Chartered Management Institute fellow John Sharp, CEO of the Business Continuity Institute, on how businesses can prepare for unexpected calamities.
Organisations exist in an uncertain world. The range and scale of threats to the continuity of their operations is increasing day by day. The financial impact of major disruptions can be severe, and the damage to reputation from a mishandled crisis can destroy market share. Recent changes in management practices have left organisations with little or no resilience to cope with existing and emerging threats.
Flatter management structures, the adoption of 'just in time' within supply chains, and increased use of outsourcing have all helped to boost efficiency. A reduced headcount and less surplus stock often result in financial savings for many of our organisations. But the use of these techniques has also reduced our ability to absorb the effects of any disruption.
None of us can predict the type and scale of the next disruption. Indeed, some major events are unpredictable, such as the terrorist attacks of 11 September, 2001 and the US power blackout in August. In recent years we have also had to cope with the fuel strike and a foot-and-mouth epidemic.
It falls to governments to improve the resilience of the community to cope with this type of national crisis. In the UK, the forthcoming Civil Contingencies Bill is designed to improve the ability of the country to respond and recover. However, protecting commercial organisations falls to company boards and senior executives.
When challenged about their ability to cope with a major disruption, it is not unusual for senior executives to respond: 'It can't happen here' or 'We are large enough to deal with any crisis.' Yet the evidence is different: it does happen and often the organisation fails to cope.
Over the past four years, the Chartered Management Institute, in conjunction with the Business Continuity Institute, has carried out a Business Continuity Awareness survey among UK managers. The results show that 18% of UK organisations had a major disruption in the past year, such as the loss of IT, people or skills; supply chain failures; fire, flood/storm; power failures and pressure group protests.
It's hard to understand how, when faced with this evidence, senior executives still believe it will not happen to them. This approach is unacceptable in a climate where customers are more demanding and business and management are under intense media scrutiny.
Research undertaken by Knight and Pretty at Oxford in the mid-90s looked at the effect of disasters on shareholder values. What they found should alarm senior executives: of 10 worldwide companies that had suffered disasters, five emerged with an enhanced reputation and increased share prices, but five suffered financial and share price losses. Investors lost confidence in the ability of senior executives to manage in a crisis that put the firm in jeopardy.
Can management do anything to improve their organisation's resilience?
They can introduce Business Continuity Management (BCM), a holistic management process that identifies potential impacts that threaten an organisation and provides a framework for developing resilience. It builds capability for an effective response that can safeguard organisations.
BCM is as much about prevention as recovery from disaster. By ensuring that the small and insignificant incidents are dealt with quickly, by listening to the operational problems of staff, and by communicating across the organisation, it is usually possible to prevent major crises developing.
The cost implications need not be high, but the benefits are considerable, as small errors and failings cost money, whereas an error-free system aids profitability.
The first action is to identify the major processes that deliver products and services and to consider the impact if these were interrupted. We don't know what is around the corner, but we do know the likely damage if a process were to be lost for any reason.
Vulnerabilities within the key processes must be identified. These may be a shortage of key skills, dependence on single suppliers, an extended supply chain subject to transport disruptions ... I could produce a very long list. Having identified these vulnerabilities, action must be taken to remove them or to plan alternatives.
BCM is a cultural process that has to be embedded throughout the organisation.
The CEO and board have to be committed to it, for the short and long term. Resources must be allocated to drive the programme and to educate managers in the principles involved. Ideally, BCM has to be owned by everyone.
External factors are now driving the need for business plans. Regulators and auditors are expecting to see evidence of BCM, and insurers providing cover for business interruption prefer those organisations with an effective BCM programme. The Civil Contingencies Bill will require local authorities and the emergency services to have BCM in place. More importantly, customers are demanding that BCM be included in new or existing contracts.
As senior executives, we all have a choice: to establish BCM as an essential business discipline to ensure that our organisations have resilience, or to wait for the inevitable disaster to expose our weaknesses.