Business Continuity Management PDF Print E-mail


It can’t happen to me!- but what happens if it does?

The need for Business Continuity Planning


When people arrive for work each day, quite naturally they expect to be able to enter their premises and have access to desks, telephones, computers and files.

But what if they can’t get into the building? What happens if there has been an incident overnight or even during the working day, that prevents access to the office?

It may be a fire, an explosion, or something relatively minor like a power cut or a burst pipe. What does everybody do? What happens to the business?


Interruptions to the business may also be complicated by internal interdependencies; the need for specialist plant and equipment; integration with suppliers and customers; issues of strategic quality, corporate governance or regulation, and sensitive customers or markets, intolerant of discontinuity of supply.


Speed of recovery largely depends on being prepared for incidents if and when they occur. What actions are required to facilitate the fastest possible recovery? Will senior personnel know immediately what to do? Will they be able to contact the key staff required? How should the media be handled? How will operations be restored, even on a temporary basis? Will staff know what was required of them?


The most practical solution to these issues is to have a detailed strategy which incorporates pre-incident planning, emergency handling, crisis management, and post loss recovery. This strategy can be applied to both insurable and uninsurable events, and leads to the preparation of a cohesive and understandable plan, generally referred to as the Business Continuity Plan.

 

Where to start?

The project needs to be set up carefully. A policy statement should support the commitment of senior management. Project personnel must be identified, and agreement reached on the scope and level of detail required after examining the tolerance of different aspects of the business to interruption. The advice and assistance of a qualified and experienced business continuity consultant can be invaluable in this process, and also with the ensuing processes leading to the delivery of the plan.

 

Business Impact Analysis

Consideration needs to be given to key business areas and their exposure to hazard. This helps to identify critical operations with the least tolerance to interruption and their interdependencies, plus current preparedness, protections and existing arrangements for recovery. A “ranking” methodology can be adopted to assess the likelihood and potential severity of a range of threats, and at the same time these can be measured in terms most useful to the business, financial, reputational or otherwise.

Plan Preparation

Armed with all of the background information, a business continuity plan can be developed. The use of flowcharts and graphics makes for ease of use and understanding, supported by other reference and checklist material. Ideally, the plan should cover three main sections, from emergency response (the first few hours); crisis management (the first few days); and business recovery (from day one to full recovery). Each of these phases will cater for the roles, responsibilities and tasks of staff involved, and how, when and where actions are carried out.


Exercising & Maintenance

 

Planning is highly effective where systems are carefully tested, but can prove woefully inadequate where they are not.


The approach to testing can vary according to the need. A desktop exercise or a walk-through of the actions may be required, or a modular approach may be preferable, leading to more complex testing. Technical testing is essential for alternate processing via other machinery or IT. Parallel operations, simulation exercises or full-scale rehearsals give more meaningful results, and also provide a platform for staff training.


Keeping plans up to date can also be challenging when business characteristics and needs are changing constantly, and the format of the impact analysis needs to be well thought out to provide scope to carry out maintenance efficiently.


Even if a plan is in place, it can be advisable to utilise independent professional advice to carry out a review, as can be evidenced by the following sobering statistics

from the CBI:


  • 76% of business continuity plans are significantly altered following a professional review

  • 42% of plans would not be effective in the event of a major incident

  • 92% of companies fail to integrate new systems/resources into their plans within six months

  • Only 20% of companies regularly test their plans

  • Companies without tested business continuity plans can lose 9 times their annual revenue

Critical Success Factors

Whilst developing a continuity plan should be considered an integral part of a company’s business strategy, for it to be successful requires its full embodiment into the business culture, and it needs to embrace certain critical factors:


  • The full authority and commitment of senior executives

  • A clear statement of the strategic aim of the business in recovering from a disaster

  • Encouragement of an awareness of the need for planning

  • The plan needs to be owned by the business managers, both in terms of content and strategy

  • A business focus, with particular emphasis on the tolerance of interruption

  • Consideration of both the indirect and direct consequences of each scenario

  • Plans which are action orientated and not merely guidance notes

  • Clear identification of and readily available required resources

  • Plans that are up to date, tested at regular intervals and well documented for ease of understanding

Conclusion

In today’s constantly changing trading environment, and with corporate governance and stakeholder value increasingly to the forefront of the business world, senior managers need to demonstrate that they have adequately dealt with business critical factors.


The ability of a business to recover it’s trading position following a major incident is one of the business critical factors. It is sobering to note that independent research has shown that 80% of organisations suffering a major incident without a pre-determined recovery procedure never recover. A further 16% fail within five years.


The Turnbull Guidance on Internal Controls sets out a framework for best practice in business. The Chairman of the working party, Nigel Turnbull stated “business continuity management will play an important role in helping companies achieve compliance”.


Both economically and in terms of best practice, any business should ensure that they have ready to implement a business continuity plan that is well researched, well communicated, and well tested and maintained.

 

H & H Consulting


Cronk Beg

Ballagawne Road

Colby

Isle of Man

IM9 4AZ

 

Tel: 07624 493844

 

E-mail:  This e-mail address is being protected from spambots. You need JavaScript enabled to view it

 

Web: www.handhconsulting.co.im