No weak links

In a channel-focused, outsourced business environment, identifying and mitigating risk is a complex problem. Developing an effective business continuity plan requires business leaders to work to ensure the survival of their entire supply chain in order to guarantee survival.

The threat of disruption to the global economy has never been greater. Terrorism, major climatic events, economic change, and political instability in emerging markets all pose threats to the continued prosperity of businesses.

However, a recent survey by the Chartered Management Institute conducted with senior managers across the UK, illustrates a widespread lack of preparedness for a major disaster. Only 49% of those surveyed had a business continuity plan, with many companies focusing their risk analysis on IT and facilities, at the expense of other critical assets, such as staff and the wider supply chain(1).

The global supply-chain driven economy makes the chances of an event on the other side of the world indirectly affecting your business high. With outsourced data centres, products transported around the world and companies with offices based in every continent, the risks to a business have increased many times in recent years, and are not simply confined to in-house problems.

Throughout Europe there are many small and medium sized businesses (SMEs). For example, in the UK alone, there are four million SMEs. Many are invaluable suppliers to large multinationals. An event that has a direct impact on their ability to continue business as usual has an indirect negative impact on the companies they supply.

The impact of the US hurricane Katrina is a good example of what can go wrong. Two hundred thousand small businesses across the Gulf coast were destroyed or closed in the aftermath. In the New Orleans region alone, 71,000 businesses were affected. According to the 2002 census, nearly 90% of New Orleans residents were employed by these organisations (around one million workers). This workforce was scattered across the country, with over 400,000 residents evacuating New Orleans and never returning. This not only had a devastating effect on the local economy, but also on many large American companies who were relying on the small businesses operating out of the area. The impact on the Mississippi and Louisiana economies alone was estimated to be in the region of $150bn and was predicted to wipe $14trn off national GDP(2).

This example spells out the importance of having secure and tested business continuity plans across the entire supply chain. Although there was enough warning for large companies to switch their critical IT processes to remote sites, the path back to New Orleans and business as usual remains blocked - not because of federal failures, but because essential support services supplied by SMEs are no longer available. As with disasters such as 9/11 and the 1996 Manchester bombing, few SMEs had plans for responding to a disaster.

In the case of Katrina, business leaders were aware of the risks posed by hurricanes, but very few had explored the long-term consequences of a worst-case scenario for their customers, supply chain and labour pool.

<B>The next pandemic?</B>

The recent outbreak of avian flu in the UK has again focused the minds of UK business leaders on continuity planning. While the outbreak was effectively contained and damage to the wider economy limited, for the businesses and local economy directly involved it has had a real and lasting negative impact. In the same way, while the national impact of Katrina, according to economists, has been limited, the impact on businesses directly involved has been catastrophic(3).

Despite these very public illustrations, very few large companies include suppliers and partners in their contingency planning. Instead of sighing with relief, business leaders unaffected by damaging events need to consider these questions: what would have happened if the H5N1 outbreak had not been contained? What if the virus had mutated and spread to humans? Could their businesses, and those in their direct supply chain survive intact?

The UK government, working with the World Health Organisation, found that only 16% of managers believe their organisation's plans are sufficiently robust, while 43% of managers said they had no plans in place to deal with a flu pandemic(1).

If the UK and other European economies are to survive catastrophic events, they need to think the unthinkable and prepare their businesses and those that they rely on for worst-case scenarios. A business continuity plan can reduce losses by 90%. The impetus has to be on undertaking the right sort of planning and just as importantly - testing.

But what is the right sort of planning? According to the Business Continuity Institute, effective business continuity management is built on seven Ps:

Programme actively managing the process

People roles and responsibilities, awareness and education

Processes all organisation processes including information and communication technology

Premises building and facilities

Providers supply chain, including outsourcing

Profile brand, image and reputation

Performance benchmarking, evaluation and audit(4).

The exposure to risk from the supply chain is obvious. For contingency plans to be realistic, they must include all the parties required for the operation to be business as usual. The problem is that most small and mid-size businesses are short of the time, expertise, money or resources required to develop expansive contingency plans. They are thus the most vulnerable to external events.

