Risk management
Risk management

Start this free course now. Just create an account and sign in. Enrol and complete the course for a free statement of participation or digital badge if available.

Free course

Risk management

1 Business continuity and crisis management

Business continuity (BC) is a systematic way of managing potential or actual disruption in order to promote the long-term health, viability and reputation of the business. Business continuity and crisis management professionals support businesses in ensuring business continuity plans are in place, ensuring the plans are robust and well thought through and testing or exercising those plans to ensure that they will work. Some business continuity managers are also involved in supporting the business in responding to incidents.

Download this video clip.Video player: Video 1 A BC expert on what BC is
Skip transcript: Video 1 A BC expert on what BC is

Transcript: Video 1 A BC expert on what BC is

SPEAKER 1
Some time we all see in the news about fire into a factory or maybe a flood or maybe an earthquake into a factory. And what you don't want to happen is that, when those things occur, you don't know what to do.
With a business continuity, I got my plans. If that occur after I envisage after I did, I had talked about some of those event that could occur. And I've got mitigation plans to manage it, to address it, in a very, very professional manner and avoid unnecessary running around without having any plan to work to.
SPEAKER 2
So it's important because it makes us think about what our key processes are and how we might tackle losing those processes, what our alternatives might be, which would hurt us the most.
So it drives us to think- the process drives us to think about that, how we can assess those impacts and manage the situation within the sort of constraints of our budget and resources.
SPEAKER 3
I want to ensure that my customers are happy, my customer get their bit and their component and their engines when required at the right time, at the right date as well.
End transcript: Video 1 A BC expert on what BC is
Video 1 A BC expert on what BC is
Interactive feature not available in single page view (see it in standard view).

In its simplest form, business continuity is about:

  • understanding how your business works and what is required for it to operate (e.g. how it is structured, who its customers are, etc.)
  • being aware of the internal and external risks that your business faces and understanding whether these can be reduced (e.g. through contingency arrangements, etc.)
  • being aware of what the main processes within your business are, what would happen if you lost any of them and which ones would be absolutely critical to making your business operate effectively (e.g. without your delivery vehicle for a day, you won’t be able to ship to your customers)
  • having plans to recover your critical process in the event of disruption or complete loss
  • having a response plan in place so that your business can respond quickly and consistently to any incident (including out of normal working hours).

Business continuity is important to a business because, if done well, it can add value by:

  • building a better understanding of your business – in undertaking business continuity planning and exercises you will often be surprised by what you don’t know or assumed you knew
  • building customer trust and confidence in you
  • promoting teamwork amongst your employees and external parties on whom you are dependent.
Download this video clip.Video player: Video 2 Using business continuity in business
Skip transcript: Video 2 Using business continuity in business

Transcript: Video 2 Using business continuity in business

SPEAKER
I'm often asked, what is business continuity? Well, sometimes I think people make this quite complex- in fact, in some cases, too complex. So business continuity for me is a really, really simple thing. It's about any organisation- small organisation, medium, large organisation- managing itself or being able to manage itself through any period of disruption.
Another way which I also invite people to look at business continuity is to break the term down into two parts. So business- why is that important? Well, we're not necessarily talking about a business as in a private sector business, although clearly that's important. What I think we mean by business there is what is it that you actually do. Why are you an organisation, an entity, a business, a group of people? What are your key outcomes that you are looking to achieve?
And people then look at me and they say, well, that's quite obvious, isn't it? And the challenge that I always put back to them is, well, maybe go away and have a think about that. Because actually, people think they know everything about their business. But really, until they start looking at it in a bit more detail, they begin to realise that there's a lot more to their business than at first meets the eye. There are people that they don't know about. There are systems. There are processes. There are locations. There are external challenges that they're not aware of or they weren't aware of before. So business continuity is about understanding a lot more about your business or organisation.
Continuity- what do we mean by continuity? Continuity is talking about, OK, when we know a little bit more about our business, we're probably going to know a little bit more about the risks that our business faces or our organisation faces. It's then about saying, OK, fine. If any of those things were to happen, what would we do- if, for example, there was a fire, a flood, a power cut, a cyber attack? And you can probably think of a whole host of different things as well that potentially might affect your organisation.
What would you do if they were about to happen or indeed had happened? How would you manage that? What processes would you follow? What would you do if you couldn't get into your building? What would you do if one of your external suppliers, for example, could no longer deliver those items to your business that are so fundamental?
What would you do if you had stakeholders who were getting ready to have a meeting with you, and suddenly your meeting is cancelled? How would you deal with that- how would you communicate that? So there's something there about the continuity piece, about how would you manage your business through a period of disruption.
If anyone were to ask me from experience what is the best way other than actually dealing with an incident that business continuity can be brought to life, I would say absolutely exercises. Exercises are a really good way to bring teams together, a really good way to raise profile of risks, and a really good way to give people that real sense of what an incident might feel like. Because there are some quite interesting and unique pressures that you can face sometimes in incidents. So my advice to people with business continuity is exercise, exercise, exercise.
I'm also asked about top tips for anyone who's actually dealing with an incident, because it can be a fairly unique and sometimes scary environment. So my advice to anybody going into a business continuity incident is there is a temptation to rush in. Don't do that.
If you've got the opportunity, take a few moments, step back, and ask yourself, I guess, fundamentally, three questions. What's happened, what's happening, and what's about to happen? When you've answered those three questions, you'll be well on your way to coming up with what I think will be a very workable way to manage yourself through a period of disruption.

