The problem is; catastrophes don’t happen often so people will think about them from time to time; but often action doesn’t go beyond preparing an emergency response plan. Managers are rarely punished for focussing on immediate business needs. Therefore, if they are confident they can get everyone out of the building alive; it’s a good start. They trust there is enough intellectual grunt and practical experience in the business to deal with an unlikely catastrophe. Of course, there’s always the catastrophe insurance to fall back on.
There are two types of catastrophe; Everybody’s Catastrophe and Your Catastrophe. The Brisbane floods, Cyclone Yasi and the Longford gas explosion in Victoria in 1997 are examples of Everybody’s Catastrophes. Each of these catastrophic events created a steep learning curve for those unprepared. However, if your business experienced a significant impact, so did everybody elses. Each of these events found a level of acceptance from the community and from company stakeholders. Most people understood there would be difficulties until things returned to normal. In these situations there is a fair chance the unprepared business can muddle its way through the issue.
A Your Catastrophe affects mainly you and involves to the following type of event:
- Your business burns to the ground
- The regulator shuts you down
- A supplier has an fire and cannot deliver to you
- A customer has an fire and cannot accept your product
- You experience a major plant or IT failure
A Your Catastrophe has a different dynamic because your stakeholders may quickly come into play in disturbing ways e.g. Your:
- Shareholders want speedy advice regarding the profit impact or they will “vote with their feet”
- Financiers want to know how it will affect debt covenants
- Suppliers feel the squeeze and want to know when you are going to be taking deliveries
- Customers fear a drop in sales and want to know how you’re going to supply
- Employees need to know whether to come to work tomorrow
- Competitors are licking their lips and calling your clients
A Your Catastrophe creates a near vertical learning curve unprepared companies. Could you meet the following challenge? Within 3 hours of the completion of the emergency response plan, the CEO and senior management team should be able to hose down stakeholder concerns by:
- Releasing a statement explaining the gross profit is protected by insurance
- Advising suppliers:
- The expected length of the interruption
- If raw materials should be redirected to one of your alternative business facilities and undertaking to absorb the additional delivery costs;
- The recovery time frame and the anticipated nett effect on their supply schedule given you may subsequently be able to increase production to make up the interruption.
- Advising customers of how you will maintain their stock levels, from your reserves or from deliveries from other production facilities, at no extra cost.
- Advising all employees via a website or social media of what to do.
- Put a “shot across your competitors bows” with a media release advising it’s business as usual.
Your business needs to act decisively and communicate effectively to demonstrate the catastrophe is under control. However, without prior preparation, it may take days to gain control of the situation and develop the message. If your stakeholders begin to react negatively your business continuity problem becomes a secondary issue. You are facing a crisis. Of course the “Elephant in the Room” issue is you may quickly discover it won’t be business as usual. As you develop you recovery plan you may find you are actually in crisis mode. I think it’s fair to assume a company without a recovery plan won’t have a crisis management plan.
The glib answer is to develop a business continuity plan (BCP) in accordance with the Australian Standard AS/NZS 5050:210. Unfortunately, once you develop a BCP; the devil is in the detail. An annual update won’t be anywhere near adequate. The plan must be regularly updated because your catastrophe could occur tomorrow. Therefore you need to ensure the people delegated responsibility to activate mitigation strategies are still on deck. Also, your business may have changed and the mitigation strategies will be out of date. When you combine the effort to create the BCP with the challenge to keep it up to date and the likelihood of the event occurring it results in most people not having a BCP.
It’s perplexing how people often treat risk management strategies as all or nothing. “If we can’t have a complete solution, we won’t have anything”. However, you can take the middle road. Conducting a business continuity risk assessment will enable you to flatten the learning curve, to some extent. I recommend you consider spending a couple of hours with key managers and a whiteboard to assess the need for a BCP. This involves identifying your Critical Business Functions by considering the following scenarios e.g.
- Failure of your customer interface
- Denial of access to a business site
- Failure of a supplier to deliver materials or services
- Inability to produce product
- Inability to store product
- Inability to transport product
- Customer unable to accept product
- Inability to collect revenue
Then apply the following assessment.
- Identify who is responsible for each Critical Business Function
- Identify the Maximum Allowable Outage for each Critical Business Function
- Consider the mitigating strategies readily available and determine the Time To Recovery for each critical business function
You may find the Maximum Allowable Outage for your customer interface is 24 hours. However, if you are running a mirrored IT system with automatic failover and additional hot site backup, your Time to Recovery may be a maximum of eight hours. Therefore you do not require business continuity plan for this Critical Business Function.
If your Time to Recovery exceeds Your Maximum Allowable Outage you add it to a shortlist of Critical Business Functions requiring a BCP. You can then assess the complexity and cost of developing the mitigating strategies for each BCP required. You may be pleasantly surprised to find that you need very few of these strategies. The senior management team can agree to progressively develop the necessary BCP mitigation strategies to reduce the risk. If they opt not to proceed the challenge of the vertical learning curve will be clear. This minimal effort may deliver peace of mind.
Avoid trying to identify the most likely scenario which will interrupt your business. You are better to simply assume an inability to produce product and proceed immediately to consider the Maximum Allowable Outage and Time to Recovery. A plasterboard manufacturer in Victoria based its business continuity plan on a loss of production due to a fire at the premises. The Longford gas interruption in 1997 was completely unforeseen. However, the mitigation strategies remained completely relevant. The cause of the interruption wasn’t the key issue. It was:
- The amount of stock on hand throughout the country
- The ability of interstate facilities to take up the shortfall in production
- Disclosure to the insurer prior to the event who provided for additional transport costs to mitigate the loss and ensure no additional cost would be passed on to customers
By Gerry Robinson – Practice Manager Business Risks WCD RiskTech