In light of the essential role that supply chain partners play in supplying multinationals, it is imperative that global companies actively involve them in developing broad-based contingency plans, and more importantly, engage them directly in exercises and tests that reveal key weaknesses and points of failure.

Of companies that do demand clear business contingency plans from outsource partners or suppliers, 62% only require a statement from a supplier that a policy exists and only 37% take the more active step of examining the supplier's business continuity plan. Only 17% involve them in their own business continuity plan rehearsals while 15% involve their suppliers in developing a plan that covers the entire supply chain. A mere 12% use a third party audit such as an independent simulation partner - an essential part of validating a plan(5).

An example of this is a recent simulation with a multinational drug company, where a disaster was created, modelling the critical factors that combine to influence the pharmaceutical market - including market conditions, political dynamics, NGOs' attitudes, regulatory factors, reactions of competitors, adversaries, public, customers, partners and the supply chain. As part of the simulation, details of the scenario were revealed to test the resilience of decisions that had already been made and force senior management to respond to changing (and unknown) events. This model is proven to explore contingency strategies in a live interactive environment and ensures that, rather than creating plans for fixed scenarios, participants are given the opportunity to develop the skills required to respond to an unanticipated real-life crisis.

<B>Case study</B>

Company Y is a medium sized, regional, graphic design company based in Manchester, UK, with 50 employees. In March 2004 it was preparing for a product launch, supported by live AV links across the world, for a key technology client. One of its managers unknowingly contracted tuberculosis (TB) and came into work feeling unwell. After being diagnosed by his doctor, the manager was advised to immediately inform anyone with whom he had been in contact over the past three days. He was told that his team must be tested straight away as he had been working with them in very close proximity. After taking medical advice, the managing director was forced to quarantine and send home key team members. The company assumed that staff would be able to tele-work, but rapidly discovered that key systems were not accessible from remote sites. The client reacted negatively to the rising uncertainty and loss of continuity. The launch was disrupted by a last minute change of supplier, resulting in huge costs to the client and a catastrophic loss of reputation for company Y(6).

<B>Collaborative planning</B>

It is imperative that companies invest in collaborative business continuity planning to identify and plan for crises before they actually occur. This will ensure that the workflows, coping skills and communication strategies that enable all parties to continue operations, even when many might think that all was lost, will be successfully developed.

<B>About Simulstrat</B>

Simulstrat runs simulations based on war-gaming methodology to test and validate the assumptions behind key business strategies. It models problems, explores solutions and helps develop strategies, resilience and training. It is built on academic expertise in the methodology of war-gaming developed over 30 years within the Kings College London War Studies Group by Professor Michael Clarke, Professor Sir Lawrence Freedman and Keith Britto.

The founding academics have developed a wide range of simulation techniques. They simulate future factors (political, economic or technological) that will impact a business and its operating environment.

A simulation forces participants to make decisions and respond to the external environment (represented by experts) in a war-game, to test the robustness of their assumptions and see the consequences of their decisions.

<B>References</B>

1) Business Continuity - Frameworks for Support at Local and National Levels - Article by Bruce Mann, Head of the CCS, published by Continuity Forum

2) <a style="TEXT-DECORATION: none"href="http://www.drj.com/special/2005Hurricanes/index.html" target="_blank">www.drj.com/special/2005Hurricanes/index.html</a>

3) CIA World Factbook 2006

4) <a style="TEXT-DECORATION: none"href="http://www.preparingforemergencies.gov.uk/voluntary/voluntary_bc.shtm - Business Continuity Institute" target="_blank">www.preparingforemergencies.gov.uk/voluntary/voluntary_bc.shtm - Business Continuity Institute</a>

5) Chartered Management Institute Business Continuity Survey 2006 Report, p11

6) <a style="TEXT-DECORATION: none"href="http://www.axa4business.co.uk/resources/files/BizContinuityGuideT1404.pdf" target="_blank">www.axa4business.co.uk/resources/files/BizContinuityGuideT1404.pdf</a>