By Karla Gahan, Associate and Head of Resilience Services, Barnett Waddingham
#1 - Crisis preparedness menas survival
When the unexpected happens, being forearmed could mean the difference between an organisation’s failure and survival. The stakes really don’t come bigger than that.
In an ideal world, organisations would operate smoothly, day in day out, fully aligned with their strategy. However, life isn't always like that. Natural disasters, civil protests, physical attacks and pandemics are examples of unpredictable but entirely possible situations.
It may not be possible to head off these events – by their very nature, they tend to come out of the blue – but it should be possible to map out a strategy to deal with them. Good and well-thought-out resilience or business continuity planning can prove to be a lifesaver when turmoil erupts, and it should form part of every organisation’s operating model.
When it comes to business continuity planning, it pays to be wise before the event, not after it.
#2 - Impact analysis means focus
Organisations need to think ahead intelligently, consider what unseen events may occur and assess what their impacts might be.
What might the impact be if a terrorist attack or civil disruption takes place near to you? How do you keep operating if there is a fire or flood on or near to your premises? Might your business be a target for a protest demonstration and if so, how will you deal with that? Have you thought about what you might do during ongoing power outages?
There are people risks too. Although no one likes to think about it, what would you do if a senior – and perhaps critical – member of the leadership team were to suddenly die, or become incapacitated, or even kidnapped? These things do happen. With that person gone, do you have the processes in place to be able to continue to function?
Thinking about the types of risk events that could disrupt your organisational priorities will help you consider what matters most to you, and how you can maintain continuity of those processes, activities or services.
During a crisis you can’t protect everything so understanding your priorities is essential to planning effectively.
#3 - Testing your continuity strategy
It’s important not just to have a business continuity or crisis management plan in place, but to test it. This is sometimes known as a wargame exercise; in other words, testing the theory of an event occurring and how the response would be actioned.
The scenario chosen for the exercise will focus on testing pre-defined objectives and should be as realistic as possible. The test scenario might be played out in real time (or as close to real time as possible), with twists and turns of the storyline being fed in as it progresses. Or it can be simulated as though taking place over weeks or months. The mock event can be as creative as you want it to be, although obviously it should be something that could genuinely happen to your organisation.
It is important to note down the results of, and recommendations from, the exercise immediately after it has concluded and when it’s still fresh in everyone’s minds. As time passes, the memory of those involved may start to drift or become imprecise, so you need to capture thoughts and findings as early as possible. And of course, there should be a full post-event debrief should a crisis actually occur.
This needs to be followed by a fuller, formal board level or risk committee discussion which can evaluate the outcome of the exercise and if, and where, response strategies should be reappraised as a result.
During the exercise you should expect two things to happen. Firstly, you will be able to determine just how well-prepared (or not) your organisation is to deal with unexpected but plausible events –) the known unknowns.
Secondly – and arguably even more importantly – you should expect the testing itself to reveal other risks you had never thought of, thereby giving you the opportunity to identify, evaluate and frame a response to these.
These insights help build resilience and enable continual learning and improvement of your response strategies.
#4 - Team building for continuity
You should also be aware that you are testing not just processes and systems, but also people. Testing crisis scenarios is not something that suits everyone. Some colleagues, perhaps for personal reasons, have entirely reasonable stress and mental health issues when asked to confront the reality of challenging scenarios –) some possibly involving loss of life.
If this is the case, stand people down straight away, with understanding and sympathy. It is far better to discover their unsuitability during a test than an actual crisis. It also helps ensure that the remaining team members work effectively and bond together, building a rapport and understanding their own capabilities, strengths and weaknesses. If a modelled event plays out for real, this kind of cohesion will be vital.
Psychological safety in an incident response team is critical and by running exercises (or tests), you are building these critical skills. Those involved in the response team will carry this awareness of the dynamics of psychological safety with them in their everyday roles too.
#5 - Long-term strategic focus
The appropriate frequency of exercising depends on the organisation and the sector, but the rule should be at least yearly if resources allow. It also depends on the types of risks an organisation feels it needs to prepare for. It also makes sense to carry out a re-evaluation if one or several members of the core team swap out. This ensures that the replacements are trained and so will be able to fully contribute should a real crisis happen.
Whatever the frequency, most organisations should regard a properly tested business continuity plan as part of their core operational strategy, as it brings real understanding, focus and comfort to all involved.
Many organisations demand visibility of business continuity exercising as part of their supply chain due diligence and therefore it’s no longer a ’nice-to-have‘ but a critical foundation for relationships between organisations. It can mean the difference between winning contracts and losing work to competitors.
Implemented and maintained correctly, a good business continuity plan provides the underlying confidence that the organisation can handle all unexpected challenges.
|
