When things go south

It is vital for a business to be able to recover quickly and effectively from a disaster, be it natural or man-made. To do so, it is necessary to be prepared and ready to take measures that ensure the business is up and running as soon as possible.

Figures show that almost half of companies hit by a disaster never recover, despite these numbers, 59% of firms in the UK don’t have a business continuity plan (BCP).

The threats that hover, like Damacles sword, over businesses range from IT systems going down to the destruction of a key site (caused by a fire or floodings, to name a couple), from the loss of staff due to pandemics to the loss of important equipment.

The development of a BCP consists of five stages: analysis, design of the solution, implementation, testing and maintenance. According to Philip Coley, senior strategic risk consultant at Zurich, the first step tends to be the one that creates most problems. “Analasys can be the trickiest – companies often want to get immediately to planning, but you need to understand the organisation and how it operates first. How it is structured, how it is divided up, the number of facilities it has are all important pieces of information, without which you can’t determine what the most critical parts of the business are,” he says.

The analysis is, above all, a risk assessment. It means understanding the activities that are critical to the business, identifying the areas where the company needs more protection and determining the recovery time which operations would need to be restored – usually from 24 hours to a week.

Charlotte Smith, a consultant at business continuity specialist Teed, adds: “Any process that is critical needs to be understood, and contingencies need to be thought through, pre-incident, in order to ensure that the loss can be managed effectively and is not going to impact on customers post-incident.” In the analysis phase, also known as business impact analysis, it is fundamental to maintain the right balance: firms frequently see everything as a priority and ask for plans that go in to too much detail, and ultimately focusing on processes that aren’t critical at all. On the other hand, being too generic can make a business overlook potential problems.

When a business continuitity plan is produced, different levels of management might disagree on what is critical and what is not: strong communication is the best way to overcome such problems and let the company speak with a single voice.

“You want to focus your plan on priorities, which is very hard to do. Some want to plan everything, others too little. For example, imagine a firm has more than one location: the BCP might be good for one facility and not so good for others,” Coley says.

Risks and responses
Compared to other types of businesses, manufacturers often face greater risks, including supply chain disruption, health and safety problems and loss of key equipment, among others. According to Supply Chain Resilience 2010, a survey by Zurich, manufacturing counts adverse weather and product quality issues as the major causes of supply chain disruption, which impacts the sector so heavily.

Andy Osborne, consultancy director at Acumen, explains: “In some ways – assuming we’ve planned and prepared adequately – recovering computer systems and office accommodation is relatively straightforward. Obtaining replacements for bespoke equipment with long lead times can be more problematic and therefore there is often more emphasis on the risk management element of business continuity – on prevention rather than just cure.” Many manufacturers see a conflict between business continuity planning and Just In Time practises, but the two can work together if the right approach is deployed. Smith confirms: “If you rely on Just in Time you need to understand your relationship with suppliers, work with them to ensure they can maintain their agreement with you.

There are contingencies they can put in place, and contingencies you can put in place. They might not conform with a JIT process, but they help in the sense that you know that you have what you need when you need it. You are not going to change your practices, but you can make them work for you.” Overviewing the plan helps to determine whether there is an actual need for a separate area for each threat, or if some of them can easily be put together under the same area, like adverse weather conditions and supply chain disruptions.

Creating a clear, effective plan can save a company hundreds of thousands of pounds, sometimes millions, and can ensure the survival of the business itself – according to the Zurich survey, supply chain disruptions (which 72% of respondents experienced at least once) cost 10% of companies at least €500,000.

The concepts of business continuity planning and disaster recovery are often kept separated, but they actually represent two different aspects of the same process, and consequently two different approaches. Coley explains: “There is a danger in concentrating too much on the recovery in the first 24 hours following a disaster. Yes, business continuity planning is about survival, but it also focuses on long-term recovery. With this in mind, non-priority areas should wait and risks affecting the company as a whole should be tackled.” The response put in place in the first, critical hours following a disaster will determine the future of a business, but prevention can also contribute to its well-being. From this point of view, a business continuity planning exercise can be an occasion to identify the worst risks and start mitigating them.

Osborne adds: “Business continuity management isn’t just about disasters and crises – it includes reviewing operational processes, and improving procedures and practices to increase resilience and reduce errors and downtime.”

Gold, silver and bronze
For a business continuity plan to be efficient, coordination among different levels of management is of vital importance. Like in the public sector, these levels can be referred to as gold, silver and bronze, which translate into strategic, tactical and operations levels.

Most senior – or ‘gold’ – managers decide the overall strategy deployed to respond to a disaster; silver management represents those people who have a responsibility for entire departments or sites; the bronze level, when present, makes for a much more detailed plan. Smaller companies tend not to need the bronze level, as it could overcomplicate the plan.

If looked at from the right perspective, this separation of levels can lead to a very well-designed response, keeping in mind that not all disasters are caused by a piece of equipment breaking down or the loss of a site. Coley adds: “You want to plan for every possible scenario. People think of BCP as related to a merely physical loss, but there are also major public relations incidents, for example like damaging information being published in the local paper. That needs a coordinated response too.” A more pro-active approach from boardrooms would also prevent businesses from being unnecessarily exposed to risks. According to the Business Continuity Institute (BCI), while 75% of executive teams took their organisation through major changes, such as a merger, barely 16% applied business continuity management to understand the implications of these choices before making the decision.

Companies should concentrate on the value add a business continuity plan can bring and the impact it can have on the future of the business. However, like anything related to planning, BCP can turn into a bureaucratic exercise very quickly.

It is important to keep a plan simple – bearing in mind the company as a whole needs to understand it – and then keep it up to date. Coley explains: “They [BCPs] quickly become obsolete, so they need to be practical, useable and easy to maintain. They also need to be concise and relevant, and they have to speak to the right people.” Teed’s Charlotte Smith agrees: “Everybody needs to be able to pick up the plan and understand who should be doing what. It might be a classic phrase, but keeping it simple really does apply here. A plan needs to be useful and effective, people need to understand how to use it.” Testing is fundamental, and it can start as a desktop review before it moves to a large scale assessment. This helps to understand the plan, and underlines the importance of communication within a business. The practical things revealed during a test can be as simple as figuring out who to talk to if a person is on holiday when an incident happens.

Andy Osborne concludes: “Experience shows that, unsurprisingly, businesses affected by a disaster or major disruptive incident who have a plan recover far quicker, more effectively and maintain their reputation far better than those without one. To use an old army adage: ‘Proper Planning and Preparation.