Protecting your hard work
For some, business continuity planning is a bit like writing a will – a good idea in theory, but difficult to sit down and do when other matters are vying for attention or simply because you’re operating in survival mode. Some may be put off by imagined cost. However, as David explains, investing in BCP, doesn’t need to be expensive but could offer significant benefits.
“In financial terms, BCP isn’t costly,” he says, “but businesses do need to commit time to get value out of the process. Many businesses confuse BCP with business interruption insurance, but that can leave vulnerabilities. For one, the risk may be uninsurable – COVID-19 is a good example – but even if insurance covers the initial loss, it doesn’t provide a plan for recovery. If you haven’t got steps in place to retain customer confidence, for example, you risk losing credibility and custom. Having a plan can protect all the work you’ve put into building your business and ensure you don’t slip so far backwards that you can’t recover.”
Firms will be analysing their supply chains for vulnerabilities and if your business can’t satisfy them that you have robust plans in place, they’ll at best look for contingencies or at worst secure a new supplier.David Teed, Business Continuity Consultant.
Meeting customer scrutiny
In the past, BCPs have been a prerequisite for larger firms, driven by stakeholder demand, particularly from investors or shareholders. Smaller firms, unless they’ve been preparing to scale up through growth or acquisition, or they’re a critical part of national infrastructure, have often overlooked their importance. Now, however, there’s a growing expectation that businesses of all sizes have conducted some BCP and it’s a trend David thinks will only increase.
“Competition is intense, and customers are no longer as forgiving,” he explains. “We worked with a logistics firm, for example, who generated 75% of their income from one key customer who they had supplied for decades, so the relationship was strong. The logistics firm suffered a power outage for a day and had no BCP in place. The outcome was that their customer informed them that if they didn’t have a BCP in place within three months, they’d move their business elsewhere. They were fortunate to be given that chance – many customers would just have switched supplier.
“As the pandemic plays out and we move from crisis to recovery, supply chains and the risks inherent in them will be under intense scrutiny. Firms will be analysing their supply chains for vulnerabilities and if your business can’t satisfy them that you have robust plans in place, they’ll at best look for contingencies or at worst secure a new supplier.”
Taking a flexible approach
Whilst the level of uncertainty around COVID-19 may make contingency planning feel impossible and traditional plans may not have covered all eventualities, they are still worthwhile says David.
“The key is flexibility,” he says. “We already knew, for example, that the tried and trusted response of moving to your business continuity site wouldn’t work if there was a security or extreme weather event, and many of us had already been considering pandemic risk on the back of swine flu and H5N1 (bird flu). And, although if we’d tried to plan for a risk on this scale, where we’ve seen borders closing and complete lockdown, no-one would’ve believed us, the principles are the same. Having identified your critical operations and a defined incident management team, you’re already a step ahead and can adapt your response.”
The value of BCP is not just in continuity, but in resilience.Gareth Anderson, Area Director, HSBC.
Planning for recovery
What about those businesses who went into the crisis without a plan or were simply caught out by the scale of events?
“Recovery can be a bigger risk to your business than the crisis itself,” says Gareth Anderson, Area Director, Business Banking, HSBC. “How you trade out of it and emerge from lockdown, and how you rebuild your business, will define its success and sustainability. The value of BCP is not just in continuity, but in resilience.”
Nor is it too late to start planning how your business will respond to changing circumstances in the months and years ahead. “As we move through the phases of recovery, there are numerous scenarios that will create risk and opportunities for your business,” says David. “Considering these in terms of their impact is important – what would jeopardise your essential services, what were you surprised by last time and what went well, how reliant are you on key suppliers or providers, what are your tech dependencies, how can you safeguard staff, what about forecasting customer demand, how are your competitors responding?”
Those businesses that take control of the situation, who have a roadmap of how they will respond as a foundation that can be adapted as required, are those best placed to respond to shifts in their trading environment.David Teed, Business Continuity Consultant
Proactive approach to opportunity
The difficulty with COVID-19 in particular is the number of known unknowns. “Normally, we’d try to change uncertainty into risk, which we can then measure and manage,” says Gareth. “You can’t do that with COVID-19 and that’s why it’s so challenging. The best a business can do is to form a series of scenarios around what they think may happen, what the assumptions are underpinning those and work alongside their trusted partners – perhaps their bank or accountant, to manage that through. The worst thing you can do is to bury your head in the sand. Taking a proactive approach can make all the difference.”
The emergence of a new post-pandemic crisis normal presents an opportunity for businesses to review and adapt, to face the future (whatever it may hold) on the front foot says David. “Those businesses that take control of the situation, who have a roadmap of how they will respond as a foundation that can be adapted as required, are those best placed to respond to shifts in their trading environment.”
What to consider when creating your business continuity plan
- Define responsibilities – who’s part of your incident response team? Their role may be dictated by the type of threat, but understanding expectations and responsibilities is important to ensure you can respond quickly.
- What’s important to you? – what are your critical activities and what matters to your customers/stakeholders? These should be the areas of focus to ensure you can communicate and keep trading.
- What tools do you have in your armoury? – have you a strategy for different scenarios? Have you back up communications, alternative suppliers, product diversification options?
- What different modes of operation can be exercised? – depending on the nature of the risk, your priorities may be to protect your finances, maintain critical services or even shift suppliers.
- How can you communicate this? – creating a plan can help keep track of the different scenarios planned for and provide the go to document for your response to a threat.