The type of business disruption that would trigger implementation of your business continuity plans is, by definition, a low-probability but high-impact event. In the case of COVID-19, there seemed to be no predictability factor. Some have even referred to this virus as a “Black Swan” event, one which seems unlikely—except in hindsight—and carries an extreme impact. We could debate the level of probability of a global pandemic, but there’s no doubt about its enormous impact.
Very rarely do so many organizations experience the type of external shock we saw with COVID-19 in the first quarter of 2020. Just about everyone’s business continuity management (BCM) program was tested, and many organizations weren’t nearly as prepared as they should have been. Even those who did have plans in place might not have foreseen such a prolonged period of disruption and uncertainty. As our Head of Risk and Compliance Mark Stifter wrote in Responding to Crisis with Agility and Resilience, even the best business continuity plans likely did not account for all of the risk factors we confronted with COVID-19.
Preparing for disruption means anticipating scenarios that would impact your operations and planning responses to minimize those impacts.
Now, most of us are again charting new ground as we prepare to bring staff back on site—at some point—in a still very uncertain environment. And as we’ve been hearing from a lot of our clients, accounting for a safe, orderly return to the workplace after a year or more away was not part of their business continuity plan.
In addition to ensuring that the physical workplace is ready, you also need to consider how you will support your workforce, including factors like health and safety, workforce planning, and employee communication and training.
Are You Prepared?
Whether you see it coming or not, preparing for disruption means anticipating scenarios that would impact your operations and putting together appropriate responses to minimize those impacts. Think about the impacts that might slow your company’s operations for an extended period of time or bring operations to a halt.
- What if you couldn’t pay bills for 30+ days?
- What if a member of senior management became embroiled in a public scandal?
- What if your brand suffered a major setback due to sabotage?
Now think about the types of events that might carry such an impact. Effectively preparing your BCM program is a process that explores various impacts to your business. Not just anyone’s, but yours. BCM identifies the events that would be most damaging to you and finds ways to mitigate those impacts by planning ahead for the unthinkable and developing workaround strategies during normal times.
There’s a proven methodology that encompasses 10 program areas governing the development, implementation and ongoing lifecycle of a BCM program.
Professional Practices for Business Continuity Management
1. Program initiation and management
2. Risk assessment
3. Business impact analysis
4. Business continuity strategies
5. Incident response
6. Plan development and implementation
7. Awareness and training programs
8. BCP exercise, assessment and maintenance
9. Crisis communications
10. Coordination with external agencies
These program areas provide a way to assess the strength of your safeguards and continuously make improvements and upgrades as needed while providing your management and employees with the tools they need to understand their role—not only during normal business operations, but also during your recovery from a business interruption.
While we can’t possibly prepare for everything, we can certainly plan for the impacts, if not necessarily the specific events themselves. The key is to fully understand the processes that must be in place to deliver the products and services that keep your business in the game.
Successfully executing your BCM requires organizational leadership from the top in the form of a steering committee and BCM coordinator in addition to your recovery teams. Roles and responsibilities must be clearly defined, and expectations set.
For each scenario in your BCM, you should account for these essential components:
- Communication plans, both internal and external
- Test plans, whether a simple table-top exercise, cross-functional simulation or practice scenarios that include external participants (key suppliers/customers or local first responders)
- Recovery to restoration plans, including potential interim phases between recovery and return to normal operations
The most important follow-up to any test or actual event is documenting the “lessons learned” during and after a crisis and incorporating those learnings into your plan. It’s through this continuous improvement that the most successful companies achieve true resilience with their BCM program.
The year 2020 has been full of uncertainty with the global pandemic alone. Add political and social unrest, wildfires, and a record-breaking hurricane season, and it becomes even more critical to rethink how we manage employees and how we conduct business in general.
By achieving resilience, you can avoid the chaos and panic that other organizations experience, even if you can’t avoid the crisis itself.
It’s not just about keeping the lights on or recovering from a crisis. True resilience means you’re able to pivot and adapt to sudden change when the situation requires it, avoiding the chaos and panic that other organizations experience, even if you can’t avoid the crisis itself.
Resilience will mean different things depending on your industry and function. For example, it could mean implementing a hybrid workforce or creating alternate supply chain paths. Becoming resilient is a unique endeavor because, like your BCM program, it depends on the critical points of failure facing your organization.
To reap the benefits of resilience—and not only survive but thrive—you must incorporate BCM deeply into your organization’s operational DNA. Planning for business continuity becomes a part of operations, and the actions you take in response to a crisis become second nature. Managers and employees alike are able to quickly shift and adapt to directed changes in operations, because they expect it; they’re familiar with their continuity roles and have practiced them.
Creating a resilient BCM program requires a good coach, and our Risk and Compliance experts can help you prepare for the next event, no matter where you are today. Download our Business Continuity Planning Playbook and Business Continuity Readiness Checklist to get started.