Converting the cynical

I have to own up to a sense of discomfort with the ever increasing responsibilities of managers today. They are plagued by endless consultants and pushed and prodded this way and that to develop every ounce of their managerial frame and improve corporate performance. It's just not fair!

When I first came across the subject of business continuity management (BCM), I felt a flood of unease rising up inside. It seemed to be just another scheme to divert management away from the real task of running the business.

But my thoughts didn't matter, as the corporate scandals of North America led to the Sarbanes-Oxley Act, while in the UK we had the Turnbull report. Both seemed to be ushering in a new era of corporate governance, where board directors were actually expected to know and understand the businesses they managed.

It seems that directors can no longer plead ignorance in the face of corporate difficulties and events of which they should have been aware. Directors must take steps to ferret out issues of concern and take action, where necessary, to limit the areas of unacceptable risk and exposure.

So when it comes to the long list of major events and material matters that directors have to consider, disaster has to be right up there. Particularly when we are told that, through an effective programme of BCM, most disasters can be handled more effectively. It is something that management just has to get to grips with.

Hence the recent surge in popularity of BCM in the workplace, which of course was reinforced during the tragic events of New York 9/11, when all spare office space was rapidly rented out and businesses caught in the disaster ended up moving many miles outside the city. Not to mention the devastation in New Orleans after Hurricane Katrina and the dreadful lack of preparedness of the authorities. And although in the UK we have lived with the threat of violence for many decades, the recent peaceful lull was shattered quite horrendously in July 2005 with the London bombings. It seems that nowadays everyone is expected to be prepared, and being prepared means BCM!

But what is BCM?

The recently released BS25999 has provided us with a definition of BCM as follows: ‘A holistic management process that identifies potential threats to an organisation and the impacts to business operations that those threats, if realised, might cause, and which provides a framework for building organisational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.’

Not too bad if you read it slowly, but to put it slightly differently, it is a process that looks at your business in the round, what it does and how it does it. It draws out your critical assets, processes and resources, and finds out what could threaten them. Often something as simple as a fire will do.

The BCM process then develops strategies to protect those critical assets, resources and processes, so that should the worst happen, your business will have the best chance of fighting back and surviving.

These strategies, of course, are all fed into written continuity plans, which is the piece of the process that most people would recognise as BCM. If you are lucky you may even experience a BCM test!

The reason for all of this preparation is that, despite the admirable efforts of management and staff, many businesses do not return to normal after a crisis. In fact, according to the London Chamber of Commerce and Industry in 2003, ‘43% of companies experiencing disaster never recover’.

Amazingly, in spite of all the expectation that we should prepare for disaster and the huge chance of failure if we do not, we can still be nonchalant about the risks we face. The possibility of disaster seems so remote it hardly seems worth spending scarce management time on.

As one who shared this cynicism a few years ago I took a more detailed look. My job involved BCM and I needed to learn more. So the first thing I turned to was likelihood, which seemed to be the first argument used when business managers questioned the need to worry about BCM.

I have discovered that an 'incident' is not as remote as you might first think, even in the UK which is not known for experiencing natural catastrophes. For example, in recent months the Environment Agency has posted three flood warnings and 33 flood watch notices. That is disaster striking, or getting pretty close to striking, in 36 places around the UK.

Then don't forget tornados! With 33 tornados a year ripping around Britain's small land mass, you are twice as likely to witness a tornado in the UK than in the US.

When it comes to terrorism it seems troubles are never far away. At the time of writing, the MI5 website has a 'Severe' threat level posted, meaning in theory we are seriously at risk of another attack.

But even setting aside bad weather and terrorists, just the way we do business must raise a few eyebrows on the risk front. For a start, we are all using more technology and becoming so hopelessly reliant on it that life simply cannot continue if the electronics start to fail. Then, when we don't want to do something for ourselves, we subcontract to somebody else, whether it is making widgets that we need, or answering our customers' telephone calls, even if the call centre happens to be 5,000 miles away in India or China.

We rely on others much more than in the past, even when in reality we do not have the ability to truly control what they do. As to whether we are assured of the consistency and reliability of supply from that far flung source, who knows?

Even a cynic like myself has had to accept that the risks are getting broader and bigger, and therefore maybe we need to think a little more seriously about BCM.

Benefits

At the end of the day, the biggest question is what real benefits BCM can bring to business and what the benefits be to the bottom line will be. I did some research here too and found a lot more than I had reckoned on.

First, BCM is a really good opportunity to take a look at the company with fresh eyes. If you do it properly it will provide a clear picture of business strengths and vulnerabilities – the kind of analysis we all need in a cut-throat business world.

A hidden benefit of BCM is the ability, through the process of self-examination, to identify inefficiencies and allow changes to be made. In other words, BCM can actually make a company more money through improved efficiencies.

In addition, you discover your critical assets, processes, people, technologies and suppliers, so that you can take the necessary steps to protect the crucial features of your business and improve its resilience to disaster or unplanned interruption.

The icing on the cake is the ability to use your new BCM knowledge to demonstrate the strength of your business model to customers and suppliers. Because, of course, the number one reason for developing effective BCM is because you value them and wish to protect their interests.

It seems that BCM can improve corporate resilience, enhance operational efficiency, increase profits and be used as an effective marketing tool. Sold to the cynical gentleman in the corner!

Paul Johnson is an associate partner of business continuity management services within Vantis plc. Tel: 020 7467 4000, E-mail businesscontinuity@vantisplc.com