End transcript: Video 2 Using business continuity in business
Video 2 Using business continuity in business
Interactive feature not available in single page view (see it in standard view).

An important part of business continuity is ensuring that plans will work. Thankfully extreme real-life incidents are often few and far between so it is not often that a business continuity manager can assess their plans against real-life information. To overcome this difficulty, business continuity managers rely upon exercises to come as close as possible to real-world testing without an incident occurring. Undertaking business continuity exercises are a great way of bringing business continuity to life. The benefits of a business continuity exercise are:

  • it raises awareness of your business continuity plan
  • it raises awareness of key roles in your business continuity plan
  • it builds confidence in tackling incidents
  • it promotes close team-working
  • it allows you to test approaches and make mistakes in a safe learning environment
  • it allows you to learn lessons and make changes to your business continuity plans so that they are up to date
  • it can be tailored to suit your required level of complexity and time available to run it (a simple business continuity exercise can be run in less than an hour).

Activity 1 Putting business continuity management into practice

Timing: Allow approximately 20 minutes

Lion Down is a textiles machining company based in Birmingham in the West Midlands region of the UK. Imagine you’re the business continuity manager at Lion Down. Read the information below and consider the questions asked.

Key company information is as follows:

  • 100 employees (70 of whom are skilled sewing machine operators or product finishers; 20 are supervisors, managers or back-office support; 10 are in the sales and purchasing function).
  • The site runs a 6-day week, 8am – 6pm.
  • Contracts are mainly full-time and salaried. Twenty of the skilled sewing machine operators are contract staff who are brought in based on demand.
  • The sales and purchasing team are located remotely and travel to Asia and sub-Saharan Africa is common for them.
  • Production is centred on a single site in Birmingham, close to the M42 and M6 motorways and Birmingham International Airport. The site was constructed in 1928 and has undergone a number of additional upgrades. There are a number of industrial manufacturers located in the vicinity and the site’s immediate neighbour is Board Stiff, a cardboard and plastic recycling plant.
  • Trade union membership is common across the workforce with the General Workers Union being the main representative body.
  • Lion Down’s main customers are suppliers of fine bed linen to major UK high-street retailers. A plan to market finished product directly via an online retail partner was shelved before the start of the current trading year.
  • Finished goods are shipped by an outsourced logistics provider, Hev-E-Lift. This is the third logistics provider that the company has used in the last five years.
  • The company has a web page and its own presence on Facebook and Twitter. Each of these are maintained by Lee Valone, who looks after all the company’s IT systems (including the accounts management and shipping systems). Lee has only been at the company for six months and this is the fifth place he’s worked in the last three years.

What are the biggest risks that your business faces and how does it manage them?

To use this interactive functionality a free OU account is required. Sign in or register.
Interactive feature not available in single page view (see it in standard view).

Discussion

For Lion Down:

  • Facility/equipment. The age of the building at our main site gives us some concern. At a recent management meeting, our Health & Safety lead raised a number of concerns regarding risk to the integrity of the roof, the electrical supply and the possible presence of asbestos in some areas. We plan to commission an external provider to carry out a full property survey in order to indicate the necessary works required to keep the site operating. Having a single site causes us some concern, so we are looking at entering a mutual agreement with Rag Trade Limited to move production in the short term in the event of catastrophic loss.
  • People. We need to guarantee a minimum staffing level to meet demand and this varies considerably. To meet demand, we need to communicate effectively with our agency staff provider to ensure that we have the right people with the right skills to do the job. We also need to build and maintain a good working relationship with our trade union rep to ensure that salaried staff do not feel undermined by agency staff (time lost through industrial disputes is currently at an all-time low). Our risk register tells us that our biggest people risk is a pandemic and we have to think about not only how we manage staff absence at our main site, but we also need to think about how our sales and purchasing team’s ability to travel may be affected.
  • Systems/documents. We are concerned that we only have one person as out IT expert. This has been flagged as a single point of failure and we are looking to bring in a part-time contractor to work with Lee Valone. Our back-office team keeps a risk register and from this carries out a simple Business Impact Analysis to look at the ‘what-if’ scenarios that might affect us.
  • Logistics. We are monitoring our logistics contract, given the fact that we have had a number of providers in a short space of time. Our Operations Director has been tasked with scoping whether we can move to a multi-provider contract to spread the risk.

Where is your Business Continuity Plan located and how does it work?

To use this interactive functionality a free OU account is required. Sign in or register.
Interactive feature not available in single page view (see it in standard view).

