CHAPTER 11: BUSINESS CONTINUITY MANAGEMENT
Business continuity management is a systematic process of risk management and planning designed to ensure a quick return to an acceptable level of service after a disruption, regardless of its nature. The idea is to ensure the organisation’s survival, even in the face of the unexpected, by ensuring its most critical business functions continue to operate – even if at a reduced capacity – so core business activities can keep going while you attend to the disruption.
Preparing for disruption
It is impossible to anticipate every possible type of disruption – global events such as the COVID-19 lockdowns and the 2021 Suez Canal obstruction have made this extremely clear. Therefore, organisations must not only rely on their risk assessment, which focuses on what threats might harm them, but also identify their most critical business operations, assets and resources, and consider what backups they can rely on, even if only temporarily.
By knowing how to cope with, for example, inaccessible workplaces – whatever the cause of the inaccessibility – you can make sure that you have remote working technologies in place and train staff how to use them. You should prepare a range of such solutions that simply focus on preserving your critical business activities during a disruption, without being too specific about the nature of that disruption.
You should consider what business continuity solutions – for before, during and after a disruption – you can use to:
• Meet your requirements and objectives;
• Protect your critical business activities;
• Maintain access to key resources;
• Reduce the likelihood of a disruption; and
• Reduce the impact of a disruption.
You will need multiple solutions to cover all these points; however, one solution can work for different types of disruption – for example, remote working technologies are a solution for site closures as well as for a train strike that prevents a meaningful number of staff from getting to the workplace.
As you combine solutions, you are effectively building your response strategies. These should detail the solutions you will use, and at what stage of the disruption you will use them. This information provides the outline for your business continuity plans.
Business continuity plans
Business continuity plans are probably the most common aspect of business continuity management. Unfortunately, it is nearly as common for those plans to be ineffective, as they are often out of date and untested.
To create effective plans for both the foreseeable and unforeseeable, and that make the most of the solutions you have already prepared, develop several broad scenarios for which responses are likely to be similar. You might, for example, develop plans for:
• Major site or premises incidents (fires, floods, etc.);
• Information and communications system failures (whatever the cause);
• Supply chain failures; and
• Pandemics and similar scenarios.
To ensure your plans are as effective as possible, make sure they use clear and specific language, and directly refer to predefined thresholds for activating the plan. Also make sure that they set out when the plans can be deactivated, how reporting is conducted, the roles and responsibilities of people involved in deploying the plan, and any supporting information necessary. Finally, ensure they are communicated and accessible to all those who will need to use them when activated.
Last but not least, to be sure your plans work as intended, make sure you test them at least annually, and incorporate any lessons learned. This will also familiarise staff with what they need to do – exercises are essentially, in themselves, a means of mitigating the risk.
Real disruptions – especially out of our control and on a global scale – should be rare, but history teaches us that they happen to even the best-managed organisations. It is therefore important to be prepared, so you can act swiftly when they happen, ensuring your organisation does not just survive them, but comes out stronger on the other side.