UNHCR documents speak of ‘Business Continuity Plans' (BCPs), ‘Business Continuity Resilience Planning' (BCRP), and ‘Continuity of Operations Planning' (COOP). In this Handbook, ‘business continuity planning' covers all three. It refers to the preparation of plans and related management processes that enable UNHCR to maintain critical processes (for the delivery of essential services or products) after a disruptive event. A BCP is a roadmap that enables an operation to continue in adverse conditions (for example, after disruption due to natural or man-made hazards).
A Business Continuity Plan (BCP) is a plan for how an office will continue its most critical functions in the event of a disruption, be it natural, manmade or medical.
Business Continuity Planning is one of the eight critical components of the Organizational Resilience Management System (ORM), a UN-wide comprehensive system to "improve the capacity of UN Agencies, Funds, programmes and Organizations to effectively manage the risks of disruptive events", by ensuring "health, safety and security and well-being of personnel", and maintaining "the continuity of critical processes and capacity to implement mandates and programmes".
A Business continuity plan must address the threats most likely to affect the functioning of a UNHCR office. Threats of highest impact are typically identified in the corporate risk register completed by all UNHCR operations and in Security Risk Management (SRM) documents developed at country level.
All scenarios that could affect any aspect of UNHCR operations (e.g. programmes, human resources, infrastructure, information technology, telecommunications) should be considered, including both internal and external, safety and security incidents (e.g. fires, floods, earthquakes, conflicts, civil unrest, mass protests).
The ultimate aim of Business Continuity Planning is to address the threats to ensure UNHCR objectives (i.e. the protection and assistance to Persons of Concern) can be achieved, when due to exceptional circumstances, such as office closure or damage, relocation or evacuation of staff for security reasons the achievement of the objectives are at stake. Another example is the disruption of UNHCR work during COVID-19, when staff is forced to work from home or multiple staff members are sick.
Business Continuity Planning increases UNHCR resilience in the face of potential disruptions to the agency's ability to operate during crises and emergencies. Business Continuity plans cover all UNHCR offices and staff.
The main objectives of UNHCR's Business Continuity Plans are to:
- Ensure the safety of UNHCR staff, premises and assets.
- Maintain critical UNHCR programmes and operations.
- Ensure UNHCR is able to deliver a swift and effective response during periods of crises.
UNHCR's ability to respond swiftly in a crisis, maintaining critical operations or restoring them as soon as possible, is key to maintaining credibility in the eyes of partners and stakeholders. Business continuity plans bring together all procedures, measures, information, assets and tools necessary for each UNHCR office to achieve the above objectives.
Underlying policies, principles and/or standards
Good practice recommendations
The following steps are essential when developing an effective BCP.
One: Assemble a business continuity planning team. A multi-disciplinary team coordinates business continuity planning activities before and after a BCP has been activated. Before activation, it develops and updates the BCP, and leads related exercises and training. Led by the Representative or Head of Office, the team should include representatives from the following departments inter alia:
- Protection and essential services to Persons of Concern
- Finance/Administration / human resources.
- Information Technology.
Members should be experienced international and national staff members who have the capacity to implement critical programme and protection activities through a disruption.
Two: Identify critical processes. Critical functions, processes and services that need to be maintained during periods of crisis must be identified beforehand. Which programme activities must be continued to fulfil UNHCR's overall mission? The office should consider the criticality of each programme and activity for which it is responsible under the Operations Plan (OP). In high risk situations, the UN Country Team (UNCT) may conduct a Programme Criticality (PC) exercise to determine which programme activities will be prioritized following a serious disruption, and how each will be sustained. [See the Entry on Programme Criticality.]
Identification of critical operations should be based on criteria including:
- Maintenance of essential protection, wellbeing and other services to refugees.
- Critical liaison with the national and local authorities, national commission for refugees, host government and other partners, UN or else.
- Enabling and support functions such as supply, logistics, communications and security.
In high to very high security risk countries, pre-identification of some critical activities and programmes may have been conducted through joint UN programme criticality assessments. In other settings, it is recommended that a similar methodology be applied to pre-identify and agree on critical services.
As well as listing critical functions, the Business Continuity Plan should provide information on:
- The minimum number of qualified staff required to continue the critical programmes/activities, and their roles and responsibilities. This staff needs to be identified, briefed or trained beforehand on the functions they will perform.
- The minimum resources, including funds and assets, needed to accomplish these functions, such as office, alternative meeting room space and/or ability to work from home, information technology materials, communications systems, vehicles. These resources should be identified beforehand and clearly listed in the BCP.
