Business continuity and COVID-19: lessons learned

May 2022  |  FEATURE | RISK MANAGEMENT

Financier Worldwide Magazine

May 2022 Issue

Adapt and survive or wither and die. That was the invidious scenario foisted upon many companies throughout the course of the coronavirus (COVID-19) pandemic – a predicament that also served as a wake-up call for business continuity processes and their real-world application.

For sure, the pandemic exposed myriad process inadequacies. While the efforts of some companies to maintain their business operations went relatively smoothly, others were less fortunate, finding that their processes were not up to scratch and essentially incapable of adapting to the pandemic-generated ‘new normal’.

“COVID-19 turned business continuity planning on its head, as it forced companies around the world to rethink their operations and, in many cases, embrace totally new models for work,” says Tim Minahan, executive vice president of business strategy at Citrix. “While many had begun moving toward remote work as part of their business continuity plans, few were prepared to do so at the speed and scale the pandemic required.”

According to Agility Recovery’s ‘Business Continuity Lessons Learned from COVID-19’ report, the top challenges companies faced in responding to COVID-19 were supporting the health and safety of their employees, followed by maintaining employee productivity and morale, which the report states is proof that many companies struggled to adapt to a work-from-home strategy.

“Many companies were reluctant to consider ‘work-from-home’ a recovery solution before the COVID-19 pandemic,” says Doug Langley, a senior consultant at Agility Recovery. “In the early days of the crisis, most transitioned to work-from-home, but now we are finding more than 80 percent of companies tell us they are in a ‘hybrid’ mode. Now, companies are redoing their risk profiles, recognising home working as a viable option.

“Those companies that had not implemented a work-from-home plan scrambled and adjusted to successfully execute and continue operations,” he continues. “And although the changes they implemented established a solid foundation, they should not assume they will be able to execute if an emergency impacts access to their facilities.”

Furthermore, the need to adapt so quickly also meant that companies had to re-evaluate their business models, especially where lockdowns caused problems for those that had complex and globally interconnected supply chains, or where face to face interactions were curtailed.

“Over the last two years-plus, it has been difficult for companies to deliver business as usual, while keeping up with the accelerating pace of change,” says Quentin Dunstan, organisational resilience market development manager at BSI. “The impact of COVID -19 created huge uncertainty in markets and leaders had to find ways of working around the challenge and ensure that colleagues were kept safe, and jobs safeguarded wherever possible.”

Learning lessons

As we begin to move beyond the most severe ravages of the pandemic, it is critical that companies validate their ability to execute a range of business continuity strategies – proving that they have learned from the harsh lessons that COVID-19 has taught them.

“Worker shortages and supply chain disruptions sparked by the pandemic challenged companies around the world to find new ways to maintain continuity,” asserts Mr Minahan. “Savvy companies placed digital workspace technologies at the heart of their business continuity strategies, and in doing so, gained the agility, speed and efficiency required to manage resources in the dynamic way that today’s business environment demands.”

So, while COVID-19 has indeed instigated a great deal of organisational change, according to KPMG, there are 10 key business continuity lessons, outlined below, that companies have particularly learned off the back of the pandemic.

First, all companies need to prepare for unexpected situations. Many companies sent their employees to work from home during the pandemic but did not have laptops or videoconferencing available. These companies did not manage risks associated with an interruption of business activities at all or completely inadequately.

Second, processes to keep, and those to set aside. It is not possible to control all processes. Therefore, companies must focus on protecting those that are most important. These include processes that add value to customers or are essential for the operation of a company, such as production and call centres, and communication tools.

Third, do a thorough risk analysis and think about probability and impacts. Many companies have forgotten that a low probability does not mean a low risk. A low probability with a huge impact signifies a big risk. COVID-19 pandemic has taught companies to think of all situations that may arise.

Fourth, recovery plans are not enough. Continuity not only addresses system failures, but also the need to increase performance in the short term. Companies should define what procedures they will use to secure alternate supplies and train their employees in other positions they can fill.

Fifth, update plans at least once a year. An initial risk analysis should be reviewed at least every year or after each major organisational change. If the risks have remained the same, a company will not have to change the plan, but changes bring the need to rewrite the whole plan.

Sixth, practice recovery and continuity plans every year. Recovery and continuity plans are often left somewhere in a filing cabinet, all dusty. Ideally, every employee must know the plans, and everybody should know what the announcement of the plan means for them.