Discussion

For Lion Down:

  • Facility/equipment. In addition to a map of the site, the BCP contains a full inventory of key machinery and resources (along with 24 hour contacts for relevant providers) that are required to restore business operations. Restoration of business operations is covered by a separate and distinct ‘Recovery’ checklist in the BCP and any recovery operation is led by a designated member of the Incident Management Team.
  • People. The HR Director leads on all people-related issues once the BCP is activated. To support this activity, the HR Director can access the online employee database and payroll records (each is backed up automatically every 12 hours and access can also be gained via the cloud). The HR Director meets with the General Workers Union rep every quarter, part of which includes a discussion on BCP activation and access to employee data.
  • Systems/documents. The BCP is a simple document that contains:
    • a.A crisis response checklist.
    • b.the composition of the Incident Management Team (IMT) – including deputies for each role and a template IMT meeting agenda
    • c.a role map for each IMT role, outlining key crisis responsibilities
    • d.a list of key contacts (staff, agencies, utility providers)
    • e.a map of the site
    • f.a copy of the BIA with key actions and considerations listed against our main risks
    • g.a recovery checklist.

    Our BCP is located in a fire-proof cabinet in the main office, with a duplicate in the Operations Director’s office. There is an electronic copy on the company’s shared drive and on three encrypted memory sticks that are held with senior management. We are also about to move to a new cloud-based IT operating system that allows anyone with a role in the BCP to be able to access the plan via any work or personal device with internet access.

  • Logistics. Contact with Hev-E-Lift is part of the immediate Crisis Response checklist and it is part of the agreed logistics contract for contact to be made at any time, 24/7, to Hev-E-Lift’s Regional Operations Centre in Dudley, West Midlands. If required, Hev-E-Lift’s duty Operations Manager can dial into the IMT. During partial or total loss of the facility, any stock in transit can be held at a Hev-E-Lift depot initially for up to 72 hours at no additional cost to Lion Down.

When was your Business Continuity Plan last exercised and what were the main lessons that were learned from this?

To use this interactive functionality a free OU account is required. Sign in or register.
Interactive feature not available in single page view (see it in standard view).

Discussion

For Lion Down:

The recycling plant is recognised as a potentially significant fire risk and an incident on their site would probably limit or cease access to our main site and bring production to a standstill. For this reason, three months ago we conducted a joint exercise with Board Stiff; this followed a genuine incident at the recycling plant, where a small fire took hold in its packing plant.

The exercise consisted of a no-notice activation of the IMT, with representation from Board Stiff and Hev-E-Lift, both of which agreed to have their respective Operations Managers dial-in to the meeting. Key lessons identified from the exercise were:

  • Facility/equipment. A question was raised about whether the dye process line should be shut down completely in the event of a full evacuation. A concern was raised about the possible overheating of a key component if left unattended for a protracted period (which could then lead to a further fire risk). The Director of Operations took an action to liaise with the Fire Engineer and the local Fire & Rescue Service to determine whether a ‘double-knock’ capability should be built in to the fire alarm to allow confirmation of a genuine incident before evacuating and shutting down the dye process line. The Health & Safety Officer also added that a capital investment scheme to retrofit sprinklers to the main site should now be re-visited.
  • People. The IMT was mobilised successfully within 15 minutes of initial notification and the meeting was chaired by the Chief Executive, Ed Spread. There was some discussion about whether the main site should have been evacuated by activation of the fire alarm if this incident had happened for real. The general view was that the Fire Marshal should be alerted as soon as possible in the event of a fire at Board Stiff and a decision should then be taken whether to keep all staff indoors or evacuate them. It was noted that depending on wind direction, the advice from the emergency services may well be to stay indoors, close all windows and monitor local radio and/or social media for regular updates from the emergency services.
  • Systems/documents. All IMT members gained access to the BCP the shared drive. As part of the exercise, anyone in possession of an encrypted memory stick containing a back-up copy of the BCP was required to print it out. This highlighted that the BCPs on the stick were an earlier version (Version 2.0), whereas the current and up-to-date version is Version 3.0. A lesson was identified for all BCPs to be at Version 3.0 with immediate effect and for version control to be checked and confirmed every quarter by the Operations Director.
  • Logistics. In accordance with the crisis response checklist, the IMT attempted to make contact with Hev-E-Lift’s Duty Operations Manager at the Regional Operations Centre. Two calls were made and on each occasion the number was unobtainable. Contact was then made using a mobile number provided by the Exercise Director. An urgent action was agreed to confirm the correct emergency contact number with Hev-E-Lift and to ensure that this number was checked as part of the quarterly BCP version control check by the Operations Director.
RM_1

Take your learning further371

Making the decision to study can be a big step, which is why you'll want a trusted University. The Open University has 50 years’ experience delivering flexible learning and 170,000 students are studying with us right now. Take a look at all Open University courses372.

If you are new to university level study, we offer two introductory routes to our qualifications. Find out Where to take your learning next?373 You could either choose to start with an Access courses374or an open box module, which allows you to count your previous learning towards an Open University qualification.

Not ready for University study then browse over 1000 free courses on OpenLearn375 and sign up to our newsletter376 to hear about new free courses as they are released.

Every year, thousands of students decide to study with The Open University. With over 120 qualifications, we’ve got the right course for you.

Request an Open University prospectus371