BUSINESS SUPPORTA DISASTER? YOUCAN STILL STAYIN BUSINESSLOUISE SMAIL WONDERS WHETHER YOUR BUSINESS IS WELL PREPARED FOR UNFORESEEN DISRUPTIONIn March 2009 the Chartered Institute ofManagement, in conjunction with the CabinetOffice, produced its 10th annual survey of businesscontinuity management in the UK*. Based onresponses from 1,012 managers, the report revealeda pressing need for UK organisations to guard againstcomplacency in their attitude towards protectingthemselves from the potential disruption resultingfrom possible risks.The results showed that 52% of organisationsacross the UK practise business continuity planningand have a business continuity plan (BCP). This is thehighest level the survey has ever recorded. However,a less positive finding was that only 64% of managersthought that business continuity ranked as ‘important’within their organisation – down from 76% theprevious year.This is a dangerous trend. Survey respondents sawelectronic attack (58%) and human disease (57%) asbeing the two greatest causes for concern. Indeed thecurrent threat of swine flu has made someorganisations look at their arrangements for carryingon – if and when it strikes their workforce – and,fortunately for them, there is now a lot of informationavailable on the subject (see, for instance ‘YourBusiness and Swine Flu’ at www.businesslink.org.uk).However, businesses often concentrate on such typesof disruption – the ones they think they will experience –at the risk of completely failing to anticipate others.They need to be prepared for all sorts of possibleincidents. Yet general disaster-readiness is what businesscontinuity planning is all about.PREPARE FOR EVERYTHINGA BCP is not about planning for specific events:disasters, whether major or minor, rarely happenat the time and in the form you expect. It is aboutlooking at how robust your business is to some formof interruption or other. There are many toolkits andchecklists available, to help you create and reviewyour business continuity – just one example beingthe toolkit available to download from the LondonPrepared website (www.londonprepared.gov.uk/18businesscontinuity). This will take you through the keyelements of a BCP – a good starting place if you haveeither a plan overdue for review, or a set of variousrecovery and continuity strategies that are not yet coordinatedas a business continuity plan.Basically, there are five key steps in creating aneffective BCP:■ understanding your business;■ developing your plan;■ testing and establishing the plan;■ training staff;■ maintaining and reviewing your plan.Following any type of disaster, the media will beinterested in how an organisation is coping with theproblem, through to whether the media perceivethat the problem may have started with yourorganisation. They will demand instant informationand details, and interviews with experts and survivors.By understanding the media’s needs, preparing aproper strategy in association with them and testing itduring exercises, the organisation’s chances of beingaccurately portrayed are greatly increased. As part ofthe plan it is worth considering how the organisationwill deal with the media – either through onedepartment or maybe through an outside agency.* A Decade of Living Dangerously: The BusinessContinuity Management Report 2009, downloadableat www.managers.org.uknovember/december 2010 <strong>londonaccountant</strong>
BUSINESS SUPPORTWHAT IS BUSINESS CONTINUITY PLANNING ANDWHY IS IT IMPORTANT?Business continuity planning – also known as business continuity management, catastrophe planning andcrisis planning – involves understanding the risks to the everyday running of a business or organisation andplanning other ways of working if a risk actually becomes a reality.Being able to get your organisation up and running quickly after an incident makes you more likely to beable to provide employment, meet customer needs and, ultimately, generate profit.The type of ‘incident’ that could significantly hamper the smooth running of a business ranges in type andscale, some examples being:■ disrupted supply from a utility service;■ bankruptcy or defection of a key customer or supplier;■ interruption to IT services;■ flooding;■ fire;■ an act of terrorism.BEWARE THE MANCHESTER BOMB RESPONSE...It would seem common sense to plan for unexpected disruptions, but by no means everyone does – evenafter having seen such a disaster at close hand. Take the example of the Manchester bomb incident in 1996.On 15 June that year a bomb was detonated in the city centre. The estimated loss of business was £5m forthe first day alone. Of the 435 businesses that were severely disrupted, more than half – 250 – went out ofbusiness within the next six months.Yet in an annual business survey carried out by Manchester City Council in June 2007, 40% of the 683respondents had never even heard of business continuity, and only 19% had put business continuity plans inplace and tested them.…INSTEAD, OBSERVE SCOGGINS’ LAWFurther reading and helpThe <strong>ICAEW</strong> has compiled a list offurther reading on businesscontinuity planning, which isavailable on the <strong>ICAEW</strong> websiteat www.icaew.comThe Emergency PlanningCollege, which is part of the CivilContingencies Secretariat, runscourses on risk assessment andbusiness continuity management.www.epcollege.gov.ukFor practical help, the CivilContingencies Secretariat hasdeveloped, in partnership withstakeholders, a BusinessContinuity Management Toolkitto help organisations implementBCM. www.direct.gov.uk/prod_consum_dg/groups/dg_digitalassets/@dg/@en/documents/digitalasset/dg_176447.pdfThe DirectGov website alsoprovides a range of informationon business continuity forbusinesses and for voluntaryorganisations.Where is help available?Many councils run businesscontinuity forums which provideguidance and advice tobusinesses.And even those who do have a plan cannot rest on their laurels; they need to be assiduous in ensuring andmonitoring its effectiveness.Mark Scoggins, a solicitor advocate who has been involved in a number of high-profile disaster cases, hasformulated a set of questions to be asked about emergency plans when a disaster happens. These questions –known as Scoggins’ Law – are equally useful for managers to apply about an organisation’s business continuityplan, and can be paraphrased as follows:■ Do you understand your business risks?■ Do you have a plan? And if so, is it up to date?■ Do people know about the plan and what it means for them, and was it supported by appropriatecommunication, training and exercising (ie, is it embedded)?■ Will it work (ie, has it been tested)?SOME KEY BCP POINTS TO REMEMBER■ Avoid using a scenario to create a plan – these are only really useful for testing plans.■ If you use consultants to assist, make sure that they are not just selling a product, but really are able to lookat the business as a whole – remember, you know your business better than they do.■ Try to make business continuity part of your normal business and not just a reaction to something in thenews.■ Business continuity should be business-driven, not just driven by IT.The business continuity plan should be concise and easily accessed – don’t only have one copy in theburning building!Louise Smail works for theconsultancy Ortalan, where shespecialises in business riskevaluation.Louise.smail@ortalan.com<strong>londonaccountant</strong> november/december 201019