Business Continuity Planning

Underlying policies, principles and/or standards

UN Policy on the Organizational Resilience Management System (ORMS), CEB/2014/HLCM/17/Rev.1, 2021 
Policy for Enterprise Risk Management in UNHCR, HCP/2020/2

Good practice recommendations

The following steps are essential when developing an effective BCP.

One: Assemble a business continuity planning team. A multi-disciplinary team coordinates business continuity planning activities before and after a BCP has been activated. Before activation, it develops and updates the BCP, and leads related exercises and training. Led by the Representative or Head of Office, the team should include representatives from the following departments inter alia:

• Security.
• Programme.
• Protection and essential services to Persons of Concern
• Finance/Administration / human resources.
• Supply.
• Information Technology.
• Communications.

Members should be experienced international and national staff members who have the capacity to implement critical programme and protection activities through a disruption.

Two: Identify critical processes. Critical functions, processes and services that need to be maintained during periods of crisis must be identified beforehand. Which programme activities must be continued to fulfil UNHCR's overall mission? The office should consider the criticality of each programme and activity for which it is responsible under the Operations Plan (OP). In high risk situations, the UN Country Team (UNCT) may conduct a Programme Criticality (PC) exercise to determine which programme activities will be prioritized following a serious disruption, and how each will be sustained. [See the Entry on Programme Criticality.]

Identification of critical operations should be based on criteria including:

• Maintenance of essential protection, wellbeing and other services to refugees.
• Critical liaison with the national and local authorities, national commission for refugees, host government and other partners, UN or else.
• Enabling and support functions such as supply, logistics, communications and security.

In high to very high security risk countries, pre-identification of some critical activities and programmes may have been conducted through joint UN programme criticality assessments. In other settings, it is recommended that a similar methodology be applied to pre-identify and agree on critical services.

As well as listing critical functions, the Business Continuity Plan should provide information on:

• The minimum number of qualified staff required to continue the critical programmes/activities, and their roles and responsibilities. This staff needs to be identified, briefed or trained beforehand on the functions they will perform.
• The minimum resources, including funds and assets, needed to accomplish these functions, such as office, alternative meeting room space and/or ability to work from home, information technology materials, communications systems, vehicles. These resources should be identified beforehand and clearly listed in the BCP.
• The addresses of back-up locations and description of available facilities (workstations, IT, communications equipment, etc.). Additionally, a list of assets that need to be transferred to the back-up location should be provided;
• Pre-arrangements and memorandums of understanding (MOUs) with identified partners or private sector to facilitate UNHCR's rapid access to additional assets, tools and spaces necessary to implement the BCP (office space in UN Agencies, Funds, Programmes and Organizations, or in hotels, additional transport and accommodation, internet connectivity solutions, etc.).

Finally, these should be identified as being either:

• Critical and need to be maintained in the location (at office or alternate location, or residence).
• Critical and can be relocated or performed remotely, be it in the country or abroad.

In the case of SARS-CoV-2 (or COVID-19), operations will also focus on the ability of staff members fulfilling critical functions to perform these tasks from home as teleworking may become a recommended measure.

Personnel.Following a serious disruption, international staff may need to be moved out of the area. A National Staff Plan should determine which staff are vital to the delivery of each essential programme activity. A National Staff Plan should:

• Designate a senior national staff member to take overall charge.
• Take measures to protect the safety and security of national staff.
• Make arrangements for payment of salaries and expenses.
• Determine how logistical support requirements will be met.
• Establish communication protocols and related equipment requirements.

Facilities. Does the activity require facilities (offices, staff accommodation, warehouses, etc.)? Plan alternative facilities or work modalities. Consider a variety of options.

Logistics and suppliers. What transport and equipment does the activity require? Make plans for emergency sourcing, pre-positioning and take other steps to meet key supply needs.

Partners. Does the activity rely on partners or other actors? In the event of a serious disruption, are they likely to be in a position to continue their work or to carry out activities implemented by UNHCR? Planning assumptions should be checked with partners and other actors.

Communications. What systems and equipment does the activity require? Consider this question alongside plans for alternative work locations and methods.

Information Technology (IT). What systems, services, data and equipment does the activity require? Note that BCPs are separate from, though related to IT Disaster Recovery Plans and Major Incident Management Processes.

Note: While BCPs are separate from other plans such as Security Plan, Critical Incident Management Plan, IT Disaster Recovery Plan, Mass Casualty Incident Response Plan, Emergency Communications Plan, Medical Evacuation Plan, etc; It is important to ensure all these plans are harmonized and compatible.

Three: Conduct an impact analysis. When critical processes are disrupted, what will be the effect on programme activities? Estimate effects over time (hours, days, months, etc.) and use the information to prioritize your response actions.

Four: Identify critical process alternatives. If processes critical to the performance of an activity are disrupted, what alternatives are available? For every critical process, identify at least one viable alternative.

Considerations for practical implementation

The Division of Emergency, Security and Supply (DESS), in collaboration with the Enterprise Risk Management team (ERM), the Division of Financial and Administrative Management (DFAM) and the Division of Information Systems and Telecommunications (DIST), has developed and launched an online BCP Power Application in 2020 to facilitate mandatory Business Continuity Planning (BCP) at all field levels.
All Country Operations, Multi-Country Offices and Regional Bureaus are requested to update their Business Continuity Plans, at least annually, using the new tool. This online tool simplifies Business Continuity Planning and offers a more user-friendly interface to enter, edit and view data, and supports management analysis and oversight. Managers will be able to more readily review existing critical tasks, how and to whom critical tasks have been assigned and enter additional information related to emergency, security and records management.
As with previous efforts to update and centralize Business Continuity Plans, each operation is to designate a BCP focal point. Regional teams with whom this tool is shared today can now provide user rights to these country focal points in order to allow access. Users of the Power App will thus be granted specific access profiles to allow the fulfilment of their respective tasks and update existing BCPs developed under a different modality in May 2020. Likewise, as was done previously, each Regional Bureau should identify a multifunctional BCP team to review country submissions and provide feedback on entries and inform HQ about compliance at the regional level.

Resources and partnerships

• Business continuity planning should be done by a multidisciplinary BCP Team including representatives from operational sections, security, administration, programmes, protection, ICT, and supply. The senior manager in the operation must be familiar with and must ultimately approve the BCP.
• Partners include appropriate counterparts in the host government and other humanitarian or development agencies, local community leaders, and programme beneficiaries. When partners business are involved in BCP and BCP training, it can enrich the process, generate insights and a better understanding of security problems, and raise the quality of BCP to everyone's benefit.

Performance Indicators

• Plan available (harmonized with other internal and UN-wide plans)
• Coordinated structure established (includes all relevant entities)
• Joint risk register including protection, programme, security, medical and BC risks is available
• Regular maintenance, exercise and review