The Penniless Business Continuity Plan

“MONEY COMES AND GOES BUT HEALTH IS IRREPLACEABLE. SHUT DOWN…”; “PLEASE SHUT AND SANITIZE THE BUILDING, SAFETY FIRST…”; “IT’S DIFFICULT TO CLOSE A BUSINESS FOR 3 TO 4 DAYS BUT IT IS MORE DIFFICULT TO CLOSE A CASKET OF A LOVED ONE FOR AN ENTIRE LIFE.”

As a risk specialist, reading these placard statements from staff of a multinational company, such as Amazon, sent shivers down my spine. Even though I was blue, I wasn’t the least surprised. I recalled my mother’s statement, “If you do not learn the easy way, you will sure learn it the hard way.”

Every organisation, no matter the size, is exposed to a number of threats. Natural disasters, environmental accidents, cyber-attacks, human errors, pandemics and man-made crises are possible disasters that can impact the survival of businesses. The shock which they bring may sometimes be the occasion for the business to meet its maker in heaven.

According to UK Chartered Management Institute, only 52% out of 1,012 senior executives claimed to have plans in place to cope with business disruptions. Mercer’s Business Response to the COVID-19 outbreak survey from over 300 businesses across 37 countries revealed that 51% of businesses do not have a business continuity plan in place.

The International Organization for Standardization (ISO) defines business continuity, in their ISO 22301 Standard, as the “capability of the organisation to continue delivery of products or services at acceptable predefined levels following disruptive incident.” To elaborate further, Business Continuity Plan (BCP) is the “documented procedures that guide organisations to respond, recover, resume and restore to a pre-defined level of operations following disruption.”

Businesses that fail to adopt an active and updated BCP will be fetching water in a basket with the expectation of having it filled. This can be the main difference between organisations that survive accidents, pandemics, disasters or cyber-attacks and those that wind up. Business storms are inevitable but weathering though successfully depends on the availability and maintenance of a BCP strategy.

A BCP strategy should be aligned with the mission, objectives and business strategy of the organisation. This includes detailing the key activities and functions such as products and services and internal and external stakeholders. Admittedly, developing a BCP strategy is a tough row to hoe but organisations that take the pains to go through the process will end up smiling at the storm.

A complete Business Continuity Process includes: Business Impact Analysis, Recovery Strategy, Plan Development and Testing.

The Business Impact Analysis (BIA) permits the organisation to ascertain the effects and consequences of disruptions to a business. The BIA is an important aspect of the entire business continuity process, forming the basis for decision-making in subsequent processes. This process involves identification and classification of all the organisation’s activities and functions based on their criticality. The key resources required for business resumption will be identified, planned and budgeted following the ranking and priority of activities. All Internal and external dependencies needed for business to resume are also documented.

The Recovery Strategy Process is the plan and use of alternative methods by businesses to restore business operations to a minimum acceptable level in the event of an incident or disaster. The decision on the choice of activity or function to restore will be derived from the BIA that was conducted. Ideally, priority will be given to critical activities and functions. This will require human capital and other resources such as equipment and technological support. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps.

The steps and framework required to get the business operating after the occurrence of a disaster should be clearly spelt out in the Plan Development stage of the business continuity process. A recovery team (including appropriate backup in case of their unavailability) comprising of competent people should be formed to respond to the incident.

The last process is Testing and Exercise. This involves examining the reliability of the organisation’s Business Continuity Plan and Policy. Testing and Exercise allows the organisation to identify possible gaps for closure. This improves their preparedness in the event of a disaster or incident.

A BCP that is not communicated to all relevant parties is a wasted effort. ISO 22301, clause 7.4 clearly indicates that, “The organisation shall determine the need for internal and external communications relevant to the Business Continuity Management including: what to communicate; when to communicate and with whom to communicate.” Organisations must establish the objectives of communication and identify all the stakeholders and interested parties. Communication should be well planned, implemented and evaluated.

In carrying out the communication plan, organisations must take note to always relay the right message at the right time addressed by a spokesperson. The 5 W’s – who, when, what, where and why- should be a main guide in the communication strategy.

The reason why 51% of organisations fail to have a business continuity plan in place is a fundamental issue that needs to be addressed. In an online survey conducted by the Continuity Central to business continuity professionals, 22.75 % of the respondents indicated that lack of budget is a key challenge to implementing BCP. 13.6% of the respondents indicated lack of organizational commitment, buy-in and support from top management is also another major hindrance. 11.4% stated lack of resources including human resources as a key issue.

Having a good BCP Strategy is not enough. Budget, resources and management support are the key ingredients needed for a complete and successful BCP. Most organisations operate with the mindset that the gap between disaster and their businesses is like that between heaven and hell. Well, guess whose businesses are in hell now that COVID-19 pounced on us.

Revenue generation, and not potential risk, is the main and only concern of management in such organisations. Investments are made on activities that bring in income. Investing in a huge BCP project that will not bring immediate income is not a priority. A senior manager was noted to have said that getting a standby production machine was a waste of resources which could have been used to purchase raw materials. He, however, saw the importance when an incident occurred but the business continued without disruption. That was a lot of cost savings for the business.

Implementing BCP is expensive but failing to plan is much more expensive. The cost of having a plan in place can never be compared with the loss the organisation would incur; the cost of restoring business operations without a plan.

Organisations that never planned for a disaster or pandemic such as COVID-19 are now faced with greater cost as compared with those that had a well-planned BCP. The latter do not have to incur extra costs in purchasing items such as laptops for staff to work from home. They are not having issues with social distancing in the workplace as the BCP Alternate Site is available for use by staff.

On the contrary, organisations without planned BCP had to incur a huge cost, for example, purchasing hundreds of laptops at a time for staff to work from home and mostly at a higher price due to the urgency. Some have folded up or had to stop operating.

Organisations experience a penniless BCP when they include Business Continuity Management as part of their business operations; processes and procedures. It is included in the annual plan and budget just like any other expense (e.g. rent). This way, the cost is amoritised over the years and will not impact the bottom line of the company.

Incidents or disasters will be normal “business as usual” for organisations with a complete BCP. This is because potential weaknesses and gaps would have been identified and dealt with during the business continuity process. The organisation is aware of its business activities and how to handle disasters so it is never taken by surprise. This results in a more robust organisation, increasing investor confidence, and maintaining productivity regardless of difficulty. This preparedness also demonstrates to staff that their interest and well-being are of great importance which will increase customer satisfaction and improve brand reputation.