COOP planning, critical functions identification, backup systems, and recovery procedures. Covers maintaining operations during disruptions.
2
hours
0.2
CEUs
Health, Safety & Code Enforcement
1.7.6
COOP planning, critical functions identification, backup systems, and recovery procedures. Covers maintaining operations during disruptions.
Format
On-Demand Online
Delivery
Self-Paced
Access
24/7 After Enrollment
Certification
Certificate of Completion
Have questions about this course or our platform?
Contact our support teamIdentify critical functions for continuity planning
A building department is unusual among local government offices in one uncomfortable respect: the events most likely to knock the department out of operation are the same events that multiply demand for its services. A hurricane, flood, earthquake, tornado, or wildfire that damages the department's own office, scatters its staff, and cuts power to its permit server simultaneously generates hundreds or thousands of damaged buildings — every one needing a damage assessment, and most needing repair permits and inspections before occupants can safely return. The fire and police response to a disaster is measured in minutes; the building department's response is measured in weeks and months, and it begins at exactly the moment the department is least able to function. That mismatch is why a building department needs a continuity of operations (COOP) plan, not just an evacuation plan: evacuation gets people out safely; continuity gets the department's work restarted.
The foundation of any COOP plan, in the continuity doctrine FEMA has promoted for government agencies at every level, is the identification of essential functions — the activities that cannot pause for more than a short time without endangering the public or halting community recovery. For a building department the essential list is shorter than most staff expect: rapid post-event damage assessment and safety placarding; intake and issuance of emergency and repair permits; inspection of life-safety-critical work such as shoring, utility reconnection, and structural repair; access to permit records and approved plans, without which neither assessment nor permitting can proceed intelligently; and the legal capacity to exercise the building official's authority — to issue permits, order unsafe structures vacated, and stop dangerous work. Everything else is deferrable: routine plan review of new discretionary projects, code-adoption research, records purging, training administration, and most reporting can wait days or weeks without harming anyone. A plan that treats every activity as equally urgent protects nothing, because it prioritizes nothing. The discipline of the essential-functions analysis is saying out loud which services will be deliberately suspended in a crisis so the critical ones survive.
Essential functions are performed by people holding legal authority, so the plan must address who may act when the usual actor cannot. The administrative provisions of the adopted code vest enforcement authority in the building official and generally allow deputies to exercise it. A COOP plan converts that general allowance into an explicit order of succession: a written, ordered list — several names deep, because a regional disaster can remove more than one person at once — identifying who assumes the building official's role and how the assumption is announced. Paired with succession are delegations of authority, which answer a different question: not who is in charge, but what specific powers transfer — issuing permits, posting unsafe placards, ordering emergency work — under what triggering conditions, with what limits, and how the delegation ends when the incumbent returns. Departments that skip this step discover, mid-disaster, that a willing senior inspector has no clear legal footing to sign the emergency permits stacked on the counter.
A tornado strikes a mid-sized jurisdiction while the building official is out of state at a conference. Within hours, the emergency manager is asking the department to placard damaged homes, and property owners are calling about emergency roof repairs. In a department with a current COOP plan, the first-listed successor assumes the building official's duties under a standing delegation and activates the essential-functions list: damage assessment teams deploy, emergency permits are issued under the delegated authority, and routine plan review is formally suspended with a public notice explaining when it will resume. In a department without a plan, the same afternoon is spent trying to reach the building official to ask whether anyone else is allowed to sign anything — while the placarding backlog grows.
The most common failure is having no plan at all, on the theory that the department will improvise; improvisation under disaster conditions consistently produces delay, inconsistent decisions, and legal exposure. The second is an essential-functions list that includes everything the department does — the correction is to force-rank functions by the consequence of interruption. Third is a single-name succession plan, defeated by the first vacation or regional event affecting two people at once. Fourth is treating succession and delegation as interchangeable: naming a successor without documenting which authorities transfer leaves the successor in charge of nothing in particular. Each of these is corrected on paper, in advance, for the price of a few staff meetings — which is the entire point of continuity planning.
