Business disruptions can happen anywhere, anytime, in any location. Bad weather, interruptions in the supply chain, systems hacking, disruption to utilities, pandemics, earthquakes, volcanic eruptions or even political events beyond the organisation’s control – all these are major disrupters of business. They cannot be predicted but businesses have to be prepared for them nevertheless, as business has to proceed regardless of conditions in the environment. Business Continuity Management (BCM) is therefore a prerequisite for any organisation, as it helps the organisation respond effectively to such threats and protects the interests of the business.
BCM is a framework for identifying the internal and external operational threats which confront the organisation, as disruption can come from within the firm as well as from outside it. Generally, BCM global best practices include disaster recovery, business recovery, crisis management, incident management, emergency management and contingency planning. It applies across the board to all business functions as a disruption to one part of the organisation often means that other parts will be affected as well. What is of paramount importance is that essential business functions can continue operating, thereby sustaining the value of the organisation.
However, every business has individual requirements peculiar to its organisational set-up and operations, so establishing what these needs are is key to formulating an effective BCM Plan. While BCM plans are imperative to large organisations, even smaller businesses will find that having one in place will help them in the event of a disruption because these plans usually detail the processes and procedures that are necessary to keep operating. At its core, the plan will help the organisation respond faster in the event of a disruption, and minimise negative impacts on the business. How the business is managed at times like these could affect its long-term revenue and reputation.
In putting together a BCM plan, the business needs to identify the areas where it is most vulnerable. Research has shown that some of the most common disruptors are pandemics, natural disasters, utility outages and cyberattacks. A risk assessment and business impact analysis will be necessary to identify areas which may be potential threats to the business. In tandem, essential business functions should be ascertained, and management should decide which should be prioritised in the event of an incident, and how these will be maintained throughout the period of the event. Ideally, a business continuity management team should be established to deal with all matters pertaining to BCM.
Team members will prepare standards, address training needs and identify processes and procedures integral to the organisation’s business continuity. Some good practice guidelines to follow when setting up a BCM system, and subsequently, an effective plan, include the establishment of appropriate organisational policies on the matter. Operating controls and measures to manage the risks should be a priority as well. A monitoring/review system to gauge overall effectiveness should also be in place so that feedback can enable improvements. Crucial to all this is robust risk management, as risk management identifies potential risks, and assesses the impact that these will have on the business, as well as offers mitigation strategies.
In tandem with risk management and assessment will come business impact analysis (BIA). A business impact analysis identifies the organisation’s most critical business activities; the resources needed to support them; how long the business can operate without them; and the impact on the organisation, from their cessation. Developing a BCM system (and plan) is not to be undertaken lightly, particularly in the current environment of globalisation and uncertainty. It requires the collaboration of many parties including external ones, and the cooperation of a range of stakeholders, besides the support of the Board, management and employees. Having “point people” in position to manage the situation in the event of an incident is imperative.
Some organisations may already have people with experience of disasters; their input will be invaluable. Everyone in the organisation has to be clear about who is in charge when the untoward happens. This clarity of roles and responsibilities has to be determined from the outset, which is one of the reasons for involving representatives from as many of the organisation’s departments or business units as possible. Right from the beginning, it should be a business continuity management goal that as many people in the organisation as possible, should be aware of how to manage any situation that may have a negative impact on business operations.
This requires the right level of awareness and training. It also needs updating and reskilling depending on the organisation’s internal dynamics, as staff may move in and out of positions, or even from one subsidiary to another. BCM plans need to be tried and tested to ensure that they will function as intended, at the material time; this can be done using various scenarios. Besides instilling confidence in staff that the organisation will be able to carry on, it also gives a certain level of transparency which boosts stakeholder confidence in management. In an environment that is increasingly competitive and challenging, BCM has become a necessity for businesses, and can no longer be considered a “nice-to-have” component of management.
A firm that keeps running despite disruptions has a better chance of mitigating financial losses, and will be perceived as stable – a crucial element in maintaining shareholder confidence. Customers, too, will want to know that the organisation is capable of appropriate response; they often keep up with certain brands to gauge how these firms are weathering commercial and financial uncertainty. Brands that are prepared will be able to prove their resiliency, and gain a competitive edge if they are able to get business moving quickly again. Knowing what to do is therefore crucial, and that means being prepared with a plan that manages and ensures business continuity.
