In good weather, the human spirit has trouble thinking about the event of a disaster. If certain major organizations have a management system integrating Risk Management and eventually Business Continuity Management, many structures remain powerless. The world pandemic linked to Covid 19 confirms this opinion. This sanitary crisis, unforeseen or considered unlikely in the risk scenarios analysis, placed almost all companies in difficulties. It already shows the importance of a more global approach in the implementation of business continuity.
A hard realization
For numerous structures, business continuity is not an issue. However, in a degraded situation where their activities would be partially or totally interrupted, a Business Continuity Planning (BCP) would help them activate organizational, technical and operational answers quickly, allowing them to keep on producing goods and services while ensuring the protection of their collaborators and of their assets.
Other companies don’t make of business continuity such a strategic issue as quality or risk management. Insofar as they have difficulties in assessing an investment’s ROI in a Business Continuity Management System (BCMS), they regard the step as a luxury. Indeed, only confrontation to a severe crisis provides proof that the losses incurred are often higher that the investment cost into safeguarding the activity.
The BCP are elaborated and formalized in the context of an implementation of a Business Continuity Management System (BCMS) whose requirements are described by the ISO 22301 Security and resilience international standard. They are specific to each company, taking into account their priorities and requirements of their businesses and activities.
BCP very focused on technical answers
Regarding the companies having a BCP, they discover, through the experience of the current pandemic, that their plan had not sufficiently anticipated two of the major impacts of this sanitary crisis:
- The physical impossibility for numerous collaborators to keep on producing, either because they have no longer access to their working place because of lockdown governmental measures, or because they have to stop working to keep their children at home, or because they are affected by the disease.
- The supply shortage of equipment critical for business continuity, as a result of the production shutdown of a strategic partner located at the other end of the world.
It seems that the BCP often focus on purely technical production continuity solutions: implementation of redundant infrastructure and systems, fallback sites... The BCP neglect two aspects just as critical as the material assets in a major crisis: the human factor and the strategic partnerships.
Integrate crisis management and business continuity into the company’s global management system
A crisis is an exceptional situation. It is therefore impossible to think of everything. But the best weapon to resist in wartime and to better bounce back once the crisis is over is to prepare in peacetime. How? By integrating crisis management and business continuity into the global management system, taking into account the most potential threats for each organization’s business.
The implementation and management of a BCMS depend on a decision of the executive management.
They require the appointment of a pilot: a Business Continuity Manager having the required skills and decision making capacity.
The BCMS methodology takes place into the PDCA Deming wheel (Plan, Do, Check, Act). It is about:
- Planning: define the BCMS objectives, organization and global policy.
- Implementing : identify and prioritize, within the development of a BIA (Business Impact Analysis), the elements playing a critical role in the production chain of goods and services; assess the risks they are exposed to and their impacts on activity ; define the response strategy to each crisis scenario; develop continuity plans describing the procedures (Who does what? When? How?).
- Checking the results: organize regular exercises with the collaborators to test the efficiency and good functioning of the procedures.
- Improving: optimize the BCP according to the postmodern documentation of the exercises
The major sanitary crisis that the world is facing calls for a more global approach of business continuity in the « implementation» phase. Furthermore, it puts the spotlight on a production continuity solution which had already proved its value during the social crisis of last December in France: teleworking.
Anticipate remote working as a fallback solution when possible
Some companies had adopted and organized teleworking in the frame of a collective agreement or a Charter before the Covid 19 pandemic. Many others, throughout the world, have inaugurated in emergency with more or less difficulties. Indeed, the roll out of teleworking requires many prerequisites and investments which, over the crises and in view of the environmental challenges, appear less and less unprofitable:
- The supply of a laptop to all employees concerned,
- The implementation of a secured solution for remote access to the information system of the company (Internet VPN for example) with sufficient capacity for handling all connection requests,
- The existence of a performing internet connectivity at home of all employees concerned,
- The training with the implemented solution, the supply of a user guide and of a technical support in case of problem.
Prepare for the recovery
Business resumption will not be « business as usual », that is to say a return to before crisis operation without a change in the method. This approach seems unrealistic in the light of the numerous impacts of this crisis. For that reason many companies will need to come up with a new operating model and with an associated transformation plan for achieving it progressively.
This new model will need to address more elements critical for business:
- The safety of persons: how to ensure the protection of collaborators in accordance with the obligations of any company? What specific measures concerning hygiene, health, security to implement? What organizations and communication mechanisms to plan to widely publish the prevention regulations and the barrier gestures?
- The safety of the work environment: how to protect the strategic sites (headquarters, datacenters, production sites, outlets…) hosting the activities and equipment essential for business continuity.
- The safety of the strategic partners and of subcontractors: how to ensure the continuity of their services? How to limit the dependence to a single outsourcing provider?
Conclusion
Few organizations had, in their risk assessment, anticipated the major sanitary crisis we are going through. Nevertheless « what does not kill us a priori makes us stronger» when we learn the right lessons and use the potential opportunities for improvement.
Among the much postmortem documentation that we will be able to make from this crisis in the end, three lessons already emerge:
- Address the pandemic as a potential event or even probable in the risk assessment.
- Manage continuity in a more global way by considering not only the risks related to the security of assets (equipment, sites…), the safety of information but also the security and safety of persons, as well as the loss of strategic partners
- Take into account the perverse effects of globalization and the risk of a sudden stop to the economy of a supplier’s hosting country.
