A stich in time....
Prof Jim Norton says the process of developing a business continuity plan is seen by many SMEs as too complicated and involving excessive costs and management time. The reality is that, for many SMEs, a good plan can make the difference between successfully overcoming a few days disruption and shutting forever
A stitch in time…
In an increasingly interconnected and interdependent world, the list of potential sources of disruption to organisations is long:
· severe weather – storms, flooding, or extremes of temperature;
· disease – such as pandemic flu or foot & mouth;
· industrial action – to disrupt fuel and energy supply chains;
· major accidents – such as the Buncefield Oil Depot explosion; or
· terrorism against people or critical national infrastructure
Any or all can have a major impact on an individual organisation. Against this backdrop, how good is the quality of thinking and preparation – so-called business continuity planning (BCP) – particularly in the many thousands of small and medium enterprises (SMEs) across the UK that are vital to our economy? While 100 per cent security is an illusion, some simple contingency planning can bring real benefits if trouble does strike…
Too little – too late
Sadly, the process of developing a BCP is seen by many SMEs as too complicated and involving excessive costs and management time. According to research by the Chartered Management Institute (CMI) for the UK Cabinet Office , 'the number of organisations that have adopted BCM remains broadly static [since 2001]: [only] 47 per cent of managers report that their organisation has a specific business continuity plan'. The smaller the organisation, the less likely it is to have formulated a plan. According to the CMI, only 33 per cent of smaller organisations have a BCP. Similar research from the Institute of Directors (IoD) among its SME members (to whom guidance has been given on the importance of continuity planning) revealed that still only 57 per cent of organisations employing 25 people or less had a BCP. Even for those with a plan, the CMI research suggests that less than half carry out regular tests or rehearsals. Only one third are aware of the useful guidance available from Local Authorities and Local Resilience Forums.
Great plan – shame about the assumptions…
Even where planning has been done, it may rest on false assumptions. New research carried out by the IoD suggests fundamental misapprehensions regarding the interdependence of different areas of critical infrastructure. 85 per cent of IoD members are confident that their mobile phone service would be unaffected by a region-wide power cut lasting at least twelve hours. The Cabinet Office guidance on this in the recently published National Risk Register suggests that mobile service would fail after only one hour (and for many it could be much quicker). Conversely, only 46 per cent thought that their fixed line telecommunications service would continue to be available. In reality, fixed line services traditionally have much more comprehensive battery and generator backup. Thus, fundamentally wrong assumptions about which communications services to depend on may be being built into BCPs. Other misapprehensions highlighted in the IoD research include:
· 10 per cent of respondents indicate that the organisational impact of loss of electrical power for 24 hours during the working week would be 'minimal'
· 20 per cent of respondents indicate that the organisational impact of loss of water supply for 24hrs during the working week would be 'minimal'; and
· less than 15 per cent of respondents indicate that the loss of sewage removal for 24hrs during the working week would mean closure for the duration of the outage.
The interdependency between electrical power, water supply and sewage removal is also poorly understood. Cabinet Office guidance is that water supply and sewage removal will start to fail six hours after regional power failure. However, over 60 per cent of IoD respondents believed that water and sewage removal would be unaffected by a 12 hour power failure.
Creating markets in resilience
It is essential to overcome the information failures that exist today about organisations' external dependencies up and down the supply chain. The misconceptions about the impact of infrastructure loss and the interdependencies between different areas of Critical National Infrastructure (CNI) are deep-seated. Customers need to understand how to ask the right questions about the resilience of their suppliers. Infrastructure providers need to offer a range of different levels of resilience alongside a range of different service costs. For many this might open up whole new areas of profitable premium service, yet still save money overall for their customers – a clear win-win situation. Given the critical importance of communications, and the ubiquity of mobile phones, a more resilient mobile communications service would seem to be a 'no brainer'. Such a service might offer resilience against defined durations of power loss (say 24 hours) and overload (think 7/7) to a subset of customers prepared to pay a premium rental.
It is strongly recommended that organisations carry out realistic risk assessments of the likelihood and impact on their operations of various levels and durations of infrastructure or other failures, and plan for their mitigation. Indeed, this is a mandatory requirement for compliance with the British Standard on Business Continuity BS25999 . There is plenty of good advice freely available. One element of compliance with BS25999 is to ensure that your key partners up and down the supply chain also have effective business continuity plans. Increasingly, larger businesses will demand evidence of compliance from their SME trading partners.
Where there is business justification, organisations should demand the option of buying services at a range of trade-offs between resilience and cost. This will break the vicious circle of 'market failure' that characterises many of the areas of resilient service provision at present, where suppliers say that there is 'no customer demand' and so no need to offer enhanced service.
Forethought really does help…
According to the CMI, 94 per cent of those organisations that invoked their business continuity plans during the floods of Summer 2007 agreed that these had reduced the resulting disruption. Similarly, 78 per cent of those who had carried out exercises indicated that these had helped by revealing shortcomings in their existing plans. The alternative is stark: 80 per cent of businesses caught without a workable BCP are forced to close within a year of a major flood or fire. The reality is that, for many SMEs, a good BCP can make the difference between successfully overcoming a few days disruption and shutting forever.
Prof Jim Norton is a member of the ippr Commission on National Security in the 21st Century www.ippr.org/security and a Senior Policy Adviser at the Institute of Directors.
