Continuity and contingency management
Planning and contingencies for business and organisational continuity in response to serious disruption
Without wishing to be alarmist, the modern world does tend to place increasing expectations on businesses and organisations to prepare contingency plans in response to serious disruptions and emergencies.
Recent examples of major crises and emergencies that have caused massive disruption to businesses and organisations of all sorts include the Buncefield Fuel Depot Fire and the London Tube and Bus Bombings.
On a more ordinary level, most organisations are now substantially dependent on the internet. Does your organisation have a contingency plan for when the next big virus hits, or if connections are lost on a wide scale for a few hours? How does your organisation fare under extreme weather conditions – cold or hot, dry or wet? Have you checked how the football world cup might affect your staffing levels? What else could happen in the future that you could have prepared better for?
External factors of all sorts affect organisations, and with a bit of thought and planning, many of the worst risks can be anticipated and averted.
Notwithstanding the age-old government ploy that seeks to reinforce power and control by emphasising risks and threats, it makes sense for businesses and organisations – especially large organisations with systems, infrastructures, and services that are susceptible to serious interruption by emergencies and disasters – to have good solid contingency plans ready (and communicated) that will minimise disruption and enable best possible continuity when and if a major (or minor) crisis occurs that provides a real risk to your operational continuity.
The principle certainly applies in a very real sense to all businesses and organisations in anticipating and planning continuity in response to smaller less dramatic emergencies, which in truth are a lot more common and likely than the next outbreak of Mongolian Hamster Flu or an earth-landing by a delegation from the planet Zarg.
Today's world is an increasingly tightly bundled collection of highly tuned, high-capacity, and relatively vulnerable systems: everywhere you look, tolerances are fine, efficiencies are super-optimised, especially in systems of communications and transport. When a big system fell over 20 years ago, life could pretty well carry on as normal. Today we are far more vulnerable: the house of cards has evolved into a huge city, so when it falls apart it does so in a much bigger way, and it's as well to anticipate and plan for it, whatever 'it' might be.
Here's a recent research report which provides some pointers (more like questions to address) for businesses and organisations seeking to assess and improve their own continuity planning.
This report is produced by the Chartered Management Institute in association with the Civil Contingencies Secretariat at the (UK) Cabinet Office, compiled from the views of 1,150 individuals, and examines the UK's "readiness for disruption to business".
According to MCI, it shows 'UK PLC' demonstrating an 'alarming lack of readiness and an insular view of disaster'.
This 2006 Business Continuity Management Survey shows that, despite past large and recent disasters affecting UK organisations and businesses:
- less than half of UK organisations have a business continuity plan in place
- inanimate objects are still the key focus for protection, even though a business can't run without people
- employees, suppliers and stakeholders don't know what to do in the event of a disaster
The report was released to coincide with the latest element of the Civil Contingencies Act which, as of this week (of 16 May 2006), compels local authorities to give continuity advice to businesses.
UK Organisations Emergency Planning Survey (May 2006)
Many UK organisations are failing to prepare for disruption, despite evidence outlining the business benefits of disaster planning, says a survey published today by the Chartered Management Institute and supported by the Cabinet Office and Continuity Forum. The 2006 Business Continuity Management Survey highlights the significant impact of disasters at home and abroad, including a potential influenza pandemic, and uncovers worrying signs of inactivity and complacency.
The research findings, collected from 1,150 public and private sector managers, uncover a worrying gap between perception and reality.
Key findings include:
Too little action: Although a majority of managers (77 per cent) believe business continuity is viewed as important by their senior management teams, less than half (49 per cent) say their organisation has a business continuity plan (BCP) in place. Organisations are also failing to rehearse plans as often as they should - only 37 per cent of those with plans test them at least once a year, compared to 52 per cent in 2005. This is made more worrying by the fact that where rehearsals have taken place, the majority (79 per cent) have revealed shortcomings in their plans.
Possessions, not people: Inanimate objects still dominate business continuity management (IT is covered by 67 per cent of plans) despite organisations admitting a fear of losing people and skills. For example, almost all (92 per cent) believe they would suffer disruption caused by higher levels of absenteeism and illness in an influenza pandemic, yet the majority (83 per cent) do not have robust plans to cope with this absence.
Big picture ignored: Less than half (45 per cent) perceive terrorist damage or environmental incidents (42 per cent) as a major threat to business. This is despite one-third of organisations experiencing disruption after the London bombings in July 2005, 14 per cent facing problems as a result of the Buncefield oil explosion and some (9 per cent) feeling the impact of the Asian Tsunami.
Shortcomings in communication: Only 1 in 10 with plans share these with suppliers and shareholders, while just 1 in 5 communicates this information to customers – despite being cited as key drivers for creating BCPs. And only 7 per cent require all suppliers to have a BCP with one third (37 per cent) of organisations requiring only business-critical suppliers to have plans.
Jo Causon, Director, Marketing and Corporate Affairs, Chartered Management Institute, says: "We are now in the seventh year of conducting this research and it is disappointing to see that organisations still fail to manage business continuity effectively. There appears to be a mismatch between the perception of the need for business continuity and the reality of little action to prepare and plan. Unless appropriate and effective business continuity processes are thoroughly considered, organisations leave themselves wide open to a variety of threats and potential disruption."
The research suggests that managers would particularly benefit from guidance on creating a plan, case studies illustrating others' experiences and guidance on the potential disruptions they face.
The Cabinet Office websites provide valuable resources for organisations wanting this sort of advice. They also have links to the Government guidance document, 'Contingency Planning for a Possible Influenza Pandemic', to help organisations consider the risks and plan more effectively for such an eventuality.
John Sharp, Policy and Development Director, Continuity Forum says: "This research highlights the need for organisations to benchmark and assess their business continuity management processes against nationally-recognised standards and frameworks so that any readjustments can be made and potential room for error is minimised."
This article is essentially ©CMI 2006, and used with permission.
The Chartered Management Institute helps set and raise standards in management, encouraging development to improve performance. Moreover, with in-depth research and regular policy surveys of its 71,000 individual members and 450 corporate members, the Institute has a deep understanding of the key issues. The Chartered Management Institute came into being on 1 April 2002, as a result of the Institute of Management being granted a Royal Charter.
Continuity planning in context
Whether you believe that a bird-flu pandemic is a serious risk or not – and there are clearly divided opinions about this particular threat (see the 29 P's of surviving Bird Flu for the other side of the coin – warning: there is adult content on this page) - and whether you run a highly-tuned big services organisation with identified susceptibility to major disasters, or a little nursing home in a sleepy coastal town somewhere, there are some important points worth considering about continuity planning:
- Carry out some sort of review as to the threats and risks that could cause your operation serious disruption.
- Develop a plan to provide contingencies and continuity should the identified risks become a reality.
- Inform your staff, customers and suppliers of your plans and the contingencies - especially communications, power and transport issues, because these are generally the most significant areas of risk and vulnerability.
- Seek input from all interested parties and, where advantageous and sensible, modify and integrate your plans with the plans of other connecting groups and organisations.
It would seem that whatever the Government's true motives in all this, (cynics would suggest that heightening people's awareness of risk and fear has been a tactic of governing powers for centuries in maintaining power and control), there are some very sensible points within the issue, and also a couple of useful resource centres available, so use them for what good they can do for your particular organisation.
It is a dangerous world these days, but keep things in perspective. As ever, look at the facts, make your own decisions, and then take appropriate action accordingly.
Continuity planning and risk assessment are essential aspects of modern management and organisational robustness, but keep it realistic and in context for your own activities and systems.