A Business Continuity Plan To Ensure Your Laboratory is Prepared for the Next Crisis
Ted Myatt | January 11, 2018
It is not a matter of if disasters will occur, but when will they occur. All institutions are at risk from disasters including natural and environmental disasters, power and energy disruptions, transportation failures, and sabotage (e.g., cyber attacks). The research environment presents unique risk management challenges. Laboratories have significant funds invested in research materials, laboratory animals, and specialized equipment and environmental controls. Examples of disruptions to research can include loss of biological samples and research animals as a result of power outages or flooding. It is vital that laboratories have an effective business continuity plan for protecting these assets and for minimizing disruption and potential financial loss in the event of a disaster.
What is Business Continuity Planning?
Creating and maintaining a business continuity plan (BCP) helps ensure that an organization has the resources and information needed to deal with emergencies. Business continuity planning comprises the steps, policies and procedures that are activated once a disaster has occurred. The object is to recover as quickly as possible to minimize downtime and financial loss.
Critical services or products are those that must be delivered to ensure survival, avoid causing injury, and meet legal or other obligations of an organization. This includes, but is not limited to:
- Plans, measures and arrangements to ensure the continuous delivery of critical services and products, which permits the organization to recover its facility, data and assets.
- Identification of necessary resources to support business continuity, including personnel, information, equipment, financial allocations, legal counsel, infrastructure protection and accommodations.
Business continuity planning ensures critical services or products are delivered during a disruption.
Key Steps in Business Continuity Planning
Identify Essential Business Operations and Services
The first step is to identify the essential business operations and services necessary to protect the research materials, data, equipment, records and critical supplies that may be impacted by a disruption. Questions a research facility must address include:
- What are our essential assets and functions? For example, in vivo animal models, transgenic animals, cell lines, primary tissue, genetically engineered vectors, compound libraries, scientific and/or clinical data.
- Who are the key personnel and vendors required to perform this function?
- What are the crucial resources required for this function?
- What are the consequences if this essential function is not resumed quickly following a disruption or disaster?
Organize and Document
Many laboratories depend on specialized equipment and supplies. Develop and maintain lists of equipment, supplies, and vendors because it is important to have information readily available during a crisis. Consider the needs of specialized environments, such as vivariums.
Plan for Recovery
After identifying essential operations and services, it’s essential to consider the required tasks to recover and back-up plans. Key personnel and responsibilities should be identified. Questions to consider are:
- What would we do it the facility, key equipment, staff or supplies were not available for this operation or service?
- How would we recover from a severe impact or loss of any of those assets/functions?
- How do we then best protect those assets/functions and prevent impacts/losses from occurring?
Consider Loss of Power
While not all disasters may involve the loss of power, a power outage is a big challenge for any organization. Power outages have the potential to result in loss of valuable specimens and years of research. To lessen the risk of losing important research, business continuity planning should address the following:
- Understand your facility’s emergency backup power system(s), including how long the backup power can be relied upon, and who is the main point of contact for the system.
- Verify that freezers, refrigerators, incubators, and other temperature-sensitive equipment holding critical materials are connected to an emergency power.
- Know how long freezers, refrigerators, incubators not connected to emergency power supply will maintain proper temperatures.
- For equipment that is highly sensitive to slight power delays or fluctuations, install uninterruptible power supply (UPS).
Track equipment that have an automatic “on” switch that may come back on by itself when power is lost and then restored, and equipment that may need to be restarted when power is restored.
Involve Key Stakeholders
An important factor to successful business continuity planning is ensuring that you have included all the relevant stakeholders in the planning process and in developing the written business continuity plan. This helps ensure that all research operations are taken into account when developing the continuity plan. In a research environment this can include personnel such as:
- Scientific research community
- Vivarium operations personnel
- Facility operations personnel
- Environmental health and safety professionals
- Human resources
- Information Technology
Review and Test to Verify the Plan Works
Business continuity plans are not complete until you can demonstrate that they work. The plan must be communicated with all the relevant stakeholders and any personnel that will be responsible for implementing the plan in the event of a disaster. Conduct tabletop exercises using various real-life scenarios (e.g., fire, flood, hurricane) to ensure that all potential aspects of an event are adequately addressed. These exercises should be conducted at least annually once the plan is established to ensure new personnel are trained and to keep all staff updated and ready to respond in the event of a disaster. Additionally, the continuity plan must be reviewed at least annually by all relevant stakeholders in order to adapt to the ever-changing environment. For example, an emergency call list must be reviewed and updated as personnel responsibilities for response change in the organization. In addition, improvements to the business continuity plan may be warranted after a tabletop exercise identifies gaps in the plan.
Turn a Crisis into an Opportunity
Every crisis presents an opportunity to review the effectiveness of the business continuity plan and to determine if modifications are necessary. When the crisis has passed, the Crisis Management Team (usually comprised of key leadership position holders within an organization) should convene to assess its performance and to determine ways in which the institution’s response could be improved. For example, did the planned measures appropriately address the situation and help alleviate disruption to operations? Did personnel understand their role in implementing the measures? Is additional training needed?
Process documentation is key to evaluating the response post-incident, including a narrative of events, emergency response actions, communication efforts, receipts for costs, etc. This documentation should be maintained by an appropriate member of senior management (e.g., operations, research, environmental health and safety).
No institution is immune from the losses that can result from a crisis. Research facilities need to take precautions in order to protect staff and their assets, many of which are unique and irreplaceable. Business continuity planning is a process that requires the involvement of various personnel to ensure that all areas of operations are addressed. The process does not end with the development of the plan – the plan must continually be reviewed and tested to ensure its effectiveness and to keep up with the ever-changing laboratory environment.