If human error, fire, flood, loss of electricity or even a temporary blip in your systems affects your business, how do you continue to produce your product? How do you get supplies? How do you maintain the flow of goods or services to your customers? How do you improve your ability to recover?
Disaster or emergency response planning is tactical; it is the way of responding to a particular event. Disaster response is usually a plan to prepare for, and respond to, incidents such as flood, earthquake and storm, while emergency response planning typically deals with response to a specific incident, such as fire, explosion or toxic spills.
In contrast, business continuity plans (BCPs) or business recovery plans (BRPs) are strategic in their application; in other words, they are plans to keep your facility up and running after it has been damaged in some way. The damage could be something as simple as not having access to your building. The premise of business continuity planning is to prepare for the worst-case scenario: you have suffered damage to your operations.
A five-phase approach to BCP would include planning, prevention and control, preparation, response and restoration.
Developing your plans
The planning phase is the most difficult as well as the most time-consuming. It includes:
This methodology is applied at a corporate level, between interdependent business units, or at the single site level with interdependent functions within the facility. While each of the components of the methodology is important, the setting of appropriate goals and objectives will ultimately decide the success of the recovery strategy.
Coping with incidents
In our experience, companies often complete the BCP but fail to carry it through to the prevention, control and mitigation phases. Flood, earthquake or fire protection may not prevent the incident, but a BCP can keep such an event from becoming a catastrophe that halts your business operations.
How to prepare During the preparation stage, response teams, command centres, mutual aid agreements and other business-related agreements are established. For example, retainers are arranged for salvor who will take damaged goods and find a market for them, and a 'Hot site' found where companies can run computer programs after losing their own computers. Vendors are identified and formal agreements signed. This is also the phase where you would test and audit the BCP to ensure its viability.
Keep in mind that a BCP is a living document. In order for it to be effective, it must be kept up to date. Organisations will often expend significant amounts of money to develop a BCP, then fail to keep it current, making it inadequate. If the plan is not up to date, it probably will not work.
Sounding the alarm When an incident occurs, you enter the response phase. An often overlooked issue is deciding who has the authority to initiate the BCP. Crises do not always occur when key managers are present. There should be a well-defined succession plan. Communication, especially during region-wide events such as earthquakes, floods and hurricanes, is critical at this point. An incident command system (ICS), which is used by public fire services and emergency management agencies, helps allocate resources as necessary and co-ordinates these resources in the most effective manner. Many organisations have adopted the idea of ICS to manage their response activities.
The local communication infrastructure is usually down, and lack of adequate communications can reduce the effectiveness of a planned response. This should have been taken into account at the planning stage, and alternate communication strategies identified. Dependency on local area networks (LANs) and the internet only heighten the need for strategies to keep communications active.
Going forward Restoration is the final stage. Here you examine a host of issues, such as continuing operations, new equipment against re-builds or upgrades; leasing against rebuilding, moving or staying; labour and regulatory requirements.
As time progresses, the human factor has to be addressed. In the initial stages your recovery teams work on adrenalin, but the increased physical and mental demands will soon take a toll. This may result in anything from bad decisions to accidents and depression.
Think forward
The notion that insurance will cover companies for all the consequences of a loss is outdated. The competitive global economy and September 11 have highlighted the need to develop plans to ensure business continuity. Insurance cover only provides a partial solution; it is not a panacea. Remember that the goal of any BCP/BRP is to keep the incident, whatever it is, transparent to your customer.
Stefano Tranquillo manages FM Global's UK operations, E-mail: stefano.tranquillo@fmglobal.com
www.fmglobal.com/
PROTECTING VALUE
In a study of Fortune 1000 chief financial officers (CFOs), treasurers and risk managers across a broad range of industries, more than 50% said their companies were not well prepared to recover from a major disruption to their top earnings driver, and fewer than 25% believed their current contingency planning efforts to be adequate. More than 75% of the nearly 200 respondents indicated that such a disruption would have a sustained impact on their firm's earnings or threaten their business continuity.
The study found significant differences in how CFOs, treasurers and risk managers see the risks threatening their firms, compared with the the views of their superiors. More than one-third of CFOs, treasurers and risk managers believed their company's senior management lacked an understanding of the impact a major disruption would have on their firm's earnings.