Seventh, manage continuity continuously. Continuity management is one continuous process which companies need to manage in compliance with guidelines and policies. It should also have its own strategy and manager. Furthermore, mistakes and issues should be recorded and learned from, with plans adjusted accordingly.

Eighth, do not subordinate continuity to operations. Companies often incorporate continuity management under operations. However, it is business that is responsible for protecting key activities such as continuity management. Therefore, companies should keep continuity management separate and ensure it is not adapted to the needs of operations.

Ninth, risk management must be aligned with suppliers. It is important that companies coordinate the protection of important activities with their suppliers. Any supplier can fail. So it is important to have others on standby who can jump in quickly and supply anything necessary. A stock of essential materials and parts should also be kept.

Finally, crises never come alone. Amid multiple crises, companies should have a team ready that will prioritise and coordinate solutions to all problems. They can also contract backup capacities with partners in advance, helping them out before they manage to restore processes.

“With governments across the globe having been forced to take action to protect their citizens throughout the pandemic, there were many things that were outside companies’ control,” observes Mr Dunstan. “However, an important lesson was that every country would go through distinct phases from survival through to getting back to the ‘new normal’.

“And while these phases were dependent on the extent and speed of spread of the virus, it enabled companies to plan despite the heightened level of uncertainty,” he continues. “Another lesson learned was that predicting the shape of the ‘bounce back’ was very difficult and what transpired was the sum of many individual actions rather than one confident point of change.”

Business continuity planning

One of the core components of business continuity is to have recourse to an effective business continuity plan – an ideally bespoke programme that can protect a company from the consequences of a major incident, such as financial losses, a damaged reputation and lost productivity.

According to Agility Recovery, companies should consider an all-hazards approach to ongoing business continuity planning and testing, including: (i) implementing pre-disaster actions to ensure a constant state of readiness and take steps to safeguard assets and vital records if an early warning is received; (ii) communicating disaster preparedness and response efforts before, during and after an emergency to keep clients, employees and regulators fully aware of the situation; (iii) utilising a cross-section of people to develop, test and implement disaster preparedness and response plans; (iv) ensuring backups are available for not only data but also personnel, worksites, vendors, equipment and other resources; and (v) treating disaster preparedness and response plans as ‘living documents’ to be updated as circumstances change.

“Business continuity testing has never been more important,” insists Mr Langley. “No longer are we just responding to a hurricane; we are responding to a hurricane causing flooding and outages during a pandemic. Organisations need to use scenarios in testing that include simultaneous incidents leading to multiple impacts with components based on lessons learned during the pandemic.

“Include all potential stakeholders such as board members, customers and third parties, and if an event is long lasting, such as the pandemic, consider after-action reviews throughout the incident,” he continues. “Companies have an increased appreciation of resilience since the beginning of the pandemic and expect leadership to impart their knowledge throughout the organisation.”

Also, what cannot be understated is the importance of good leadership. “Good leadership is essential at a time of continuing uncertainty,” says Mr Dunstan. “While no-one can predict the future with certainty, leaders can operate within the parameters of what is known and can be controlled. For some, this will involve how to ensure their companies survive, while others may see opportunities that their organisations can explore and create value from.”

Game changer

As the recovery from the pandemic continues, forward-thinking companies’ stance will be to create and review easily accessible business continuity plans – a game changing posture that will increase their resilience and allow them to structure their operations to adapt to a rapidly evolving landscape.

“The extended duration of the pandemic has confirmed for many that there is a real need to have a plan when the unexpected occurs,” notes Mr Langley. “There appears to a be a heightened recognition of the value of planning ahead and we have a window of opportunity to transition that heightened awareness into solid action.

“On top of the pandemic, there are other pressures which are causing changes in behaviour, such as the reduction in airline travel, the drive to carbon neutrality, climate change and sustainability,” he continues. “So, while COVID-19 has been an accelerant of change, there are many other game changers that are now coming into the focus of leaders, and these will all impact business continuity over time.”

For Mr Dunstan, leadership is a key component of how companies respond to the impact of a global event. “The realisation that such events can actually happen, means that leaders will be required to take a longer term view of their company’s direction of travel and performance,” he concludes. “The pandemic has been a game changer in that business is unlikely to return to the way it was prior to the pandemic, but there will be equilibrium in the ‘next or new normal’.”

© Financier Worldwide

BY

Fraser Tennant