Open for business

1 March, 2010

Unplanned events can have a devastating effect on businesses. Crises such as fire, damage to stock, chronic illness of key staff or IT system failure could all make it difficult or even impossible to carry out normal day-to-day activities. At worst, this could see you losing important customers or even going out of business altogether.

Business continuity involves ensuring businesses can continue to trade at all times no matter what happens, and in many ways it should be considered just as important as finance and HR. With correct planning, you can take steps to minimize the potential impact of a disaster.

The first step in putting together a business continuity plan is to identify the issues that could have an impact on the business. This can include identifying potential problems such as staff-related issues, IT failure, premises being damaged or problems with suppliers and stakeholders. A carefully thought-out business continuity plan will make coping in a crisis easier and enable you to minimise disruption to the business and its customers.

A common misconception of planning business continuity is that it just involves preparing for the major disasters. It should have a much broader perspective and generally involve identifying and then managing any risks that could disrupt the organisation’s ability to continue to trade.

The next stage is to identify how each potential issue could affect business continuity. For instance, if IT systems were to fail, organisations need to make sure they have the correct back-up system in place for when trade is interrupted.

Interserve has developed ‘think ahead’, a Quality Assurance procedure that identifies gold, silver and bronze statuses, enabling us to effectively identify, evaluate, allocate and actively manage risk, and control its associated cost throughout. Every aspect of the situation is covered ensuring that when business continuity is needed most, the support is there. Managing incidents from severe weather conditions to the 7 July London bombings has tested our systems and proven our capability in proactively preparing and managing these incidents for clients.

Risk assessment
It is important that companies analyse the probability and consequences of crises that could affect the business. This can be done by carrying out a qualitative risk assessment, including an appraisal of how likely the risks are to happen and how severe it would be if they did happen.

This kind of analysis should help you identify which business functions are essential to the day-to-day business operations. You are likely to conclude that certain roles within the business, while necessary in normal circumstances, aren’t absolutely critical in a disaster scenario. It will also allow you, if necessary, to develop a recovery structure.

A risk assessment can also help you to grade the probability of a particular crisis occurring, perhaps on a numerical scale or simple grading, such as high, medium or low. This will help to decide your business’s attitude towards each risk. You may decide to do nothing about a low-probability crisis, although we advise businesses to always bear in mind that it could be highly damaging to your business if it did occur.

It is also essential to look at risks from the perspective of your customers. Consider how they would be affected by each potential crisis. How damaging could a failure be for their business, and how can you mitigate this? Interserve has identified four phases which are key to identifying risk: identification, analysis, quantification and control. For clients, we carry out a risk management plan to ensure that risk is proactively managed throughout the contract and the possibility of disruption to the service provided is minimised.

We work with clients to ensure they clearly understand the context, adequately describe the risk, identify relationships and explore opportunities. The effects of risks are also considered, enabling the risks to be logically grouped and relationships captured so that planning and management activities can be conducted efficiently.

Assigning a level of command is about giving you an agreed management structure on a specific issue. This will identify how and to whom things should be given, and be the start of a plan to deal with the issue. Once the issue and level of command have been established you can start to look for ways to engineer the risk out of your business.

For example, Interserve considered what it would do if its premises flooded or could not be used for some reason. We considered securing standby premises, but after taking stock of all our properties we found that we had other premises already available to deal with all but the severest of incidents. This process not only saved the cost of acquiring unnecessary standby premises, it helped us understand better what is available to us as a business.

Testing
Once the business continuity plan is in place, you will need to test how well it is likely to perform in the event of an emergency. Although by their very nature crises are obviously hard to simulate in a rehearsal, you can assess your plan against a number of possible scenarios in a paper-based exercise.

Think about the things that would cause most disruption and seem most likely to happen to your business. Then make sure that your plan covers each of the risks. Ask yourself the following questions: have I set out the right steps to take? Is the order of the plan correct so that priority actions will take place immediately after the incident? A simple checklist will help to quickly evaluate the situation and understand the response required: people, systems, premises and suppliers.

On the day of the London bombings on 7 July 2005, Interserve staff were involved in two of the most critical areas: at University College Hospital, to which many of the casualties were taken; and with the Metropolitan Police, handling the aftermath of the events on the street and below ground. Interserve continually carries out dry runs and training sessions as part of London’s emergency planning, which helped to ensure co-ordinated support throughout the incident.

The future
In this fast-changing world, clients are becoming more sophisticated when it comes to business continuity and more businesses are requesting detailed plans. Yet while the financial aspects of business continuity may be understood, the environmental aspects are less so, and many companies are not yet preparing themselves for changes.

Business continuity managers need to be more forward-thinking. They cannot just consider the current risks, but the likely risks in five or ten years’ time – such as climate change, floods, heat waves, extreme weather, energy shortages and power cuts. It was estimated that the snow at the end of 2009 through to the beginning of 2010 cost businesses £600m a day, as staff failed to commute to work.

The economic situation, however, means business continuity plans must show a demonstrable return. Financial stresses can in themselves have a direct impact on a business. Interserve advises clients to look at sharing resources to develop the plans among different departments, or sharing resources with clients. And it makes economic sense that where possible, businesses should always check suppliers to ensure they are financially sound.