Hi Ruthie22, welcome to the forum.
The business continuity plan is one of my least favorite SQF requirements, as it feels like it has little direct impact on food safety, is covered by many other requirements, is incredibly subjective, and requires a lot of maintenance.
I'll share my approach with you to hopefully provide some guidance, but let's start with the code:
18.104.22.168 A business continuity plan based on the understanding of known food safety threats to a business shall be prepared by senior management outlining the methods and responsibility the organization will implement to cope with a business crisis that may impact on the ability of the supplier to deliver safe food.
22.214.171.124 The business continuity plan shall include as a minimum:
i. A senior manager responsible for decision making, oversight and initiating actions arising from a crisis management incident;
ii. The nomination and training of a crisis management team;
iii. The controls implemented to ensure a response does not compromise product safety;
iv. The measures to isolate and identify product affected by a response to a crisis;
v. The measures taken to verify the acceptability of food prior to release;
vi. The preparation and maintenance of a current crisis alert contact list;
vii. Sources of legal and expert advice; and
viii. The responsibility for internal communications and communicating with authorities, external organizations and media.
126.96.36.199 The business continuity plan shall be reviewed, tested and verified at least annually.
188.8.131.52 Records of reviews and verification of the business continuity plan shall be maintained
The guidance can be found here: http://www.sqfi.com/...idance-7.2.pdf
on page 18. I won't quote it all here because it's pretty long, but it is very helpful to clarify what your Auditor wants to see and provides great examples.
If you have controlled storage such as refrigeration, your BCP can be much more in-depth to cover those predictable threats to food safety such as loss of power or ammonia pressure. However this details my main issue with the BCP, which is that sudden, unpredictable threats to food safety are addressed in corrective and preventative actions requirements, your recall plan, rework control, and your haccp plan. In this sense, SQF really just wants to see that you've thought through predicable issues that could come up, and have a pre-prepared CAPA plan.
To help clarify what the plan is really about, I renamed by BCP "Crisis management plan" to help clarify what the plan is exactly for and why it exists, this helped me feel like it was less redundant.
What I did with by BCP because my plant has little to no risk from power outages etc. on the production of safe product (or it simply would not operate), is to cover those essential business infrastructure items we need to operate and assign personnel responsible. Throughout my plan, anytime an evaluation of food safety should take place for product or processes, I refer back to my CAPA SOP and Recall Plan, which satisfy the requirements of the BCP, and include requirements to indicate the process like:
"If a process must be changed due to the inability to operate under our existing hazard analysis (e.g. no electricity for equipment, damage to facility), the HACCP team shall be assembled to perform a hazard analysis of the new/temporary process to ensure safe food is produced. Products produced during a crisis before this hazard analysis is completed shall be placed on hold until it can be evaluated under the new hazard analysis."
"In the event that product cannot be produced under the existing hazard analysis,
By performing a hazard analysis under the requirements of our HACCP plan, we've made sure that in the event of a "crisis", we will evaluate the changes and hold them to the same food safety standard as "business as usual".
The assignment of a crisis management team is another redundant one that's either included in your Org chart or job descriptions, but you can clarify the specific SQF requirements for media contact etc. by listing primary contacts and secondary contacts by job description to prevent needless edits when personnel changes.
Outside of these broad strokes, in terms of cranking out your "first draft" of documents like these, I mirror the code to make sure I don't miss a requirement and fine-tune (rewrite) later to make them more useful to my company. This could be an example way to "template" your BCP based on the code:
1. List the crisis manager and backup (or assign one for each type of crisis, e.g. utility failure, criminal acts, natural disaster, fire)
2. List the crisis management team and outline the training you require (which could be simply training on the BCP), I typically say our HACCP team is always part of this team, as well as key executives.
3. Controls implemented (Refer to your CAPA SOP to detail how you will respond in a generic way, and give one or two examples of known crisis and what your first steps would be (power out, ammonia leak, city water has a flush order).
4. Refer to your product hold procedure for isolation of affected products and recall plan for recovery of affected products as needed.
5. Refer to your product release procedure and HACCP plan, and clarify that you will hold products produced during a crisis to the same specification as products produced under normal conditions.
6. Contact list, refer to wherever you maintain this list (HR, Etc.). I choose to include contacts for utilities, law enforcement, etc. as well.
7. Refer to your insurer or wherever you would reach out for legal advice. The Acheson Group is a good example to list (I am not affiliated with TAG nor endorsing their services).
8. Refer to job descriptions or crisis manager/backup for media relations
9. Describe what a BCP test looks like (follow SQF guidance to see what they want here)
10. Describe where records for 9 will be stored.
Hope this helps!