There was a clear difference of opinion between risk managers and CFOs and treasurers regarding contingency planning efforts, underscoring the need for better communication between these groups. CFOs and treasurers were less confident in their company's contingency planning efforts and consistently understated the scope of them compared to the risk managers. The results also showed that significant challenges have yet to be addressed, even though contingency planning is now instituted across most of the participants' businesses.
On the insurance front, 50% of respondents from companies with less than US$1bn in sales reported they had fully transferred the overall risk associated with their top earnings driver, including damage, liability and business interruption. In sharp contrast, only 26% of respondents from companies with more than US$1bn in sales (Fortune 1000) cited full risk transfer, while the remainder chose to retain some risk on their balance sheets.
The comments of more than 80% of respondents indicated they considered the terrorist attacks of September 11 largely to be an insurance event, underscoring the need for adequate coverage and thorough disaster-recovery plans.
"It is a mistake to overlook or under appreciate the value of good risk management efforts," said Ruud Bosman, executive vice president of staff operations and planning at FM Global. "The results of this study indicate there are real, ongoing property hazards that affect a company's top earnings drivers. In particular, the impact property-related hazards can have become more important as traditional insurance markets become less willing to indemnify all the associated risks.
The Protecting Value Study was conducted by FM Global, the National Association of Corporate Treasurers and management consulting firm Sherbrooke Partners to better understand the role and value of risk management in major corporations. To download a free summary of the results, visit www.protectingvalue.com
KEY DISCIPLINES
The ten key disciplines of business continuity have been developed by the Business Continuity Institute (BCI) and the Disaster Recovery Institute International (DRII) as standards of professional practice for business continuity professionals. These main areas considered to be key to effective business continuity planning are:
PROJECT INITIATION AND MANAGEMENT
Obtain management support for a business continuity plan by demonstrating the need for a correctly developed and managed business continuity plan. Organise the project team and manage the project to a successful conclusion
RISK EVALUATION AND CONTROL
Conduct a comprehensive environmental risk analysis process. Establish the controls needed to mitigate or prevent any potential loss
BUSINESS IMPACT ANALYSIS Conduct an analysis to identify the effects of disruption and disaster scenarios on the organisation. Identify the key functions and their interdependencies with other operations so that you can prioritise the recovery process
DEVELOPING BUSINESS CONTINUITY STRATEGIES
Determine the choice of business recovery strategy by ensuring that the critical functions can be recovered within the set time whilst maintaining the organisation's best operating performance
EMERGENCY RESPONSE AND OPERATIONS
Develop and implement procedures for response and stabilising the situation following an incident or event, including establishing and managing an emergency operations centre to be used as a command centre during the emergency
DEVELOPING AND IMPLEMENTING BUSINESS CONTINUITY PLANS
Design, develop and implement the business continuity plan to provide recovery within the recovery time objective
AWARENESS AND TRAINING PLANS
Prepare a programme to create corporate awareness and enhance the skills required to develop, implement, maintain and execute the business continuity plan
MAINTAINING AND EXERCISING BUSINESS CONTINUITY PLANS Pre-plan and coordinate plan exercises and evaluate and document plan exercise results. Develop processes to maintain the currency of continuity capabilities and the plan document in accordance with the organisation's strategic direction. Verify that the plan will prove effective by comparison with a suitable standard, and report results in a clear and concise manner
PUBLIC RELATIONS AND CRISIS COORDINATION
Develop, coordinate, evaluate and exercise plans to handle media during crisis situations. Develop, coordinate, evaluate and exercise plans to communicate with and, as appropriate, provide trauma counselling for employees and their families, key customers, critical suppliers, owners/stockholders, and corporate management during crisis. Ensure all stakeholders are kept informed on an as-needed basis
COORDINATION WITH PUBLIC AUTHORITIES
Establish applicable procedures and policies for coordinating response, continuity and restoration activities with local authorities while ensuring compliance with applicable statutes or regulations.
To download these disciplines and for daily updated news on continuity issues, visit www.globalcontinuity.com
