Business Continuity Planning: the most important thing that organisations hope they’ll never need
Everybody knows business continuity planning (BCP) is part of an organisation’s risk planning. But it is perhaps only in the last two years that its importance has been driven home quite so starkly. Whether it was supply chain, IT and the turn to remote working, health and safety in the workplace, cash flow or other issues, the outbreak of the Covid pandemic stretched businesses to their limits.
What exactly is BCP? First and foremost, business continuity may be defined as "the capability of an organisation to continue the delivery of products or services at pre-defined acceptable levels following a disruptive incident”, with BCP being the process of creating systems of prevention and recovery to deal with such disruptive incidents, or any other potential threats.
As should be obvious from the brief discussion so far, a BCP is, in a sense, an amalgam of a selection of smaller BCPs for differing areas: clearly, what is needed to handle IT disruptions to servers, networks, PCs and mobile devices is not the same as what is required to manage the disruption caused by the Suez Canal blockage this March, which disrupted 12% of global trade at a cost of over £10m a day.
BCP did begin life in the 1970s as an outgrowth of disaster recovery planning regarding IT. It was about alternate sites, where back ups could be stored, so was predicated upon physical disasters, such as floods and fire. By the 1990s, it has become much more about application architecture and distributed applications, data and processing. Nowadays, the IT side of BCP is, somewhat obviously, concerned primarily with cyber attacks and the risks associated with digital transformation and other cloud transference and convergence gateways to risk.
What all plans try to do is have contingencies for disaster, ensure operations continue, and in so doing, for IT at least, optimise availability of relevant applications, software, and so on. In Britain, the British Standards Institute (BSI) produces guidance and provides training.
BCP. Photo: Annant2015/cropped from original/licensed under CC-by-SA-4.0
So what of BCP in the context of Covid, the most disruptive event on a global scale since WW2? Back in February 2020, the Financial Times was already highlighting the importance of getting your continuity ducks in a row in a piece built around an interview with Hannah Ryder, who runs an international development consultancy in Beijing, which was just returning to work then. She stressed the difficulty of managing uncertainty, something with which we’ve all become accustomed in the last 18 months. The article also sought the opinion of Peter Groucutt, the managing director of a BCP specialist called Databarracks:
“Small companies in particular can find it difficult to draw up plans as they are often focused only on day-to-day operations. These smaller employers “will have things up to date for audits, but once the audit passes, their focus will turn away,” Mr Groucutt says. Big businesses are often better prepared, with in-house teams who focus on resilience and risk planning.
An effective continuity plan will make sure employees have the necessary resources to continue working if movement becomes heavily restricted and they cannot get to the office, as well as giving companies the tools to get themselves up and running again as quickly as possible after a crisis, or to turn to other markets to make up for a production shortfall in an affected area.”
What is striking is the extent to which this played out as much of the world went into lockdown. Larger companies set up huge numbers of people for remote working; for example, one large German manufacturer did this for a quarter of a million employees in one week. Resilience was the order of the day. Moreover, crisis really was the mother of invention in the spring of 2020, as necessary innovation flourished during this initial crisis management period: as well as teams being set up to work from home, there was a refocussing of strategy on digital customer engagement, and a massive increase in speed of getting solutions to market.
Despite this, many small organisations were not set up to cope with a crisis event on the scale of Covid-19. Indeed, a survey conducted by Gartner last March found that only 12% of businesses were highly prepared for Covid, while a staggering 26% thought it wouldn’t affect them. However, only 2% thought they would continue as normal. This suggests that BCPs at the 26% were not telling the board what they needed to know.
And what of supply chain, perhaps the most disrupted business area? One year on from the pandemic, supply chain experts were emphasising “the need to bolster business continuity planning”. Initially, demand dropped, manufacturing dried up and workers were furloughed. One and a half years on, and the problem has not gone away. There is no end in sight. The reasons for that are outside of the purview of this article, so having noted the ongoing problem, let’s move on to sustainability, construction and BCP, with a particular focus on small business.
There are a lot of parts to this. For example, small businesses with workers on site has to balance risk and flexibility. Covid lockdown meant a reduction in the number of workers who might be in a given place, but then once something resembling normality returned, there was an attendant risk of having too many workers who might need removing from site if health conditions change. Furthermore, there has been the extended use of personal protective equipment. Companies have been taking on riskier jobs with even tighter margins than usual as they look to keep their businesses going and people employed. These means that a BCP now might include a strategy of putting risks into contracts as businesses look to prepare for unknown variables. The list below is what SAGE is suggesting small construction firms should do:
Include contingency scenarios that address all aspects of the business
Maintain regular cash flow forecasts for a better handle on finances
Have a dedicated person oversee and own the business continuity plan to streamline the process
Obtain feedback from your team; they may know specific areas of the business better than anyone else
Remain flexible, build in alternate ways of doing business, and identify backup suppliers to account for future unpredictability
All very sensible. What we are seeing across industry is the merging of scenario planning – what we might call a day-to-day part of operations – with disaster and business continuity planning, as further crises after Covid, such as the Suez Canal blockage and the worldwide supply chain issues that are seeing containers not being moved, make it clear that BCP is an ongoing issue, and something that needs constant re-evaluation. The New Normal has to have BCP running right through it.