Five BCP lessons from COVID-19

I’ve heard from clients and several other businesses that for the most part, Business Continuity Planning (BCP) has worked. Whether it means shifting to remote working, servicing clients in a different way, adapting the business to minimise impact or more strategic pivots for those that foresee lasting effects.

As the economy slowly begins to reopen, it is useful to take stock and bank some learning experiences and consider the implications on your BCP.

1. Scenario of a government-imposed lockdown

A global flu pandemic is not really a surprise, this is a commonly identified BCP scenario along with terrorist attack and extreme weather. The biggest shock however that we in the profession likely didn’t consider in the scenario exercises was that governments all over the world would make a unilateral decision to enforce a lockdown of the entire population and the borders thereby stopping huge parts of the global economy over many months.

This would have been previously considered an unlikely response given the economic implications but now most certainly could re-occur if there were a second wave, the virus mutates, or proves to be seasonal until a vaccine is developed. We now have to be prepared for this reoccurrence.

2. Preparing by looking outside-in

Business impact assessments within BCP seeks to identify the critical people, processes, systems and places, focusing on business operations and supply chains ensuring we have contingencies in place to deliver as normal. This is very much an inside-out process and the assumption of getting back to normal doesn’t always apply.

We may not have considered the impact of the risk event on our customers, the need for increased customer communications and the opportunity to turn a crisis situation into lasting customer loyalty if handled correctly. When applying BCP techniques and we seek out critical people – one suggestion is to keep the customer persona (who is a critical person) in consideration and develop plans to engage and support them.

3. The importance of financial resilience          

Whether you are a risk, BCP, resilience, or crisis management expert, there is no denying the importance of a strong balance sheet in times of crisis, especially an event as pro-longed as Covid19.

From my experience and interactions with peers in the profession, this is an area the risk managers tend to shy away from. Companies that are highly-leveraged during normal situations will be at much higher risk of bankruptcy during stressed scenarios. For businesses that are cash-rich, preparing for and arranging borrowing facilities when you don’t need funding is the best time to lock in favourable terms. Trying to borrow or raise funds while in a stressed situation or market is always more difficult and costly.

4. Combination of risks

As we know from work done to support Long Term Viability Statements, businesses that are in a stressed scenario - as most businesses are now - can become unviable on even small risk events normally considered background noise. This is why it was concerning that many Australian businesses and government bodies experienced a major cyber attack last week while just beginning to end their lockdown.

In terms of the risk assessment that informs the BCP plans, we should now be in an elevated level of risk awareness and must respond to minimise impacts of all risk events. Given the impact COVID-19 is having and the stressed state most businesses are in, it is timely to consider the various implications on the business.

I recommend conducting a thorough risk identification, applying the simple Strategic, Tactical, Operational model to think through and proactively manage the immediate and medium term. Some considerations are listed below:

Strategic – local over global, germaphobia, racism and anti-Chinese sentiment, urban sprawl

Tactical – cashflow, cost cutting, government support, delivering digital transformation and strategic pivot projects

Operational – social distancing and restricted travel, affects of and effectiveness of home-working, cyber and privacy risks, side-effects of vaccine

5. Need for agility

As a technology startup CEO, the buzzword of the moment is ‘pivoting’ but how does a major listed enterprise pivot? It is not easy, and companies need to be careful not to take knee-jerk decisions. Agility and entrepreneurship is often smothered by bureaucracy, politics, fear of taking risks and misalignment of rewards. These are all common in major businesses but the trend started much before COVID-19, businesses, especially the struggle of large incumbent players to maintain their competitive edge against new, more nimble and digitised business models.

There is an undeniable need to improve in these areas beyond cost cutting, the BCP and risk management community are well positioned to be agents of change as we have access to the board and internal networks across the business to help get things done. Our BCP and response plans need to be more commercially-minded and customer-minded as we not try to prepare our businesses to win in the post-COVID world.

Danny Wong is an enterprise risk practitioner and CEO of GOAT Risk Solutions Limited.