Interest in business continuity management is growing as customers, shareholders, regulators and insurers seek greater assurance about the organizations they are dealing with. More important than a plan is getting it right.
Given the current global economic downturn, organizations are looking for much greater assurance from their risk management and compliance functions to determine whether they could survive any major disruption in their supply chains or their customer base. This drive for reassurance is focusing minds on business continuity management (BCM).
Recent research backs this up. Insurance broker Marsh's European BCM benchmarking report, "The Upside to Business Continuity", published last year found that there is now almost a unanimous acceptance of the necessity of BCM in Europe. Most firms view it as good practice to manage their overall operational risk management challenges.
It is perhaps not surprising that concerns over the present financial climate are driving more businesses to reassess whether their existing BCM plans are robust and current enough to deal with the latest risks facing their businesses. Others that do not already have a plan are considering implementing one. Lee Glendon, campaigns manager at the Business Continuity Institute, a professional membership body, says that organizations are also raising questions about the capabilities of their suppliers' contingency plans.
"Companies have woken up to the fact that their business could fail due to the poor governance, financial management or lack of a robust business continuity plan in their own organizations, their supply chain or their customer chain. As a result, they are revisiting and reworking their own BCM plans, as well as asking more questions about the plans that their suppliers and customers have," he says.
When best practice isn't
Experts warn that risk managers need to carefully consider how they approach defining their BCM plans. Dennis Murphy, Head of Consulting Engineers Europe at Allianz Global Corporate & Specialty (AGCS), says that most businesses give assurances to regulators, shareholders, customers and suppliers that they have a BCM plan in place, but that a large number of these plans are either untested or unsuitable.
"If you ask any company whether it has a BCM plan, they will always say that they have. But when you dig deeper, you find that these plans are either based on complying with best practice standards, or are simply lifted from other organizations. As a result, these plans are not robust enough to adequately deal with any kind of major business interruption," says Murphy.
Murphy's observations are borne out by independent research. According to the UK's Chartered Management Institute's (CMI) Business Continuity Management 2008 report, the adoption of BCM plans has largely remained static over the past decade, despite the fact that most managers appreciate their importance. The report found that only 47% of managers had reported that their company had a specific business continuity plan, despite the fact that 76% reported that continuity is regarded as important in their organization. Furthermore, of those that had invoked their plans, 94% agreed that they had reduced disruption.
The CMI survey also found that just under half of organizations with business continuity plans carry out regular and thorough rehearsals/exercises, despite strong evidence that rehearsals are vital to ensure the effectiveness of planning. Around four out of five (78%) of those who had exercised their plans said that they had revealed shortcomings in the plan.
A living document
According to Murphy, for a business continuity plan to work, organizations need to consider a number of issues. Firstly, he says, organizations should look at the markets they are working in: for example, if the company works in manufacturing, it will need to consider where it sources its materials, how dependent it is on them, and how easily it could source from elsewhere should a supplier go out of business or raise its prices – a priority in the current economic climate.
Secondly, organizations need to know whether their customers will remain loyal if a disruption to the business occurs. Murphy points out that around 80% of firms hit by a major disaster go out of business, and that many of those that do recover never recover their previous stature. "If you lose a customer through business interruption, there's no guarantee that you'll get them back. You can replace your buildings and your hardware, but it is less easy to rebuild your reputation. For example, if you are supplying a customer with thousands of products a week, a week's disruption could effectively end the contract if the customer has to find a replacement supplier," he says.
In order to retain customer confidence and trust, Murphy says that a good and effective continuity plan should be seen as a "living document" that is regularly updated, tested and approved by management. "Too often, business continuity plans are left to one person in the organization to champion, which simply isn't good enough. Boards and senior managers need to take the lead, but all employees need to be aware of the plan, its importance, and take ownership of it," he says.