Develop backup procedures and systems
Once essential functions are identified, the plan must answer a practical question for each one: how will this function actually be performed if the primary facility, systems, or people are unavailable? The first answer is usually an alternate facility. A building department's needs are modest — counter space for permit intake, work surfaces for plan review, connectivity for the permitting system, and secure storage — which means candidates are plentiful if identified in advance: another jurisdiction-owned building, a public works yard office, a library meeting room, or space offered under a mutual-aid arrangement with a neighboring jurisdiction. The plan should identify at least one alternate location, confirm the arrangement with whoever controls the space, and note what equipment must be transported or pre-positioned. Increasingly, the most resilient "alternate facility" is no facility at all: a department whose permitting software is cloud-hosted and whose staff are equipped and practiced at working remotely can accept applications, review plans, and dispatch inspectors with the main office closed. Remote capability that exists only on paper fails when needed; the capability is real only if staff routinely log in from outside the office and know it works.
No alternate facility helps if the department's records are gone. Vital-records protection deserves particular attention because building department records are unusually consequential. Building Department Administration, ICC's administration text, classifies issued permits and plan review records as permanent records — legal public records documenting the construction history of every building in the jurisdiction, which cannot be recreated from memory. The same text observes that electronic storage has proven a viable official record-keeping method, but with conditions that read as continuity requirements: electronic records need backup in protected storage and periodic review to confirm they remain readable, and retention practices should follow a legislatively approved retention policy developed with legal counsel. For COOP purposes the translation is direct: identify which records are vital to essential functions — active permit files, approved plans, inspection histories, the permit database itself — and ensure each exists in at least one form that would survive the loss of the main office, whether cloud-hosted, backed up off-site, or duplicated. A department whose only copy of its permit records is a row of filing cabinets, or a server in the office closet, has a single point of failure standing between a disaster and the entire recovery permitting effort; departments still holding significant paper archives should treat digitization of active files as a continuity investment, not a convenience.
The third backup system is communications, planned in advance on three distinct channels. First, staff: a current contact roster maintained outside the office systems, a defined method for accounting for personnel after an event, and a way to broadcast reporting instructions when the office is closed. Second, contractors and design professionals: the department's working partners need to know where permit intake has moved, what is temporarily suspended, and how to reach inspectors — a website notice and a message to the permit-holder contact list accomplish most of this if someone is assigned to send them. Third, the public: residents make repair decisions within days of a disaster; if the department does not quickly publicize how to obtain emergency permits and why permits still matter, unpermitted and uninspected repairs fill the vacuum, and the department spends years discovering them. Pre-drafted announcement templates are among the cheapest, highest-value components of the entire plan.
A department's server room is destroyed by an overnight electrical fire — no injuries, but the permitting system and the digitized plan archive are on the lost server. Under a developed backup program, the current off-site backup is restored to replacement hardware or a cloud environment within days, and permit intake continues on paper forms at the counter in the interim, keyed into the system after restoration. Without a backup program, the department faces reconstructing active permit files from whatever applicants happen to retain — a months-long effort during which the legal status of hundreds of projects is uncertain.
The classic backup failure is the untested backup: a nightly job silently failing for months, discovered only at restoration time — the correction is periodic test restores, not backup logs. A second mistake is storing backups in the same building as the originals, converting one loss into two; off-site or cloud storage is the fix. Third is an alternate-facility designation made unilaterally, so the space turns out to be claimed by another agency in the same emergency; coordinate designations with the jurisdiction's emergency management function. Fourth is the stale contact roster; refresh it on a schedule and store it where staff can reach it with office systems down. Finally, departments frequently plan communications to staff but not to contractors and the public, then wonder why unpermitted repair work proliferated after the event.