- The addresses of back-up locations and description of available facilities (workstations, IT, communications equipment, etc.). Additionally, a list of assets that need to be transferred to the back-up location should be provided;
- Pre-arrangements and memorandums of understanding (MOUs) with identified partners or private sector to facilitate UNHCR's rapid access to additional assets, tools and spaces necessary to implement the BCP (office space in UN Agencies, Funds, Programmes and Organizations, or in hotels, additional transport and accommodation, internet connectivity solutions, etc.).
Finally, these should be identified as being either:
- Critical and need to be maintained in the location (at office or alternate location, or residence).
- Critical and can be relocated or performed remotely, be it in the country or abroad.
In the case of SARS-CoV-2 (or COVID-19), operations will also focus on the ability of staff members fulfilling critical functions to perform these tasks from home as teleworking may become a recommended measure.
Personnel.Following a serious disruption, international staff may need to be moved out of the area. A National Staff Plan should determine which staff are vital to the delivery of each essential programme activity. A National Staff Plan should:
- Designate a senior national staff member to take overall charge.
- Take measures to protect the safety and security of national staff.
- Make arrangements for payment of salaries and expenses.
- Determine how logistical support requirements will be met.
- Establish communication protocols and related equipment requirements.
Facilities. Does the activity require facilities (offices, staff accommodation, warehouses, etc.)? Plan alternative facilities or work modalities. Consider a variety of options.
Logistics and suppliers.What transport and equipment does the activity require? Make plans for emergency sourcing, pre-positioning and take other steps to meet key supply needs.
Partners. Does the activity rely on partners or other actors? In the event of a serious disruption, are they likely to be in a position to continue their work or to carry out activities implemented by UNHCR? Planning assumptions should be checked with partners and other actors.
Communications.What systems and equipment does the activity require? Consider this question alongside plans for alternative work locations and methods.
Information Technology (IT).What systems, services, data and equipment does the activity require? Note that BCPs are separate from, though related to IT Disaster Recovery Plans and Major Incident Management Processes.
Note: While BCPs are separate from other plans such as Security Plan, Critical Incident Management Plan, IT Disaster Recovery Plan, Mass Casualty Incident Response Plan, Emergency Communications Plan, Medical Evacuation Plan, etc; It is important to ensure all these plans are harmonized and compatible.
Three: Conduct an impact analysis. When critical processes are disrupted, what will be the effect on programme activities? Estimate effects over time (hours, days, months, etc.) and use the information to prioritize your response actions.
Four: Identify critical process alternatives. If processes critical to the performance of an activity are disrupted, what alternatives are available? For every critical process, identify at least one viable alternative.
Considerations for practical implementation
The Division of Emergency, Security and Supply (DESS), in collaboration with the Enterprise Risk Management team (ERM), the Division of Financial and Administrative Management (DFAM) and the Division of Information Systems and Telecommunications (DIST), has developed and launched an online BCP Power Application in 2020 to facilitate mandatory Business Continuity Planning (BCP) at all field levels.
All Country Operations, Multi-Country Offices and Regional Bureaus are requested to update their Business Continuity Plans, at least annually, using the new tool. This online tool simplifies Business Continuity Planning and offers a more user-friendly interface to enter, edit and view data, and supports management analysis and oversight. Managers will be able to more readily review existing critical tasks, how and to whom critical tasks have been assigned and enter additional information related to emergency, security and records management.
As with previous efforts to update and centralize Business Continuity Plans, each operation is to designate a BCP focal point. Regional teams with whom this tool is shared today can now provide user rights to these country focal points in order to allow access. Users of the Power App will thus be granted specific access profiles to allow the fulfilment of their respective tasks and update existing BCPs developed under a different modality in May 2020. Likewise, as was done previously, each Regional Bureau should identify a multifunctional BCP team to review country submissions and provide feedback on entries and inform HQ about compliance at the regional level.
Resources and partnerships
- Business continuity planning should be done by a multidisciplinary BCP Team including representatives from operational sections, security, administration, programmes, protection, ICT, and supply. The senior manager in the operation must be familiar with and must ultimately approve the BCP.
- Partners include appropriate counterparts in the host government and other humanitarian or development agencies, local community leaders, and programme beneficiaries. When partners business are involved in BCP and BCP training, it can enrich the process, generate insights and a better understanding of security problems, and raise the quality of BCP to everyone's benefit.
- Plan available (harmonized with other internal and UN-wide plans)
- Coordinated structure established (includes all relevant entities)
- Joint risk register including protection, programme, security, medical and BC risks is available
- Regular maintenance, exercise and review
In this section:
Let us know what you think of the new site and help us improve your user experience….