Building effective business continuity plans

We are living in unprecedented times. Just ask Google. That’s what millions of people did, resulting in an unprecedented spike in searches for the term ‘business continuity planning’.

Most businesses by this stage can see if they are going to take a hit from COVID-19. And let’s be clear, most businesses will. What’s less clear is what will happen in three or six months’ time, or a year. Many are withdrawing their guidance because they genuinely do not know.

What adds to the unusual nature of the times is that almost everyone in business is suffering to some degree or other, including your competitors, and the government has also provided significant business stimulus support, making this different to other crises.

Fortunately, those organisations who had Business Continuity Plans (BCPs) in place have generally been in a stronger position to respond nimbly under these uncertain circumstances. Plans that identified the most critical parts of the business, which markets and customers to prioritise, alternative supply chains, or what to do if staff can’t come into the workplace.

Unfortunately, some did not. According to the Global Board Risk Survey that Ernst & Young (EY US) conducted with 500 global board members and chief executive officers (CEOs), even before the COVID-19 outbreak, only 21 per cent of board members believed their organisations were very prepared to respond to an adverse risk event from a planning, communications, recovery and resilience standpoint.

COVID-19 has made evident the need for, and importance of, such plans to help make an already difficult situation slightly more manageable and to ensure you’re doing right by your customers, employees and stakeholders when unpleasant situations arise.

My 18 years of experience helping clients to manage their business risk and resilience tells me that there are a few core points to keep in mind when trying to boost your business’s chances of surviving a shock through business continuity planning.

Get the Board onboard

While it is up to the business to decide where the responsibility sits, risk managers are well positioned to develop and implement BCPs. They generally have sufficient links within the business to make it effective.

However, it is the responsibility of those more senior in the organisation – preferably at board level – to state a commitment at the outset and ensure the necessary resources, both in terms of people and capital, are put in place to make the process effective.

Know your business inside and out

At the heart of everything is understanding your business sufficiently well. What are the most critical processes in your business that enable you to do business and what are your alternatives if you can’t complete those processes as normal.

This is where the business impact analysis comes in. It’s a systematic approach to understand what the critical aspects of your business are that are needed to deliver products and services into your market. It’s at the heart of the whole business continuity management process.

Seven key questions to delve into

• Your mission and strategy - what is your organisation trying to achieve?
• Your products, markets, money - what products and services do you deliver?
• Into what markets?
• How much money do each of those products and markets generate?
• Your operations - what processes enable their delivery?
• What could happen to the processes to stop those operations?
• The business impact - what would happen to your business if the processes stopped?

Asking these questions will generally enable you to determine something else critically important: what is the bare minimum you need to do or have in order to survive as a business. The BCP itself must have strategies to help you to achieve that.

Fully-fleshed out strategies

Part of my job involves reviewing BCPs and over 18 years I’ve seen many. Far too often we see that organisations have failed to create a fully formed BCP. There’ll be plenty of great background information but not what you’re going to do if disaster strikes.

Common shortcomings include a lack of continuity strategies and a tendency to plan for a team to meet to formulate a response. But you can’t simply say, “These people will meet and decide what happens next.”

At the heart of every plan should be strategies to maintain the effective delivery of critical products and services. These must include giving people charged with responsibility for crisis management clearly defined actions that could be taken to maintain the business. Crystallise who makes that decision or that call. You don’t want to be left wondering in the moment what decisions you have to make and who is going to make them.

Testing and updating

Once you’ve got a plan, it’s important to see how it will hold up in a crisis. FM Global’s Asia-Pacific operations in Singapore and Australia test their Business Continuity Plans at least once a year, led by our corporate risk management team. The Incident Command Teams (ICT) go through case scenarios facilitated by our corporate risk manager. As they go through this exercise, the ICTs discuss actions that they would take at different stages of the scenarios, guided by the strategies set out in the BCPs.

Beware a false sense of security

While it may seem counterintuitive, there is also a risk that coronavirus breeds complacency. After all, it is a major shock – but it is a highly uncommon situation.

For some businesses, a sudden government mandate on social distancing – or in the case of the airlines Qantas or Virgin Australia, closing of Australia’s domestic and international borders – meant quickly bringing the majority of their operations to a standstill. Others, depending on the industry, may have had weeks to prepare for the worst of the impact, as it spread around the world. Customers dealing with challenges themselves were probably more understanding of the difficulties you were facing. Your competitors were likely to have been affected significantly too and unable to steal a march on your business.

For this reason, extrapolating from the fact that a company deals well with coronavirus to assume a BCP would respond equally well in different situation is inadvisable. An earthquake or sudden machinery breakdown will give you no time to prepare your response. Customers are unlikely to be so forgiving and you can be sure that your competitors will look for any opportunity to gain an advantage.

The times we are living through are indeed unprecedented, but the response must not be. The reaction must always be to understand your business and its critical processes, know what your alternatives are if things fall through, and to plan and delegate your next steps thoroughly ahead of time.

Stuart Selden is manager Business Risk Consulting and chief risk officer, FM Global Australia