“Down Time” inevitably means lost revenues, delays, disruptions and complications in the future. Lost revenues mean reduced profits, and a decrease in the value of the business. A business continuity plan is essential because in today’s frenetic, globalised world, the Butterfly Effect is ever present. Businesses stand to fail if their Business Continuity Management (BCM) strategies and plans are not in place. But what do these entail? Experts generally agree that the key to BCM is readiness, but how ready should the business be? There is no one-size-fits-all solution, when it comes to BCM, but there are some aspects organisations must seriously consider when customising their strategies and analysis plans.
A major aspect is that BCM goes beyond the internal environment. It involves a myriad of external parties as well. At the heart of the BCM strategy process is readiness, and that means the organisation’s stakeholders – staff, customers, suppliers, contractors etc – need to be on board. The data connected with every aspect of the business needs to be up to date, verifiable and reliable. BCM recovery strategies and analysis therefore should start with a business impact analysis, from which a business continuity plan can be drawn up, that incorporates appropriate systems testing, awareness, education and training of staff.
Organisations would do well to create awareness of the need for BCM at all levels so that everyone feels invested in the process. Staff awareness of this need is pivotal to the success of the firm’s plans, and should therefore be a part of strategy. When undertaking business impact analysis, for instance, the input of as many people as possible should be sought. This will give an accurate picture of the level of awareness of the organisation as well as its existing resources, that are pivotal to the development of effective recovery strategies and incident management. Of particular importance is the extent of the firm’s use of technology, such as its ability to switch to online or remote operations.
Information gleaned from business impact analysis can be used to formulate strategy and policy that directly affects the way the firm recovers from incidents or events like pandemics and natural disasters. Most events are unanticipated, regardless of whether they are natural – like earthquakes, landslides or floods – or man-made, like cybersecurity attacks, sabotage or acts of terrorism. But business continuity means the business has to continue delivering its products or services even if business as usual is disrupted. BCM strategy therefore must encompass people, systems, networks, processes, procedures and other methods used by the organisation to achieve this.
In many cases, the organisation makes the decision of how to move forward in the event of an untoward event, based on the information and findings of the business impact analysis. From here, it can draw up its risk analysis and mitigation strategies, including determining what systems and processes will take priority when an event occurs and identifying the appropriate personnel to manage the situation. This will also cover training of personnel, and testing and maintenance of the BCM plan when it is formulated. Organisations almost always operate under tight budget constraints, so priority is usually given to areas which have the highest risk and impact, as indicated by the business impact analysis.
Immediately following an event that causes business disruption, the focus will be on recovering operations to a minimum acceptable level. The business impact analysis will determine what these should be, based on information gleaned that will enable it to set recovery time objectives (RTO). Feedback from staff is critical; being hands-on and on the ground, they are in the best position to know what will work. A major portion of the organisation’s BCM plan hinges on their understanding of their respective roles; their contribution to its structure and formulation will go a long way towards achieving the plan’s goals.
Because BCM ultimately affects all parts of an organisation, the team which implements the BCM plan should, ideally, represent all its functions, and have a thorough awareness of its culture. As the organisation’s understanding of its BCM path develops and is disseminated, the BCM plan can be integrated into all aspects of the business. This may be a lengthy process, and its complexity will depend on the size and requirements of the organisation. The plan should be tested and documented in detail, and feedback incorporated into its improvement where relevant. Effective BCM is not something that can be achieved overnight or on demand; hence the need to start as early as possible – and the importance of continuous improvement.
Firms will realise that BCM effectiveness relies a great deal on analysis, design, implementation and validation from stakeholders, supported by concise communication at the material time. Where necessary, BCM strategic analysis reports should be issued; these will increase understanding and confidence in the firm’s BCM efforts. It is no secret that many firms struggle with BCM but it has become a commercial imperative, given the current business environment. Maintaining a BCM plan, once it is in place, is therefore well worth the effort. Plans should be tested regularly so that awareness of what to do, and who is to do it, is maintained.
It is also a pragmatic measure, as staff mobility may affect the way it is implemented, since employees may be promoted, redeployed or leave. Regular updating of BCM plans is a way of reflecting the changes the organisation undergoes as it faces challenges and how it mitigates these. The business impact analysis may identify critical functions and processes and what resources the organisation needs to get back to “business as usual” but BCM is an entire framework that is intended to safeguard all stakeholder interests, and ensure that the organisation enhances its resilience in a holistic, sustainable manner.
