The need to address business continuity failings

There’s a say­ing that if you fail to pre­pare, you’d best pre­pare to fail. Many busi­ness­es will have found this to be fright­en­ing­ly true in the wake of the coro­n­avirus pan­dem­ic. 

Large busi­ness­es will gen­er­al­ly have a busi­ness con­ti­nu­ity plan in place that is ready to be imple­ment­ed in case of an emer­gency. Small­er busi­ness­es gen­er­al­ly relied on busi­ness inter­rup­tion insur­ance, although it took a rul­ing by the Supreme Court before many of them were com­pen­sat­ed. 

Hiding in plain sight

Even though infec­tious dis­ease has been high on the government’s Nation­al Risk Reg­is­ter since it was cre­at­ed in 2008, most busi­ness con­ti­nu­ity plans were not devel­oped with a glob­al pan­dem­ic in mind.

“Busi­ness lead­ers have wok­en up to the lev­el of resilience they need to embed into the heart of their com­pa­nies,” says Felic­i­ty March, secu­ri­ty and resilien­cy direc­tor at IBM Ser­vices, Europe. This is why, she says, the cur­rent mar­ket demand for IT secu­ri­ty and resilien­cy ser­vices in the UK and Ire­land is expect­ed to be worth almost £2.7 bil­lion in 2021. 

If an organisation’s busi­ness con­ti­nu­ity plan didn’t fac­tor in the pan­dem­ic, it is in good com­pa­ny. More than half of com­pa­nies (51 per cent) around the world had no plan in place to com­bat a glob­al emer­gency, such as COVID-19, accord­ing to research pub­lished by Mer­cer in March 2020.

More wor­ry­ing is the lack of con­fi­dence where a busi­ness con­ti­nu­ity plan did exist. Around half of busi­ness­es in the UK (46 per cent) were not con­fi­dent their busi­ness con­ti­nu­ity plans were up to date, accord­ing to a 2019 report from Data­bar­racks.

Business protection is changing

Busi­ness con­ti­nu­ity used to be about dis­as­ter recov­ery. That large­ly refers to IT because what is required is a more con­nect­ed approach, says Pro­fes­sor David Deny­er, direc­tor of research in the school of man­age­ment at Cran­field Uni­ver­si­ty. That approach is resilien­cy.

Resilien­cy is required because the pan­dem­ic demon­strat­ed the con­nect­ed nature of soci­eties and tech­nolo­gies. As a result, these prob­lems can­not be man­aged through a risk man­age­ment, busi­ness con­ti­nu­ity or cri­sis man­age­ment approach that only looks at a sin­gle part of the sys­tem. 

“Resilien­cy is so cru­cial because it encom­pass­es more than just busi­ness con­ti­nu­ity crises. It includes inci­dent man­age­ment, dis­as­ter recov­ery, risk man­age­ment and all those oth­er func­tions,” says Deny­er.

The proof is in the risk reg­is­ter, he says, because many busi­ness­es have failed to trans­late that risk aware­ness into pre­pared­ness. “Resilien­cy shifts the think­ing from the recov­ery of an asset to the deliv­ery of essen­tial ser­vice out­comes. We may find in a severe cri­sis that a site can­not be recov­ered, but we can find an alter­na­tive way of deliv­er­ing the essen­tial ser­vice to our end-user,” he adds.

New definitions

Dif­fer­ent busi­ness­es are bet­ter at iden­ti­fy­ing what needs to be done, says Helen Molyneux, direc­tor at con­sul­tan­cy Cam­bridge Risk. A man­u­fac­tur­er may have con­sid­ered many of the prime issues and even built con­tin­gen­cies, such as gen­er­a­tors, where nec­es­sary. These are the obvi­ous process­es and pro­to­cols and dif­fer between com­pa­nies. 

Often over­looked is what the board does not see, areas such as mid­dle and back-office pro­ce­dures, for instance a call cen­tre tak­ing orders or a ful­fil­ment depart­ment.

“I ask the board to take a step back and con­sid­er what they actu­al­ly do as an organ­i­sa­tion,” says Molyneux. “This cov­ers key activ­i­ties such as orders, deliv­er­ies.” 

She then looks at the process­es beyond these func­tions and probes the rep­u­ta­tion­al or finan­cial impact if any of those were lost. “This sets the cor­po­rate con­text so you can bench­mark just which process­es and resources are mis­sion crit­i­cal,” she explains.

Beware the blind spots

Blind spots are a cru­cial avenue to exam­ine, par­tic­u­lar­ly in light of the pan­dem­ic. Many organ­i­sa­tions found they were often igno­rant of vul­ner­a­bil­i­ties with­in their sup­ply chain beyond reg­u­lar con­tacts, says James Crask, head of resilience for the UK and Ire­land at insur­ance bro­ker Marsh.

