Forewarned is forearmed

The Business Continuity Institute has been campaigning hard to raise awareness of the need for European organisations to deploy disaster recovery solutions. But have companies been listening? CXO meets Lyndon Bird, International and Technical Director at the BCI, to find out.

“Despite the best part of 20 years spent promoting ideas of business continuity, no more than about 50 percent of organisations have taken our advice on board”
-Lyndon Bird

How can business contingency management increase business resilience and drive better performance within organisations?
Lyndon Bird. The main purpose of business continuity is to improve the resilience of organisations. So that in the event of any interruptions that they may have to any of their key business processes, they minimise their outage time, and, therefore, manage to continue to operate with much less loss. It’s about looking at your organisation to see how it’s structured, to make sure that you organise your business in a way that you can actually deal with crises and incidents – disasters, or even small-scale problems – in a way that doesn’t actually affect your top line or your bottom line significantly. One of the spin-offs of business continuity is the fact that in order to structure your business properly for resilience you have to look at the way that you have set up many aspects of your business. And you will often find, in doing that analysis, that you can improve performance significantly, through better organisation, better technology, more efficient ways of doing things, and just having the opportunity to look at dependencies and criticalities and priorities in your business.

Do you think enough companies have implemented business continuity plans?
LB. Most companies will have done something in terms of dealing with the possibility of things going wrong. I think it would be insulting and ridiculous to say people don’t think through the fact that certain things could go wrong. But a lot of companies do this from a slightly wrong viewpoint. Many of them approach things from the point of view of looking at specific threats such bad weather or an industrial accident. They see all of these things as individual issues. What we say is look at the key things that you need to deliver, and then work back to what could affect that. Research shows that in the UK, despite the best part of 20 years spent promoting ideas of business continuity, no more than about 50 percent of organisations have taken our advice on board. And many of the surveys tend to suggest that this flattens out, and that the main growth now, in terms of business continuity uptake, is coming from the public sector, rather than the private sector.

A recent report from the BCI states that companies are dealing with at least five disruptive events every year. What types of events are these, in your experience?
LB. Most people who know a little bit about business continuity think it applies only to the very large disruptions – the catastrophe, the big fire, the terrorist attack. These things are not likely to happen to most companies at all. Or if they do, it would be a once in a lifetime type of incident. The reality is, of course, that if you look at the way business operates, it is constantly having interruptions. My theory about this is that if you were looking at business, say 20 or 30 years ago, they could cope with much more interruption before it started to hit their ability to deliver their products or services. The whole speed now with which we run businesses because of the internet means that the time isn’t there. So rather than just the big incident, anything, really, which could create a problem if it interrupted a key function, could be treated as a businesses continuity issue. So it could be the small fire. It could be the small power outage. It could be just having insufficient staff to do certain things on a particular day. It could be bad weather. If you actually look just at the UK over the last 14 months, we started with G-20 type concerns, about how that was going to affect businesses. Could people get to work? Would companies fail to operate with the protests? We went through a pandemic. We had a series of bad weather, two years running. Then there was a BA strike. And certainly there is the potential in the future for considerable industrial action, as the economy probably is going to be tightened by whoever wins the next election. So business continuity is no longer just for dealing with the big fire or the big terrorist attack or that type of thing. It’s for dealing with anything that creates an interruption to your business, beyond that which you can cope with.

You mentioned crisis management as well. How is that a problem?
LB. I think crisis management is about two things. It’s having access to the information that you need, to be able to make decisions. And that isn’t necessarily about following a detailed plan. Because with most incidents, you don’t know where you are. You don’t know the extent of the damage, at the point that management has to make decisions. You don’t necessarily have the ability, even, to get together and look at things and discuss things. That is where the old-fashioned ways of crisis management fall down. Because the old-fashioned way is to get everyone together in a room, get the flip board out and decide what to do. In the modern day, you’ve got to be quicker than that. You’ve got to use the internet. You’ve got to use chatrooms. You’ve got to use videoconferencing. You’ve got to use whatever technology you can to be able to share information and get those decisions quicker.

What do you think are going to be the ongoing trends, in terms of the kinds of systems people can put in place?
LB. Clearly, resilience does work better if you haven’t got all your eggs in one basket, so certain technological developments in the IT world will add additional resilience to organisations’ capability to cope with an interruption to operations. Cloud computing, servers, virtualisation and home working are all technologies that switch the emphasis in business continuity from a technical recovery to a management issue. People can now work from different locations without significant issues, which means many of the traditional technical problems created by the loss of computers and traditional data can be resolved. And they are being resolved quite quickly. Another big technology trend is outsourcing and off-shoring, which are fine from a business efficiency point of view. But they’ve got to be built into your business continuity programmes. Just because somebody else is doing something for you, doesn’t mean that if it fails, it makes any difference to you. Problems remain in two other areas: crisis management and people. Unless you have a completely automated business, where people don’t have to do anything other than press a button, then you’re going to have to have a workforce to manage. You’ve got to be able to manage and motivate people and prepare how to deal with them, post-incident. There are so many HR issues in business continuity just as there are so many supply-chain related incidents – things that are outside of your direct control, but will impact your ability to cope.