Business continuity management: what have we learnt from the coronavirus response?

Senior and operational leadership teams have always known that business continuity management was important. But the current coronavirus pandemic has made it an urgent and critical business activity. And, judging by the thoughts of our scientists and politicians, the current pandemic may not be the last. 

The pressure of so many teams having to work from home, staff having to juggle family, health and financial concerns, and an inability to travel has exposed whether organisations had been taking crisis management and business continuity management seriously. And these are only a handful of the issues that organisations are having to tackle.

One of the common mistakes many organisations make is to think that resilience can be obtained by simply writing down comprehensive plans and procedures. But having a plan to deal with major disruption is very different from being able to execute it. We have seen many plans that suggest moving teams, personnel and operations to alternative locations or premises, something that has not been possible in many cases due to the pandemic lockdown measures. Additional technology has been available as ‘contingency kit’ but the volume of this kit has been woefully insufficient to support an entire workforce working remotely. 

So there is undoubtedly a lot to learn since March 2020 about how to improve crisis management and business continuity management, as we move out of the current pandemic and adapt to a new normal. 

What, then, can we do to prepare our businesses for the new normal and develop robust business continuity management plans? Here are three key areas to focus on

1. Process: managing risk effectively

Risk management remains a key exercise in deciding where to focus, whilst ensuring senior executive oversight and accountability. Whilst the risk of a pandemic was on most risk registers, the likelihood of the risk materialising was almost certainly deemed low in many instances.

We will inevitably see many more organisations adding pandemics to their risk register and scenario planning similar situations to the current one, where offices and other premises are off limits.

Key factors for consideration:

• timeliness and effectiveness of risk management processes and procedures;
• ownership of risks and scenario planning; and
• supporting tools and SME input.

2. People: rethinking business continuity

As we move out of lockdown and into social distancing measures, businesses could in effect be operating under a completely revised model and it will be critical for them to rethink their business management plans. The business may also need to prepare to operate with a significantly reduced workforce, with limited certainty on the ability of third parties to play their part in the continued operation of the business model. Business continuity should be focussed on practical approach and capability, not plans. 

In these instances, business continuity management processes will need to account for the loss of key resources (single points of failure) and ensure adequate contingencies are in place to enable the continued operation of the business. Plans will need to be further supported by stringent health and safety measures to ensure employees are safeguarded from the potential threats posed by the virus. 

A large part of the success criteria for dealing with events that become serious is how leadership manages the response. This is as much about design and culture than just the inherent qualities of particular leaders. Having defined and effectively linked response forums / calls for executives (enterprise crisis management) and operators/engineers (incident response teams) is critical to ensure people remain focused.

Key factors for consideration:

• reliance on key individuals to support business operations;
• failure of a key outsourced service or supply channel; and 
• practical contingency plans ‘playbooks’ and scenario tests. 

3. Technology: ensuring robustness and suitability

Technology will need to be factored into new and amended plans to ensure that both existing and new technology infrastructure can withstand another change in circumstance, or continued remote working over a longer period of time.

It is highly anticipated that the pandemic has started a new age of working, one that will be far more home based and far less reliant on staff accessing office locations if the same job can be done remotely.

As more businesses move towards cloud-first and software as a service models, there will be a greater reliance on the robustness of technology infrastructure and on technology partners to provide reliable managed services and support. 

Key factors for consideration:

• IT strategic plans that underpin future business planning, including digital transformation and introduction of emerging technology such as AI and RPA;
• reliance on key third parties, their financial and operational stability, and their continued ability to support the business; and
• robustness of IT disaster recovery processes  including regular testing exercises.

The best way to tackle business resilience is to focus on capabilities rather than plans alone. Having these base capabilities (people, process and technology) established will help to ensure a sustained response to a developing and quite often uncertain, situation. 

For more information on effective business continuity planning and disaster recovery please contact Sheila Pancholi.