Few organisations were truly prepared for the far-reaching impact of a globally synchronous pandemic. Many had assumed that their business continuity plans were robust and comprehensive, only to find them overly complex and impractical (read: untested) in the face of a rapidly evolving and deeply interlinked health crisis that would impact every fibre of an organisation’s micro and macro-environments.
In a recent webinar, Craig Kent, Head of Risk Management at Aon and Junita van der Colff, MD of Protea Business Solutions have unpacked and distilled some of the key learnings of what did and did not work in managing the BCM considerations of COVID-19.
Flexible and agile versus overly detailed and tick-box driven
Flexible and agile business continuity management that focuses on every organisational component can ensure that leaders and businesses are prepared for the next normal, no matter what it looks like. COVID-19 has provided an exceptional testing ground for assessing the veracity of even the seemingly best laid BCM plans. And as they say in the classics, never let a crisis go to waste.
Covid-19 has been the ultimate testing ground of whether business continuity plans performed as expected in keeping the wheels and cogs of business running as smoothly as possible when a disaster strikes. While many continuity plans were used to manage the 2020 pandemic crisis, many fell short and couldn’t be implemented because they simply didn’t cater for a pandemic crisis nor the ancillary disruptions on the scale of COVID-19.
The saying goes, “hindsight is beneficial, but foresight is better”. This is more relevant now than ever. Business leaders and risk managers need to evaluate their response to the pandemic crisis, draw out the key learnings, successes and failures in managing their response to this black swan event, and build on their BCM plans for the next normal, and the next potentially globally synchronous crisis.
Business continuity management could have been better
The Business Continuity Institute (BCI) surveyed 787 business continuity and resilience professionals in 93 countries earlier in the year, to find out how well they were prepared for and managed the Covid-19 pandemic. According to their findings, just over 64% of business leaders were well prepared to lead and coordinate the pandemic response.
Further findings show that nearly half of the survey respondents (49%), said the effect of a global lockdown had not been considered or factored into their planning. However, complementary to that, 64% still reported a successful response, lending credence to the need for agility and flexibility notwithstanding any gaps in the potential exposure planning phase.
The lack of preparedness was apparent in South Africa when the lockdown was announced. Many businesses were caught off-guard, specifically in relation to IT, communications and supply chain management. The week prior to lockdown was a rush of manic data and router equipment purchases for employees so they could work from home – a time-consuming, expensive and largely uncoordinated exercise.
Plans lacked the flexibility to deal with many unknown variables
There are several reasons why many existing business continuity plans didn’t work. Some had not factored for an event such as a pandemic, let alone a global one occurring at the same time across multiple geographies, or the potential consequences of it. Others were rigid and inflexible, or simply too generic for implementation to have any reasonable positive influence. Business continuity plans also tended to focus on scenarios where a disaster would force an office to move its operations to another site, versus a ‘work from home’ situation. In a country beset with power outages and load shedding, inconsistent and expensive data and internet infrastructure between urban and rural areas, this was a major challenge.
Crucially, there was not nearly enough consideration given to the financial impact of a crisis. A disturbing 33% of respondents said the planning process did not consider the financial impact, which makes it difficult to measure the success of a plan in the absence of a potential business interruption costing. Risk mitigation strategies should be directly aligned to the value of the exposure.
Covid-19 isn’t the first crisis of this nature, and it won’t be the last. The economic impact will be felt probably for the next decade and beyond. We need to think carefully about our financial resilience and focus on what our plan will be in instances where our ability to generate revenue is threatened. Who could have foreseen the dramatic, months-long, far-reaching lockdown that shut down entire supply chains – from the manufacturer to the end user and everything in-between.
An important lesson learnt from the effects of the 2020 pandemic is that business continuity must have buy-in from leadership. Business continuity management must be seen as a strategic enabler that helps the business continue operating when a crisis or disruption happens, not something that only happens at an operational level. To this end, 66% of BCI survey respondents said they will have more attention from board-room level when asked about future business continuity management.
Don’t ignore the human touch – Covid-19’s business continuity lessons
#1: Most BCM planning underestimated the impact on people and didn’t pay enough attention to the human element. It is critical to put the wellbeing of employees first. This requires trust, on both sides, and good communication. A central helpline, for example, can help minimise anxiety and uncertainty among staff during a crisis of this nature.
#2: Collaboration is important in business continuity. For example, if a business cannot manufacture its core product; could it manufacture another product that could be used, such as ventilators, and work with other businesses to get a finished product to market? We saw this across the world in lockdown where companies shared expertise and facilities and managed to stay open for business.
Covid-19 highlighted significant flaws in business continuity management. Going forward requires that we draw from these lessons, be more flexible in our planning and ensure that business continuity is part of the organisational culture.
Don’t complicate the business continuity plan
When trouble strikes, or is imminent, you must be able to respond with speed and agility. A ship analogy explains it best, comprising of a small ship, a fleet of ships and the Titanic.
The Titanic is large with greater capacity, but it is so big it cannot respond or move with the required speed and agility and is less likely to survive a crisis.
Small ships have limited capacity, but they can move quickly. Unfortunately, they solely shoulder far greater exposures to adverse elements and the chance of failure is heightened.
A fleet of ships, provides a collective of speed with agility, in addition to manageable portions, effectively enhancing the chance of success.
This is where we want to be in our business continuity response – able to see what is happening and respond quickly, being able to work in a complementary unison towards the common goal. This may require accelerated decision making so that we can respond quickly, which means smaller decision-making teams of no more than nine people.
In addition to being agile and flexible, effective business continuity plans must:
Be simple and easy to use.
Focus on planning for key business components and not specific scenarios.
Understand where critical business areas are.
Be action-oriented and include a roadmap that contains the scope of activities and timelines. Toolkits are more effective than detailed plans as they provide the tools to respond, rather than having to look for a response that fits the crisis.
Use process diagrams to illustrate what should happen and have checklists and agendas, rather than pages of text.
Be easy to navigate and easy to read – using bullet points and concise language.
Follow the flow in an organisation by using existing reporting structures.
Be tested. For example, identify a few critical people and plan for what would happen in their absence. Test it by removing these people from the workplace to see if the plan is effective.
Create and maintain awareness of business continuity planning
Planning is necessary. Leadership, agility and communication are crucial. In a snap South African survey on the Covid-19 response, only eight respondents out of 153 agreed that planning is everything.
While planning is a small component of business continuity success, overall business continuity management is more important. 80% of business continuity is ingrained in the culture. If you have a business continuity culture in your organisation you are more likely to be effective and innovative in a crisis. It must be on the agenda and part of everyday life in organisations. Education in the form of business continuity training and awareness programmes are key.
The next normal
The only certainty is that the future is uncertain. This is not going to change. There is a new way of working, we are adopting technology at a faster pace, we benefit from collaboration and we are interconnected. If one business in a supply or value chain fails, all are at risk. We must understand this and take it into account when we plan.
It is quite clear that planning won’t be enough and does not equal preparedness. Business continuity is not just about protecting our business, it is about creating value so that we thrive, not just survive.
The key to future planning is anticipation, agility and resilience. Is your business ready for the next normal considering how things have changed and will you be prepared for the next disruption?
Junita van der Colff is host and co-founder of RSKReview, member of the Business Continuity Institute (bci) and Institute of Directors Southern Africa, and MD of Protean Business Solutions
The webinar can be viewed here: https://proteanbusiness.com/webinar-business-continuity/