Test and update continuity plans
A continuity plan that sits in a binder is a hypothesis, not a capability. FEMA's continuity doctrine treats testing, training, and exercising as a permanent program element rather than a one-time validation, and the logic applies fully to a building department. Training means every employee knows the plan, their role in it, and where to find it when office systems are down — including named successors, who should be trained on the authorities they may have to exercise. Testing means verifying the technical pieces individually: restore a records backup and confirm it is readable; have staff log into the permitting system from outside the office; call the phone tree and time how long accountability takes. Exercising means rehearsing the plan as a whole, typically as a tabletop: present a scenario and walk the staff through the decisions hour by hour. Every exercise produces findings — a stale contact list, an alternate site no longer available, no one sure who notifies contractors — and findings only matter if they flow into plan revisions. The plan should also be reviewed on a recurring schedule and after every real activation, succession-affecting staffing change, system migration, or office relocation, because a plan describing an org chart and a software system that no longer exist is worse than no plan: it produces false confidence.
Two further doctrine concepts complete the plan. Devolution addresses the worst case: an event that removes not just the facility but the department's leadership and workforce — the scenario succession alone cannot solve. A devolution arrangement pre-designates who outside the normal chain would carry out essential functions: commonly a neighboring jurisdiction's building department under a mutual-aid agreement, a state program where one exists, or contract plan review and inspection services on pre-negotiated terms. The essence is that the arrangement, authorities, and records access are worked out before the event, because a devastated department cannot negotiate agreements from inside the disaster. Reconstitution is the opposite bookend: the planned return to normal operations — assessing whether the original office is safe to reoccupy, migrating operations back without losing the permit activity conducted in the interim, working down the deferred backlog in a deliberate order, formally ending delegations and emergency procedures, and capturing lessons learned while memories are fresh. Departments consistently underplan reconstitution; the disruption ends not when the emergency does, but when the deferred work is caught up and the interim records are complete and properly filed.
A slow-moving storm floods a department's ground-floor office with two feet of water — and the same storm damages several thousand homes in the jurisdiction. The department activates its plan: staff account for one another through the phone tree, permit intake and damage-assessment coordination shift to the pre-arranged alternate site at the public works facility, and the cloud-hosted permit system continues operating untouched. Emergency repair permits are issued the day after the water recedes, and inspectors work the damage-assessment grid while routine inspections are formally deferred under the plan's priority list. Because the department had exercised the plan the previous year, staff had already discovered — and fixed — the fact that the intake forms existed only on the office server. Reconstitution takes another six weeks: drying and reoccupying the office, merging the alternate-site permit intake into the main records, and scheduling the deferred inspections, with an after-action review feeding the next plan revision. The storm was a disaster for the community; for the department, it was an activation, not a collapse.
The dominant mistake is writing the plan and never exercising it; the first activation then becomes the first test, at the worst possible time — even one tabletop a year surfaces most fatal defects. Second is exercising but not revising: assign each finding an owner and a completion date, and open the next exercise by checking whether the last exercise's fixes were made. Third is the plan that quietly rots — named successors retired, phone numbers dead, software changed; recurring calendar review plus event-triggered review is the correction. Fourth is ignoring devolution because it is unpleasant to contemplate; a mutual-aid conversation with a neighboring department fixes it, and most are glad to reciprocate. Fifth is treating the return to the office as the end of the event; reconstitution needs the same planning attention as activation, or the interim records and deferred backlog become a permanent mess.
Because the disasters that disrupt a building department are the same events that multiply demand for damage assessment, emergency permits, and inspections, continuity planning is a core public-safety responsibility rather than an administrative luxury. Participants learned to identify essential functions and deliberately defer the rest; to document orders of succession and delegations of authority so the building official's powers can be lawfully exercised through a disruption; to develop backup capacity through alternate facilities, remote operations, protected vital records, and pre-planned communications with staff, contractors, and the public; and to keep the plan real through testing, training, and exercises, with devolution and reconstitution completing the lifecycle. A department that has done this work meets a disaster as an activation rather than a collapse — and its community recovers faster because of it.