Rather than stoking panic and rapid overhauls of business operations and strategies, the less-acknowledged but very real risk of COVID-19 from a business continuity perspective may be that it leads to complacency.

COVID-19 stands out in a number of ways. While much of the commentary around the pandemic relates to how suddenly it caused us to change so many aspects of how we do business, in truth, other types of disasters could grant us much less leeway to respond.

In comparison to the impact of, say, a cyber attack or a fire that destroys a critical site, the business interruption caused by the pandemic played out rather more slowly for many. Depending on the industry and its geographic location, a business might have had weeks to prepare for the worst of the impact as it spread around the world.

Other factors make it unlike anything else we need to prepare for, as well. Your customers were likely to have been more understanding of the difficulties you were facing, while your competitors were probably equally as affected as you and thus unable to take advantage of your misfortune. The broad-ranging government directives and massive stimulus effort also make the situation and its impact on businesses unique.

In a webinar held by FM Global in April, attended primarily by those in risk management roles, we polled the audience to see how they felt about the adequacy of their business continuity plans in the wake of COVID-19. Sixty-two per cent said their business continuity plans (BCP) were effective, 26 per cent said they had no documented BCP, but felt they had managed effectively, while 12 per cent said it was “too early to tell”. Of those who had a BCP, 80 per cent indicated they only needed to make “modest changes” to their plan in light of COVID-19. Ten per cent declared a need for “material changes” while the remainder admitted to not having a plan at all, but intended to implement one now.

It could be argued that our audience members were an unusually engaged group where risk and resilience is a core focus. But it’s also worth contrasting those results with the fact that prior to the COVID-19 outbreak, only one in five (21 per cent) board members believed their organisation was prepared to respond to an adverse risk event from a planning, communications, recovery and resilience standpoint.

 

Building strong business continuity plans

In 18 years spent helping clients manage their business risk and resilience, and reviewing their business continuity plans, the same recurring points stand out in terms of what makes for an effective plan and an effective planning process.

The role of the board is key from the outset. Its responsibility is primarily for risk oversight, as opposed to risk management. The board needs to set the tone around the risk appetite it considers appropriate for the organisation and consider whether the company culture is aligned to the risk appetite it has outlined. Managers are generally best positioned to develop and implement BCPs, having sufficient links within the business to make it effective.

Importantly, both the board itself, and management’s activities, need to be structured in a way that both reinforces the culture set for risk appetite and provides effective risk management and oversight. The board should ensure managers have the robust crisis management capabilities they need to act, including the necessary authority and resources — both in terms of people and capital — to make the process effective. The board can and should also be a sounding board for strategies.

 

Getting back to basics

Those tasked with developing your BCP need to be people who possess a solid understanding of your business and its most critical processes. A business impact analysis (BIA) should be carried out to determine in a systematic way what critical aspects of your business are needed to deliver products and services into your market.

Asking these questions will help you determine the critical issue: what is the bare minimum you need to do or have in order to survive as a business? What are your alternatives if you can’t complete your usual processes as normal? It is imperative the BCP has strategies to help you to achieve that.

 

Strategies not suggestions

When providing oversight of the results of this analysis, it’s important the board notes whether a fully fleshed-out BCP emerges. Background information alone, without continuity strategies, will not carry a business through when disaster strikes.

Those charged with responsibility for crisis management should be given clearly defined actions to take to maintain effective delivery of critical products and services if a negative scenario plays out. Crystallise the decisions that need to be made — and by whom.

 

Test and update

Once a plan is agreed upon it’s important to test it with case scenarios, discussing actions the company would take at different stages of the scenarios, guided by the strategies set out in the BCPs.

While this time may seem unprecedented, it doesn’t mean that the risks were unavoidable, nor that a resilient response indicates readiness to handle other large-scale threats. Consider this moment a reminder that the most unlikely events can have an enormous impact. Comprehensive planning ensures you have strategies in place to mitigate both these, and the more mundane.

 

Questions to be explored

  • Your mission and strategy — what is your organisation trying to achieve?

  • Your products, markets, money — what products and services do you deliver? Into what markets? How much money do each of those products and markets generate?

  • Your operations — what processes enable their delivery? What could happen to the processes to stop those operations?

  • The business impact — what would happen to your business if the processes stopped?

This article first appeared in the July 2020 issue of Company Director Magazine for the Australian Institute of Company Directors (AICD).