1 Business continuity and crisis management
Business continuity (BC) is a systematic way of managing potential or actual disruption in order to promote the long-term health, viability and reputation of the business. Business continuity and crisis management professionals support businesses in ensuring business continuity plans are in place, ensuring the plans are robust and well thought through and testing or exercising those plans to ensure that they will work. Some business continuity managers are also involved in supporting the business in responding to incidents.
Transcript: Video 1 A BC expert on what BC is
In its simplest form, business continuity is about:
- understanding how your business works and what is required for it to operate (e.g. how it is structured, who its customers are, etc.)
- being aware of the internal and external risks that your business faces and understanding whether these can be reduced (e.g. through contingency arrangements, etc.)
- being aware of what the main processes within your business are, what would happen if you lost any of them and which ones would be absolutely critical to making your business operate effectively (e.g. without your delivery vehicle for a day, you won’t be able to ship to your customers)
- having plans to recover your critical process in the event of disruption or complete loss
- having a response plan in place so that your business can respond quickly and consistently to any incident (including out of normal working hours).
Business continuity is important to a business because, if done well, it can add value by:
- building a better understanding of your business – in undertaking business continuity planning and exercises you will often be surprised by what you don’t know or assumed you knew
- building customer trust and confidence in you
- promoting teamwork amongst your employees and external parties on whom you are dependent.
Transcript: Video 2 Using business continuity in business
An important part of business continuity is ensuring that plans will work. Thankfully extreme real-life incidents are often few and far between so it is not often that a business continuity manager can assess their plans against real-life information. To overcome this difficulty, business continuity managers rely upon exercises to come as close as possible to real-world testing without an incident occurring. Undertaking business continuity exercises are a great way of bringing business continuity to life. The benefits of a business continuity exercise are:
- it raises awareness of your business continuity plan
- it raises awareness of key roles in your business continuity plan
- it builds confidence in tackling incidents
- it promotes close team-working
- it allows you to test approaches and make mistakes in a safe learning environment
- it allows you to learn lessons and make changes to your business continuity plans so that they are up to date
- it can be tailored to suit your required level of complexity and time available to run it (a simple business continuity exercise can be run in less than an hour).
Activity 1 Putting business continuity management into practice
Lion Down is a textiles machining company based in Birmingham in the West Midlands region of the UK. Imagine you’re the business continuity manager at Lion Down. Read the information below and consider the questions asked.
Key company information is as follows:
- 100 employees (70 of whom are skilled sewing machine operators or product finishers; 20 are supervisors, managers or back-office support; 10 are in the sales and purchasing function).
- The site runs a 6-day week, 8am – 6pm.
- Contracts are mainly full-time and salaried. Twenty of the skilled sewing machine operators are contract staff who are brought in based on demand.
- The sales and purchasing team are located remotely and travel to Asia and sub-Saharan Africa is common for them.
- Production is centred on a single site in Birmingham, close to the M42 and M6 motorways and Birmingham International Airport. The site was constructed in 1928 and has undergone a number of additional upgrades. There are a number of industrial manufacturers located in the vicinity and the site’s immediate neighbour is Board Stiff, a cardboard and plastic recycling plant.
- Trade union membership is common across the workforce with the General Workers Union being the main representative body.
- Lion Down’s main customers are suppliers of fine bed linen to major UK high-street retailers. A plan to market finished product directly via an online retail partner was shelved before the start of the current trading year.
- Finished goods are shipped by an outsourced logistics provider, Hev-E-Lift. This is the third logistics provider that the company has used in the last five years.
- The company has a web page and its own presence on Facebook and Twitter. Each of these are maintained by Lee Valone, who looks after all the company’s IT systems (including the accounts management and shipping systems). Lee has only been at the company for six months and this is the fifth place he’s worked in the last three years.
For Lion Down:
- Facility/equipment. The age of the building at our main site gives us some concern. At a recent management meeting, our Health & Safety lead raised a number of concerns regarding risk to the integrity of the roof, the electrical supply and the possible presence of asbestos in some areas. We plan to commission an external provider to carry out a full property survey in order to indicate the necessary works required to keep the site operating. Having a single site causes us some concern, so we are looking at entering a mutual agreement with Rag Trade Limited to move production in the short term in the event of catastrophic loss.
- People. We need to guarantee a minimum staffing level to meet demand and this varies considerably. To meet demand, we need to communicate effectively with our agency staff provider to ensure that we have the right people with the right skills to do the job. We also need to build and maintain a good working relationship with our trade union rep to ensure that salaried staff do not feel undermined by agency staff (time lost through industrial disputes is currently at an all-time low). Our risk register tells us that our biggest people risk is a pandemic and we have to think about not only how we manage staff absence at our main site, but we also need to think about how our sales and purchasing team’s ability to travel may be affected.
