Revising your Business Continuity Plans
The current global pandemic has invoked a new normal on businesses across the region, thrusting business continuity plans to the forefront. This webinar focused on how, a few months on, these plans are holding up and what businesses have learned about business continuity planning for future unexpected events. FM Global’s APAC Group Manager, Business Risk Consulting, Stuart Selden, and APAC Business Risk Consultant, Jeffrey Toh, share their insights from working with clients across the region.
Moderated by Suchitra Narayanan of Lazada Group, the session included a presentation by Stuart and Jeffrey and an interactive Q&A by the audience.
Our experts shared their thoughts on the importance and future of BCPs:
Stuart Selden (SS): The well-known military maxim that “no plan survives first contact with the enemy” is highly relatable to business continuity. Has your BCP been fit-for-purpose in the face of COVID-19 and supported your organisation’s business continuity or has it become redundant because it rigidly focused on a small number of scenarios? Business continuity is about preparing to respond to all possible challenges that could otherwise severely damage your business so adaptability and flexibility are key. Business resilience is about putting things in place beforehand to give your organisation the best chance of survival in a crisis. Getting the Board and the executive on-board with both resilience and continuity is absolutely critical to achieving a successful outcome.
Flying has come to a virtual standstill in many parts of the world during the pandemic and Qantas Airways, like most of its peers, has seen its business model massively disrupted as a result. Although in early February the situation appeared to be relatively benign, it deteriorated rapidly and within a month Qantas had stood down 20,000 employees and made massive capacity cuts to control costs. These actions were critical but what really underpinned Qantas’ survival was cash at hand and an ability to raise finance against previously unencumbered aircraft. Alan Joyce, the Qantas chief executive, said that “Our ability to withstand this crisis… is only possible because we’re tapping into a balance sheets that has taken years to build,” as reported by The Market Herald. This resilience gave Qantas the ability to make tough decisions quickly and develop a new business strategy for the years ahead, recognising that it’s a different airline operating in a different business to what it was at the beginning of 2020.
Jeffrey Toh (JT): At FM Global we use a framework that we call Design for Resilience to help clients withstand challenging circumstances. It incorporates four main areas of consideration: Strategy and Culture, Understand Your Business, Develop Continuity Strategies, and Implement Continuity Strategies.
The two areas that we want to focus on in building resilience are Strategy and Culture and Understanding Your Business.
The Strategy and Culture area is core to a good BCP. It is key that the BCP speaks to the language of the Board and what helps them drive decisions. What is the Board’s key areas of concern? Is it shareholder value? Is it the non-transferrable business exposures? Is it the culture of resilience within the organisation? By appealing to these concerns, you are more likely to get their support. A research that FM Global has commissioned recently, led by Deborah Pretty of Pentland Analytics, shows the main characteristics that impact shareholder value during an incident such as a cyberattack or natural disaster. These include leadership and communication, among others, which are key to your business culture. As such, echoing what Stuart has mentioned, it is vital to get your Board and the executive on-board.
It is also important for BCPs to be developed with a better understanding of your business. This requires a business impact analysis. Unfortunately, businesses often skip over this analysis and go right into the development of their strategy. If businesses step back and try to gain greater understanding of the interdependencies between their products, processes and revenue streams, this would put them in a better position to assess the potential impacts of their critical processes. Armed with this information, the strategies developed would inevitably be more effective.
SS: Some final thoughts to wrap up:
Guard against complacency – survival so far doesn’t mean that you’re prepared for everything and the pandemic is unique – you won’t always get the same level of support, understanding or forgiveness as you might have had in this pandemic, where everyone has been affected.
Understand your business – Alan Joyce has been in the airline industry since the late 1980s and he knows the airline business inside out. Make sure you understand what’s critical to your business and model the impact of disruption.
Resilience complements business continuity – don’t entrust everything to a BCP; take steps ahead of time to make your business resilient.
Get the board on-board – the crisis management or incident command team cannot operate in a vacuum. Use appropriate themes and language to secure engagement form the executive.
Business continuity management is still relevant – it must be part of the business culture, scoped to fit the requirements of your business and not be a siloed, universal, stand-alone solution.
Our experts answered questions from the audience:
1. Our audience survey showed that organizations often tried to use their BCP to respond to the pandemic, but ultimately had to abandon these plans to deal with the reality at hand. Do you have any examples of this from clients?
SS: From the experience of FM Global, our BCP was at the forefront at the beginning of the pandemic and things we had put in place through our business continuity planning process helped us in the transition. For example, we were well equipped to work from home and that transition happened smoothly. As the pandemic has evolved, the plan document has become less important but the incident command team is still meeting regularly to monitor and respond to reality as it continues to unfold.
We are still very much living the pandemic and few clients have yet had the ability to conduct an ex post analysis, to step out of the situation and truly analyse their business continuity management process to determine what worked and what did not.
What we can say is that letting go of the BCP as things progress is okay and does not mean that it failed – perhaps what has happened is that the new reality has birthed a ‘new business’ of sorts and outgrown the scope of the BCP.
2. When companies are planning for business resilience, can they realistically plan for government support like we have seen in the pandemic? If a company requires government intervention to survive, what is the reputational cost? Is there a branding issue?
SS: I don’t think companies should plan on government support being available as it has been in the pandemic – this could cause complacency. The pandemic is a very specific situation where everyone is impacted. It’s highly unlikely that an event affecting just your organisation or a small number of business would warrant a similar government intervention.
From a reputational impact perspective, the support provided to the banks in the 2008 global financial crisis had a very damaging reputational impact on those institutions, as many people saw them as responsible for the crisis. Support provided to companies in the pandemic appears to attract much less – if any at all – negative publicity, perhaps because in most people’s eyes blame has not been apportioned so directly.
JT: Government funding is really based on the situation, and the pandemic is very much a one-off event. Regarding the impact on reputation, it really has to do with how you dealt with the issue. If you look at airlines, Singapore Air and Qantas are doing a great job, whereas AirAsia has struggled with cashflow and has therefore taken a big hit to their reputation, as reported by the Straits Times.
3. How do we move forward? What is next for our business continuity planning?
SS: I agree with what was said previously about the next BCP being the hardest to develop. We would advise clients during this time to ensure that business continuity gets the attention it needs and deserves from the executive. Right now is the right time to convince them of that and get buy-in, engagement and support.
JT: To get buy-in from executives, we must speak their language and understand what drives their decisions. This will be different from organisation to organisation. The culture of resilience must come from the top, and it is vital to get the Board and executives on-board.
3. Does the responsibility lie within the risk managers? Who should be driving the future of BCPs?
SS: We need to see collaboration within organisations in the development of business resilience and business continuity. This collaboration might look different in different organisations – the critical thing is that it’s there. Getting the executive and board on-board lends itself to both a more defined structure and a more embedded culture of resilience within an organisation. If this is achieved, ownership will not be contained to silos and responsibility can sit clearly within that defined structure.