Is Your Laboratory Prepared for the Next Crisis? A Proper Business Continuity Plan Will Ensure That It Is
by Betsy Gilman Duane, MS, RBP, CBSP
It is not a matter of if disasters will occur, but when will they occur. All institutions are at risk from potential disasters including natural and environmental disasters, power and energy disruptions, transportation failures, and sabotage (e.g., cyber attacks). The research environment presents unique risk management challenges. Laboratories have significant funds invested in research materials, laboratory animals, and specialized equipment and environmental controls. Examples of disruptions to research can include loss of biological samples and research animals as a result of power outages or flooding. It is vital that laboratories have an effective plan for protecting these assets and for minimizing disruption and potential financial loss in the event of a disaster.
What is Business Continuity Planning?
Creating and maintaining a business continuity plan (BCP) helps ensure that an organization has the resources and information needed to deal with emergencies. Business continuity planning comprises the steps, policies and procedures that are activated once a disaster has occurred. The object is to recover as quickly as possible to minimize downtime and financial loss.
Critical services or products are those that must be delivered to ensure survival, avoid causing injury, and meet legal or other obligations of an organization. This includes, but is not limited to:
- Plans, measures and arrangements to ensure the continuous delivery of critical services and products, which permits the organization to recover its facility, data and assets.
- Identification of necessary resources to support business continuity, including personnel, information, equipment, financial allocations, legal counsel, infrastructure protection and accommodations.
Business continuity planning ensures critical services or products are delivered during a disruption.
Key Steps in Business Continuity Planning
Identify Critical Business Operations and Services
The first step is to identify the critical business operations and services necessary to protect the research materials, data, equipment, records and critical supplies that may be impacted by a disruption. Questions a research facility must address include:
- What are our critical assets and functions? For example:In vivo animal models, transgenic animals
Cell lines, primary tissue, genetically engineered vectors
Intellectual property, scientific and/or clinical data
- How would we recover from a severe impact or loss of any of those assets/functions?
- How do we then best protect those assets/functions and prevent impacts/losses from occurring?
Involve Key Stakeholders
An important factor to successful business continuity planning is ensuring that you have included all the relevant stakeholders in the planning process and in developing the written business continuity plan. This helps ensure that all research operations are taken into account when developing the continuity plan. In a research environment these include, but are not limited to:
- Scientific research community
- Vivarium operations personnel
- Facility operations personnel
- EH&S professionals
- Human resources
Review and Test to Verify the Plan Works
Continuity plans are not complete until you can demonstrate that they work. The plan must be communicated with all the relevant stakeholders and any personnel that will be responsible for implementing the plan in the event of a disaster. Conduct tabletop exercises using various real-life scenarios (e.g., fire, flood, hurricane) to ensure that all potential aspects of a particular event are adequately addressed. These exercises should be conducted at least annually once the plan is established to ensure new personnel are trained and to keep all staff updated and ready to respond in the event of a disaster. Additionally, the continuity plan must be reviewed at least annually by all relevant stakeholders in order to adapt to the ever-changing environment. For example, an emergency call list must be reviewed and updated as personnel responsibilities for response change in the organization. In addition, improvements to the continuity plan may be warranted after a tabletop exercise identifies gaps in the plan.
Turn a Crisis into an Opportunity
Every crisis presents an opportunity to review the effectiveness of the continuity plan and to determine if modifications are necessary. When the crisis has passed, the Crisis Management Team (usually comprised of key leadership position holders within an organization) should convene to assess its performance and to determine ways in which the institution’s response could be improved. For example, did the planned measures appropriately address the situation and help alleviate disruption to operations? Did personnel understand their role in implementing the measures? Is additional training needed?
Process documentation is key to evaluating the response post-incident, including a narrative of events, emergency response actions, communication efforts, receipts for costs, etc. This documentation should be maintained by an appropriate member of senior management (e.g., operations, research, environmental health and safety).
No institution is immune from the potential losses that can result from an unplanned crisis. Research facilities need to take precautions in order to protect staff and their assets, many of which are unique and irreplaceable. Business continuity planning is a process that requires the involvement of various personnel to ensure that all areas of operations are addressed. The process does not end with the development of the plan – the plan must continually be reviewed and tested to ensure its effectiveness and to keep up with the ever-changing laboratory environment.
Betsy is Biosafety / Laboratory Safety Service Leader at EH&E. She has over 25 years experience in the laboratory safety and biosafety fields. For more information, contact Betsy at firstname.lastname@example.org or at 1-800-825-5343.