- Systems/documents. We are concerned that we only have one person as out IT expert. This has been flagged as a single point of failure and we are looking to bring in a part-time contractor to work with Lee Valone. Our back-office team keeps a risk register and from this carries out a simple Business Impact Analysis to look at the ‘what-if’ scenarios that might affect us.
- Logistics. We are monitoring our logistics contract, given the fact that we have had a number of providers in a short space of time. Our Operations Director has been tasked with scoping whether we can move to a multi-provider contract to spread the risk.
For Lion Down:
- Facility/equipment. In addition to a map of the site, the BCP contains a full inventory of key machinery and resources (along with 24 hour contacts for relevant providers) that are required to restore business operations. Restoration of business operations is covered by a separate and distinct ‘Recovery’ checklist in the BCP and any recovery operation is led by a designated member of the Incident Management Team.
- People. The HR Director leads on all people-related issues once the BCP is activated. To support this activity, the HR Director can access the online employee database and payroll records (each is backed up automatically every 12 hours and access can also be gained via the cloud). The HR Director meets with the General Workers Union rep every quarter, part of which includes a discussion on BCP activation and access to employee data.
- Systems/documents. The BCP is a simple document that contains:
- a.A crisis response checklist.
- b.the composition of the Incident Management Team (IMT) – including deputies for each role and a template IMT meeting agenda
- c.a role map for each IMT role, outlining key crisis responsibilities
- d.a list of key contacts (staff, agencies, utility providers)
- e.a map of the site
- f.a copy of the BIA with key actions and considerations listed against our main risks
- g.a recovery checklist.
Our BCP is located in a fire-proof cabinet in the main office, with a duplicate in the Operations Director’s office. There is an electronic copy on the company’s shared drive and on three encrypted memory sticks that are held with senior management. We are also about to move to a new cloud-based IT operating system that allows anyone with a role in the BCP to be able to access the plan via any work or personal device with internet access.
- Logistics. Contact with Hev-E-Lift is part of the immediate Crisis Response checklist and it is part of the agreed logistics contract for contact to be made at any time, 24/7, to Hev-E-Lift’s Regional Operations Centre in Dudley, West Midlands. If required, Hev-E-Lift’s duty Operations Manager can dial into the IMT. During partial or total loss of the facility, any stock in transit can be held at a Hev-E-Lift depot initially for up to 72 hours at no additional cost to Lion Down.
When was your Business Continuity Plan last exercised and what were the main lessons that were learned from this?
For Lion Down:
The recycling plant is recognised as a potentially significant fire risk and an incident on their site would probably limit or cease access to our main site and bring production to a standstill. For this reason, three months ago we conducted a joint exercise with Board Stiff; this followed a genuine incident at the recycling plant, where a small fire took hold in its packing plant.
The exercise consisted of a no-notice activation of the IMT, with representation from Board Stiff and Hev-E-Lift, both of which agreed to have their respective Operations Managers dial-in to the meeting. Key lessons identified from the exercise were:
- Facility/equipment. A question was raised about whether the dye process line should be shut down completely in the event of a full evacuation. A concern was raised about the possible overheating of a key component if left unattended for a protracted period (which could then lead to a further fire risk). The Director of Operations took an action to liaise with the Fire Engineer and the local Fire & Rescue Service to determine whether a ‘double-knock’ capability should be built in to the fire alarm to allow confirmation of a genuine incident before evacuating and shutting down the dye process line. The Health & Safety Officer also added that a capital investment scheme to retrofit sprinklers to the main site should now be re-visited.
- People. The IMT was mobilised successfully within 15 minutes of initial notification and the meeting was chaired by the Chief Executive, Ed Spread. There was some discussion about whether the main site should have been evacuated by activation of the fire alarm if this incident had happened for real. The general view was that the Fire Marshal should be alerted as soon as possible in the event of a fire at Board Stiff and a decision should then be taken whether to keep all staff indoors or evacuate them. It was noted that depending on wind direction, the advice from the emergency services may well be to stay indoors, close all windows and monitor local radio and/or social media for regular updates from the emergency services.
- Systems/documents. All IMT members gained access to the BCP the shared drive. As part of the exercise, anyone in possession of an encrypted memory stick containing a back-up copy of the BCP was required to print it out. This highlighted that the BCPs on the stick were an earlier version (Version 2.0), whereas the current and up-to-date version is Version 3.0. A lesson was identified for all BCPs to be at Version 3.0 with immediate effect and for version control to be checked and confirmed every quarter by the Operations Director.
- Logistics. In accordance with the crisis response checklist, the IMT attempted to make contact with Hev-E-Lift’s Duty Operations Manager at the Regional Operations Centre. Two calls were made and on each occasion the number was unobtainable. Contact was then made using a mobile number provided by the Exercise Director. An urgent action was agreed to confirm the correct emergency contact number with Hev-E-Lift and to ensure that this number was checked as part of the quarterly BCP version control check by the Operations Director.