called a recovery time objective. That tells you how much work the recovery plan must do.

Step 3: Write the response procedures

Response procedures tell people what to do in the moment. Write one for each of the risks that could hurt people. A good procedure is short, clear and specific to the place where it will be used.

Common procedures include:

• Evacuation for fire, gas or chemical leaks. Include the alarm, the assembly point, the roll call and who checks that everyone is out.
• Shelter in place for chemical spills, smoke or airborne threats, where moving people would be more dangerous. Include how to close doors and vents, and when it is safe to leave.
• First aid and medical response, including who is trained, where the kits are, and when to call emergency services.
• Emergency contacts for emergency services, utilities, building management and key staff. Keep the list on paper as well as on a phone.

The emergency response plan template gives you a structure for these procedures. For an existing site, our post on implementing an emergency response plan in the workplace covers the steps in more detail. Safe Work Australia's emergency plans fact sheet also sets out what an emergency plan should cover.

Step 4: Plan the communication

In an emergency, confusion can make the danger worse. A communication plan makes sure the right people hear the right message at the right time.

Your plan should answer:

• Who needs to be told, including staff, contractors, visitors and neighbours?
• Who sends each message, and who approves it?
• How will the message reach people? Use more than one channel, such as a loudspeaker, a text message, a radio or a printed sign. Email alone will fail if the network is down.
• How will you reach people who cannot hear an alarm, read a screen or understand English?
• Who speaks to customers, suppliers and regulators, and what do they say?

Give one person the role of emergency spokesperson so the business does not send mixed messages. After the incident, plan a short update to staff, even if the update is only that the situation is under control.

Step 5: Plan the recovery

Once the immediate danger has passed, the business needs to restart. The disaster recovery plan sets out how systems, premises and supplies are restored, in what order.

Include:

• how data and systems are backed up and restored
• where people will work if the site cannot be used, including remote work and alternative sites
• which suppliers can replace those that have failed
• the order in which functions are restored, based on the recovery times you set in step 2
• the safety checks needed before people return to a damaged site, such as structural inspections and gas or electrical testing

Recovery is where many plans fail. Staff may return to a site that is not yet safe, or work may restart before the controls are back in place. Do not restart a critical function until its safety controls are working. The disaster recovery plan and the business continuity plan templates both cover the recovery stage.

Step 6: Train people and test the plan

A plan is only as good as the people who use it. Train everyone who has a role, including new starters, contractors and casual staff. Cover the procedures they must follow, where to find them and what they are responsible for.

Test the plan regularly. Good tests include:

• a fire evacuation with a roll call
• a shelter-in-place drill for a chemical spill
• a call tree test to check that messages reach everyone
• a tabletop exercise where managers talk through a loss of power or a cyberattack

Record what happened in each drill, what went wrong and who will fix it. An emergency drill report gives you a consistent way to do that.

Common mistakes

The plan is out of date. Contact lists and roles change often. Check the plan at least once a year, and after any incident, change of premises or change of staff in a key role.

Communication depends on one channel. Use at least two ways to send an alert, and check they work.

Workers were not involved. The people who do the work know where the hazards are. Involve them in writing and reviewing the plan.

Recovery is not planned. A plan that stops at response leaves the business guessing about how to restart. Include recovery steps and the safety checks before anyone returns.

Common questions

Is a business continuity plan a legal requirement? The WHS Regulations require a workplace to have an emergency plan, and it must cover the emergencies that could reasonably happen there. A BCP is a wider document that you can use to meet that requirement and to cover the business side. Check the emergency plan rules that apply in your state or territory with your regulator.

How is a BCP different from an emergency plan? An emergency plan covers the immediate response, such as evacuation and first aid. A BCP covers the wider disruption, including how the business keeps operating and recovers.

How often should we test the plan? Test it at least once a year, and after any significant change. Smaller tests, such as a call tree check, are quick and can be done more often.

Who should own the plan? A senior person with the authority to make decisions, usually the business owner or a manager. Name a deputy, and make sure both know their roles.

Read next

• Fire evacuation plan: guide to effective implementation
• Risk assessment 101: what it is and how to get it right

How SafetyDocs helps

SafetyDocs has business continuity and disaster recovery plans written by safety experts, and an emergency response plan you can adapt to your site. Job, client and site details fill themselves in, so the plan starts with your own details. When the plan changes, everyone who signed the old version is asked to sign the new one, so you have a record that the team has read the update.

This is general information, not legal advice. Check the current law with your WHS regulator.