|
In an article aimed at those just starting to explore the subject of business continuity, Mel Gosling explains why it is worth the effort and the expense.
All organisations, be they a small corner shop, a large company, a government department, or a charity, are continually faced with decisions about how their resources should be deployed, and quite rightly ask the question “Why should we invest in business continuity?” Unless that question can be satisfactorily answered, it should not come as any great surprise to find that business continuity is not considered to be important.
The simple answer to that question is that business continuity helps to protect an organisation, and in particular its future, and because this has to be one of the priorities for those that run any organisation, then business continuity should be seen as important.
There are though, many other ways in which an organisation can be protected. What makes it so important, and why should an organisation devote scarce resources to business continuity?
Unavoidable risks
No matter how good an organisation’s risk management is, or how much it spends on risk reduction, there is a high probability that its operations will be seriously disrupted at some time by an event that is outside of its control.
In 2005, the Chartered Management Institute obtained information about incidents that caused disruption via a postal questionnaire sent to a random sample of individual Institute members. The results, in terms of the percentage of the sample that had experienced various types of disruption in the preceding year, were:
* Loss of IT 41 percent
* Loss of people 28 percent
* Loss of telecomms 25 percent
* Loss of skills 20 percent
* Flood/High winds 18 percent
* Employee health and safety incident 19 percent
* Negative publicity/coverage 17 percent
* Loss of access to site 11 percent
* Damage to image, reputation, brand 11 percent
* Supply chain disruption 10 percent
* Environmental liability incident 7 percent
* Customer health/product safety issue/incident 6 percent
* Pressure group protest 6 percent
* Fire 5 percent
* Military action 4 percent
* Terrorist damage 2 percent.
My own company’s (Merrycon)own research, conducted informally through clients, indicates that an organisation can expect to suffer serious disruption to its operations from such incidents at least once every five years.
To put it simply, it is very likely that an organisation will, at some point, suffer disruption from an event that is outside of its control. Having an effective business continuity management process in place will lessen the effect of such an event, and should enable the organisation to provide continuity of its operations and critical functions.
Survival
Over 250 businesses failed as a direct result of the Manchester bomb in 1996.
It is not always possible to buy in the resources needed to carry on after an incident has occurred, and insurance doesn’t always cover everything required. How many organisations would be able to react quickly and effectively after such an event to:
* Obtain new premises
* Decide which of its functions are critical
* Know what resources are required by the critical functions
* Decide which staff were required, and when
* Obtain new equipment or stock
* Replace and recover computer systems
* Ensure that it could still be contacted by its customers?
Every organisation will, at some time, experience an event that causes disruption that is outside of its control, and without a plan the organisation is unlikely to be able cope effectively.
A key element of the business continuity process is business continuity planning, which is the process of preparing a contingency plan for situations which might occur. Prudent management recognises that such planning can mean the difference between survival and failure.
Financial
Decisions made in the first few hours of an event that causes serious disruption to an organisation’s operations are critical, and actions undertaken in the first few days will have a significant financial impact. In other words, if you get it wrong, it’s going to cost a lot of money.
Business continuity not only aims to provide continuity in customer service at a minimum acceptable level, it also aims to limit the impact on the financial position of an organisation by ensuring that its critical functions continue to operate during a crisis and that the remainder are recovered in a controlled manner.
An organisation that has an effective and well-tested business continuity plan is more likely to take the right decisions in the first few hours and to subsequently undertake the best actions to limit the impact on its financial position. It has a better chance of incurring significantly less additional expenditure at the time of a disruption.
In short, a failure to develop and deploy an effective and well-tested business continuity plan means taking an unnecessary risk with an organisation’s future and profitability.
Insurance
Most organisations will have some kind of Business Interruption insurance, and rely on this insurance to cover the costs of any interruption to their operations caused by an event that is outside of its control.
However, with increasing premiums, many organisations are failing to ensure that they have adequate Business Interruption cover (typically, this cover is taken out for 12 months interruption, whereas a period of three years would be more realistic). In addition, Business Interruption insurance will not cover losses such:
* New products and services being delayed or aborted
* Loss of business opportunities
* Loss of reputation
* The lifetime cost of losing customers
* Erosion of brand value.
Business Interruption insurance therefore, will provide some protection in terms of a limited financial cushion, but will not, on its own, enable the organisation to survive in the longer term.