Last year, one of Crask’s retail clients was wait­ing for a ship­ment of East­er gifts that had failed to arrive. It was only then that the com­pa­ny dis­cov­ered they were whol­ly depen­dent upon a series of man­u­fac­tur­ing sup­pli­ers based in and around Wuhan, the province at the cen­tre of the ini­tial COVID-19 out­break, that had been out­sourced from their main sup­pli­er.

“The com­pa­ny had no vis­i­bil­i­ty until the call came to say the ship­ment would not arrive. This will force organ­i­sa­tions to think much hard­er about their sup­ply chain resilience,” says Crask. 

These over­sights are acci­dents wait­ing to hap­pen, says Richard Gor­don, direc­tor of the dis­as­ter man­age­ment cen­tre at Bournemouth Uni­ver­si­ty, and are in every organ­i­sa­tion. “They can often be avoid­ed by speak­ing to employ­ees who are clos­er to the coal­face,” he says. 

Fail­ures may be due to a deficit in the cul­ture or the report­ing mech­a­nism because even an intern or clean­er might iden­ti­fy a poten­tial risk. “But if they do not know how to report it, or that mech­a­nism is inef­fi­cient, the risk will not be cap­tured,” Gor­don points out.

Busi­ness­es often focus too close­ly on a sin­gle point of fail­ure, yet the pan­dem­ic has demon­strat­ed an emer­gency can have a glob­al impact. “Some organ­i­sa­tions have focused exclu­sive­ly on the resilience of their site, but every­thing that’s around that site is equal­ly impor­tant to their resilience,” he adds.

This is impor­tant because it is where employ­ees live, how they trav­el, where the busi­ness and employ­ees get their food, elec­tric­i­ty, gas and water. “It’s the off-site ele­ment that is often ignored. So when things go wrong, and we spill out into the wider area, we lose con­trol,” says Gor­don. “We’ve lost the abil­i­ty to con­tin­ue to main­tain the trust of our cus­tomers and do not have an under­stand­ing of our staff or their con­di­tions.”

Where to start

Any busi­ness con­ti­nu­ity plan needs to be based on a holis­tic assess­ment of the company’s poten­tial chal­lenges and needs, says IBM’s March. “A cross-func­tion­al team of lead­ers with­in the organ­i­sa­tion cer­tain­ly can and should be involved with the ini­tial plan­ning and rou­tine assess­ments to ensure aware­ness and readi­ness,” she says.

Dr Lee Miles, pro­fes­sor of cri­sis and dis­as­ter man­age­ment at Bournemouth Uni­ver­si­ty, agrees any plan needs to be holis­tic, but that it also needs to be oper­at­ed at all lev­els and, more impor­tant­ly, to be con­tin­u­al­ly updat­ed. 

“You’re only as good as your mon­i­tor­ing,” says Miles. “Plans are guide­lines, skele­ton struc­tures in which to give peo­ple advice about how they should do things. But it’s the peo­ple that fill in the gaps.”

In a cri­sis sce­nario, the plans are no good if they did not pre­dict the sit­u­a­tion the busi­ness faces. This is where “entre­pre­neur­ial ele­ments” among employ­ees fill in the gaps of plans. “That requires the build­ing of trust to allow that dis­cre­tion to be exer­cised, with­in remits, cou­pled with a flow of com­mu­ni­ca­tion,” he says. 

Crask broad­ly agrees: “It comes down to mak­ing sure there is a very strong func­tion with­in the sec­ond line of defence that is hold­ing man­age­ment account­able.”  That sec­ond line of defence sets the poli­cies and process­es, so there is con­sis­ten­cy in plan­ning, he says.

How to continue

How­ev­er it is achieved, the process must be con­tin­u­al, adds Miles, because the busi­ness only under­stands the extent of the poten­tial risks by exer­cis­ing the plan, and most impor­tant­ly, the peo­ple who will be imple­ment­ing it. 

Lead­ers may not be in charge of the resilience project, but they are absolute­ly cru­cial to the suc­cess of the project, says Deny­er at Cran­field Uni­ver­si­ty. “Our research shows that lead­ers who put resilience at the heart of what they do cre­ate an align­ment across all an organisation’s silos. 

“It requires com­mu­ni­ca­tion and co-ordi­na­tion, but essen­tial­ly build­ing com­mit­ment to resilience and dri­ving it through the cul­ture of the organ­i­sa­tion, so peo­ple feel per­son­al­ly respon­si­ble for resilience and deal­ing with prob­lems as they emerge.”

---