An effective business continuity plan gives an organisation the best possible chance recovering from an incident, maintaining their operations, maintaining their market share and maintaining their ability to deliver to their customers.
Qantas is a good example of a company which responded quickly and adaptively to the COVID-19 crisis.
Those organisations which were unprepared, with inadequate or out-of-date business continuity plans or none at all, were hit by the COVID-19 crisis much worse than their peers with robust and effective risk management practices, says Paul May, operations engineering manager at specialist property insurer FM Global Australia.
By contrast, Qantas is a good example of business continuity planning. When the coronavirus pandemic struck, the airline quickly stood down 20,000 staff and slashed its airline routes to control costs.
Importantly, it also had a strong balance sheet which allowed it to draw on cash reserves to help see it through the ongoing crisis.
May says a business continuity plan is only effective if it is updated and practised regularly. Many organisations have business plans which consider half a dozen or so specific scenarios, which it does so very robustly.
“But then when the wheels all fall off and we’ve got a global pandemic, they go, ‘hang on a minute. This 450-page business continuity plan is not really fit for us. It’s not really adding value to our organisation’,” he says.
Importantly, risk management plans have to be flexible and agile, because not all risks can be accurately predicted.
“I take my hat off to every risk manager because their job in many ways is to predict the unpredictable. There are so many risks out there that there needs to be an ability to prioritise what is the most likely risk that could befall a company,” May says.
Organisations need to take a systematic approach to business continuity planning and risk management. There is usually a cost involved in risk mitigation, so risks need to be ranked and categorised.
FM Global puts data and analytics at the centre of its approach to helping organisations with their risk management and assembles the annual FM Global Resilience Index, which compares risk factors in 130 different countries.
A business might have 50 different locations that are subject to fire risk. But engineering knowhow and predictive analytics can help identify the specific risk at each location. Additionally, it can help identify which specific pieces of equipment are most subject to fire risk.
“We’re finding that that is really powerful as it can help risk managers get a bit more focus in terms of we only actually have a limited resource of what we should tackle first and what is the highest priority,” May says.
“The lesson from every organisation it’s really highlighted is the importance of effective risk management and the need to have inbuilt resilience within their organisation.”
The global pandemic has raised the profile of risk management and the importance of investing to make a business as resilient as possible and May says the next step for organisations is to give risk managers a seat at the executive table, because sometimes risk management has been an afterthought.
“What’s most critical is getting the board, the executive C-suite members really on board with that message of business continuity, business resiliency. And only when you have that, really you have a better than average chance of a successful outcome,” he says.
Risk mitigation has often been seen by executives as a cost, with companies asking if they can afford it, but May argues it should be considered an investment.
“I think the pandemic has really flipped that on its head. Boards are now asking the question can we afford not to do this? Because I think just like natural disasters and pandemics, risk events are coming with increasing frequency, increasing severity.”
Kai Riemer, professor of information technology and organisation at the University of Sydney Business School, warns businesses against resuming what he calls the cycle of neglect and panic.
This is when businesses are unprepared for a crisis, then when it hits they scramble to get through it and once it’s passed and business has returned to normal, they forget about risk management and don’t take the opportunity to focus on business continuity planning and develop an effective business continuity plan.
“What businesses need to do is they need to stay with the crisis – even though everyone wants to go back to normal – and do business continuity planning and contingency planning and risk assessment for when the next crisis comes,” he says.
There is currently a window of opportunity for organisations to improve their business continuity plans, but as things get back to normal that will close.
“It’s really hard to make that mental and actual budget commitment to doing business continuity planning, because if you push it out and say we can always do business continuity tomorrow, then awareness will basically fade away and then we’re going back to panic and neglect next time,” he says.
This article first appeared in The Australian Financial Review