Insurance companies themselves are now starting to realise the opportunities that business continuity provides for loss reduction, and it is becoming increasingly common for a condition of insurance cover to be the existence of a business continuity plan. Even if an insurer does not insist on such a condition, organisations are now finding that they can obtain better terms from insurers if they have a business continuity plan.
Competitive advantage
The organisation that has a tried and tested business continuity plan is able to tell its customers that it can provide continuity of supply in the event of an incident that causes serious disruption to their operations.
This is a significant competitive advantage, and demonstrates that the implementation of a business continuity management process is not just an additional overhead. It can make the organisation much more attractive as a potential supplier, and therefore adds value.
Increasingly, the existence of a business continuity plan is becoming a condition of supply as large companies and public bodies implement their own business continuity management processes and start looking at the vulnerability of their supply chain. Many organisations are finding that their customers are contacting them to ask about their business continuity arrangements, and that a failure to demonstrate that effective processes have been established is leading to contracts not being renewed.
Continuity of supply is vital to every organisation, and there is a growing realisation that it is just not worth doing business with organisations that do not take the issue seriously.
Customers
One of the most critical and costly aspects of running any kind of organisation that operates in a competitive market environment is obtaining and retaining customers.
Customers can be surprisingly loyal, but what would happen to such an organisation if it suffered a serious disruption? Would its customers stay loyal, and for how long would they tolerate the disruption, or would they simply go elsewhere? And if they did go elsewhere, would the organisation ever get them back again?
If there is one overriding reason why an organisation that operates in a competitive market environment should have a business continuity plan it is to ensure continuity of supply to its customers. Once lost, it is both difficult and expensive to regain a customer, particularly if that customer was once loyal and had been forced to go elsewhere.
Understanding
One of the benefits that implementing business continuity management brings to an organisation, which is not immediately apparent, is an understanding of what the organisation does and what is important to it (this comes directly out of a business impact analysis, one of the key business continuity plan development tools).
Obtaining this knowledge enables an organisation to examine the utility of what it does, and can lead directly to a better allocation of resources to focus the organisation on its mission, aims, and objectives, rather than the non-critical peripheral functions that can often take on a life of their own. The organisation is able to find out what is critical and of value, and what can be outsourced or left undone.
The business continuity management process also provides an understanding of the organisation’s supply chain, and where this fits into the critical and non-critical functions that are being undertaken. This enables the organisation to ensure that it has continuity of supply to its critical functions, and provides the background to enable a review of its suppliers to be undertaken.
Governance
The implementation of business continuity is now seen as an integral part of corporate governance, and any organisation that failed to take the issue seriously would struggle to convince its investors, customers, auditors, staff, and other stakeholders of its commitment to good governance.
Quite simply, it makes good business sense as well as displaying corporate responsibility to the wider community by continuing to provide support to other organisations and individuals in the event of a serious incident, enabling a return to normality sooner rather than later.
Requirement
Many organisations now find that they have a legal or regulatory obligation to maintain an effective business continuity plan. This started with internal controls such as Turnbull and SORP, to which many organisations are expected to conform, and more recently the Civil Contingencies Bill 2004.
A good example of a regulatory obligation to maintain an effective business continuity plan can be seen for UK insurance brokers, where the Financial Services Authority (FSA) states that: “A firm should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness.”
Size
Contrary to popular belief among SMEs (small to medium sized enterprises), their smaller size does not make them immune from the need to have a business continuity plan. They are, in fact, more likely to suffer failure following an event that causes serious disruption than a large organisation.
Actually, it doesn’t matter whether an organisation is a large ‘corporate’ or an SME, the ability to respond swiftly and effectively to a major incident has never been more important.
As Eliza Manningham-Buller, Director General of MI5, said: “I am often asked what single piece of advice I can recommend that would be most helpful to the business community. My answer is a simple, but effective, business continuity plan that is regularly reviewed and tested”.
Mel Gosling is a Member of the Business Continuity Institute, and managing director of Merrycon Ltd, which specialises in providing business continuity products and services. He can be contacted by email at melgosling@merrycon.co.uk
•Date: 21st July 2006 • Region: UK/World • Type: Article •Topic: Selling to the board
Rate this article or make a comment - click here |
