How prepared are you?

Anyone who is familiar with business continuity management will recognise the poor statistics associated with the testing of business continuity plans. Although different surveys offer different insights into business continuity preparedness, both in the UK and overseas, questions relating to the frequency and effectiveness of testing almost always make gloomy reading. Research based on the most optimistic of respondents is unlikely to report that more than 50% of organisations regularly test their plans, while those at the other (realistic?) end of the scale usually report a much more modest picture. Although recent advancements in business continuity management have increased both the awareness and the effectiveness of plans, a lack of commitment to testing remains the weak link in many organisations.

Aon and Gate Gourmet, the international airline catering supplier, worked together to prepare and, more importantly, test a pandemic business continuity plan. Using this work as a case study, and focusing on the testing phases of the project, we here seek to outline a possible approach to testing plans, and to simultaneously illustrate the benefits through a real life, practical example.

The value of testing

The value of periodic testing and exercising of business continuity plans is rarely disputed. For a mature plan, testing ensures that its contents remain relevant and up to date, and that the business continuity team can still effectively use it in a future incident. For a new plan (as in this case study), testing provides assurances that its provisions will work as expected. However, despite these widely accepted benefits, complacency or a lack of knowledge, budget or buy-in is frequently blamed for leaving plans untested.

Testing and exercising are often cited as being the most interesting part of any business continuity programme, which makes the low take up even more unfortunate. Assuming the test has been properly prepared and is delivered effectively, everyone involved will undoubtedly benefit. The participants will learn from practical experience while gaining confidence in themselves and the plan. However, if the test is unsatisfactory or poorly implemented, most participants are likely to lose interest in business continuity management and may ultimately attempt to distance themselves from the initiative in future.

Case study

Gate Gourmet is headquartered in Switzerland, but has significant catering operations around the globe. The company has recently embarked on various initiatives to develop and formalise risk management. As a result of this, the threat associated with a pandemic-related event, whether global or regional in nature, had been identified at board level as a significant corporate risk. Given that the majority of Gate Gourmet's revenues are derived from international airlines, the impact of a pandemic could be both immediate and severe. As a result, the board were keen that the corporate risk management function undertook a more detailed evaluation of the underlying risk and implemented policies and procedures to protect the business should the risk actually materialise.

Preparation

“A lack of commitment to testing remains the weak link in many organisations

Working closely together over a period of approximately six months, Gate Gourmet's core pandemic team and Aon developed an approach for helping both the corporate and local food preparation facilities (known as ‘kitchens’) prepare for the likely impact of a pandemic. Preparations were comprehensive and included people, processes, systems, suppliers and customers. The overall approach was underpinned by a series of checklists that helped local management teams develop an effective response to reflect both accepted best practice and local circumstances. Each kitchen was given adequate time to prepare and access additional help and support where required. Relevant corporate functions based in Zurich were also involved, to ensure that specialist resources at the corporate level were coordinated, effective and capable of helping to protect the whole organisation in a worst case scenario, or to support specific local geographies in the case of a local or regional outbreak.

All the preparation culminated in the creation of the Gate Gourmet Pandemic Plan, or GGPP. This, along with supporting documents, would form the basis of the organisation’s response to a future pandemic event.

Testing

Following the development of the draft GGPP and the associated processes, it was important to undertake a test of the arrangements. Initially three sites were identified to undertake the exercise and two primary objectives were agreed for each test. First, we needed to evaluate how realistic the plans were, how practical they were to implement and how easy they were to use. By understanding the strengths and weaknesses in our approach we could further improve the GGPP before it was rolled out across all Gate Gourmet's locations. Second, the testing exercise provided an opportunity for local managers to understand the potential risk and experience what it might be like to implement the plan. This was important as Gate Gourmet was still developing its overall approach to business continuity management, and so many of the concepts, processes and benefits were not widely understood.

Process

Based on an initial assessment of the current situation, the timescales and the available resources, we jointly developed our methodology. Taking account of the maturity of Gate Gourmet's existing business continuity management, it was important to develop a supportive approach that would help build confidence and constructively identify areas for improvement, rather than present the initiative as a complex, technical and overbearing process. The outline approach is illustrated in Figure 1.The key elements included:

n A briefing document that conveyed the importance and scope of the GGPP and highlighted the relevance of the testing. By communicating the benefits of the testing we were able to ensure that people were engaged in the process from the outset.

n A questionnaire distributed at the start of the testing phase provided an opportunity to identify and address any significant gaps in current understanding and by repeating the exercise (with additional feedback questions on the testing itself) at the end of the process we could clearly demonstrate improvements and the value of testing at individual sites.

“It was important to develop a supportive approach

n A dedicated conference call with each test site was scheduled in advance of the actual test. This provided an opportunity to address any specific concerns as well as finalise the logistics that could potentially be complicated by time zones, language or local culture.

n A testing workshop was built on a properly researched and realistic scenario. To maintain credibility, each scenario had to take account of local circumstances and above all be believable. Before each test, the local management team participated in three training sessions, which provided a background and overview of business continuity management, the pandemic threat and the GGPP documentation.

n There was a commitment to critically evaluate the readiness and effectiveness of the site-level pandemic plans coupled with action tracking, to ensure continuous improvement in both pandemic planning and wider business continuity management.

Results

As a result of investing in the GGPP and the associated testing, Gate Gourmet has developed and tested a way of mitigating a major risk to its business. The number of locations and the potential magnitude of the risk necessitated a corporate response, and through the use of multi-disciplinary teams and taking account of local circumstances through the testing exercises, a highly effective response has been developed. The questionnaire which was distributed both in advance and after the training and testing workshops makes it possible to record the value of undertaking such an exercise. Figure 2 presents examples of the pre- and post-test results and illustrates a few of the benefits.

Conclusions

The concepts underlying business continuity management have developed significantly in recent years. However, a lot more can be gained from ensuring that testing is a core part of your business continuity arrangements. Testing may sometimes appear daunting, but a relatively simple approach can deliver tangible results.