Indispensable asset: defining and refining a BCP

September 2024  |  FEATURE | RISK MANAGEMENT

Financier Worldwide Magazine

September 2024 Issue

The world today is a world of disruption. A rugged landscape littered with hidden curves that continuously threaten to cripple already weakened economies and societies; this is a new age of longer term and less controllable disruptive forces.

In a business context, disruptions can happen at any time and in any place. New technologies, changing customer preferences and unpredictable events are just a few of the challenges forcing businesses to adapt quickly so they keep their head above water.  

In its annual ‘Pulse of Change: 2024 Index’, Agility PR Solutions ranks six disruptive factors affecting businesses: (i) technology: the pace and scale at which emerging technologies are adopted; (ii) talent: the overall talent environment from a quantitative and qualitative perspective; (iii) economic: macroeconomic, financial and business indicators of economic disruption; (iv) geopolitical: economic sanctions, war and conflicts and trade tensions; (v) climate: the financial cost implications of climate-related regulations; and (vi) consumer and social: the social climate and consumers’ confidence in the future.

While some of these challenges may be relatively minor and easily fixed, others can literally stop a business from operating for many months, incurring considerable loss of revenue and, potentially, much longer-term business losses. In the worst-case scenario, business operations may be forced to cease entirely.

“While each organisation’s situation is unique, there are a handful of categories of disruption that major organisations now typically plan for,” observes Mark Robinson, managing director at Inoni. “These include cyber attacks, supply chain failures, climate-related incidents, operational accidents, errors or omissions, exclusions due to protest and direct risks to life.”

It is scenarios such as these where a business continuity plan (BCP) comes into its own – a means of assisting a disrupted business to navigate turbulent times and retain control over its operations.

As defined by Harborough Portas, a BCP identifies the risks a business faces and the potential impacts they may have. Such a plan details how the business should deal with each incident, who to contact and what steps should be taken. It also helps to minimise the stress and panic when something does happen and allows the business to be able to deal with the consequences of any incident.

However, despite its obvious importance, many businesses do not have a BCP in place. Indeed, according to ZipDo, 43 percent of businesses across the globe are in this very situation.

“Many small to medium-sized firms, and even some large ones, choose to ignore the need for a BCP,” says Mr Robinson. “This is often because their leaders have a characteristically strong risk appetite and are unwilling to invest in activities with an apparent low rate of return. Those that do subscribe to a BCP usually do so because of governance, insurer or customer pressure.”

The case for a BCP

Boiled down, the purpose of a BCP is to document procedures for how to respond to incidents. This includes how a business will manage and contain incidents, and how it will continue operations amid disruption. For example, if a cyber attack disrupts networks and forces operations offline, a business must consider how it will continue to provide its services to customers.

It is also important for businesses to remember that a BCP should not be confused with disaster recovery. While of course related, disaster recovery is IT-specific and focuses only on systems, unlike business continuity which considers all areas of an organisation.

According to Crisis Control’s 2024 guidance ‘Why Your Business Needs a Bulletproof Business Continuity Plan (BCP)’, there are certain factors, outlined below, that make a BCP an indispensable asset for any organisation.

First, it minimises downtime and financial losses. A well-defined BCP outlines swift recovery procedures, minimising downtime and ensuring a faster return to normalcy. This translates directly to reduced financial losses and a protected bottom line.

Second, it enhances crisis management. A BCP serves as a cornerstone for effective crisis management. It provides a clear roadmap for communication, decision making and resource allocation during disruptive events, mitigating the overall impact of the crisis.

Third, it boosts customer confidence. Customers value a business that is prepared to handle disruptions. A BCP demonstrates its commitment to operational resilience, fostering trust and loyalty with its customer base.

Fourth, it improves regulatory compliance. Many industries have specific regulations regarding disaster preparedness and business continuity. A BCP ensures that an organisation adheres to these regulations, avoiding potential fines and legal repercussions.

Lastly, it empowers the workforce. Well-communicated BCPs empower employees to respond effectively during disruptions. They understand their roles and responsibilities, ensuring a coordinated and efficient response.

“A BCP could be made up on the spur of the moment, but the chances of it working first time are slim,” contends Mr Robinson. “Imagine an orchestra trying to play an unfamiliar piece perfectly at the first, and potentially only, attempt.”

In essence, a BCP is an investment in the future. It safeguards a business’ financial wellbeing, protects its reputation and empowers its workforce to navigate challenges with confidence.

Creating a BCP

With the importance of a BCP beyond doubt, businesses need to implement a plan that is well-evaluated and compliant, ensuring it is a good fit for the organisation from conceptualising to testing. Key to this is for a BCP to be based on business impact analysis (BIA).

“BIA is perhaps the most overlooked and least understood aspect of a BCP,” suggests Mr Robinson. “In fact, it is the business’ mirror in which to look back at itself and understand what it would mean to endure a severe, possibly existentially threatening disruption.

“Specifically, BIA quantifies losses, identifies risks and develops the scenarios it might face and shares that knowledge with the business so it can act with certainty,” he continues. “It provides the baseline knowledge and motivation for survival. Conduct BIA and a BCP becomes straightforward.”

Thus, with BIA as a good starting point, businesses can then utilise this base to inform the core components of their BCP. According to BCN, key steps can be taken to help test preparedness and identify potential weaknesses in a BCP, as outlined below.

First, determine objectives and goals. Be clear as to the overall aim of the BCP. Consider what it is that needs to be achieved. For instance, protecting critical team functions is core to business operations. That way, it is easier to focus on what is needed in the plan.

Second, identify responsibilities. Determine which stakeholders to involve, especially those responsible for writing the BCP. Decide upon incident responses or running staff training. It is also a good idea to nominate a business continuity team.

Third, identify critical functions. Review the entire business workflow and determine which functions are critical. These are any functions that, if compromised, would severely impact business operations. As such, the BCP should primarily focus on these areas.

Fourth, assess business impacts. Assess the impact of disasters on the business to help prepare for what could happen. Organise results by severity to help prioritise plans for alternative procedures.

Fifth, create an operations plan. Outline an operations plan with clear responsibilities. This should include prevention strategies, incident responses and recovery procedures.

Sixth, identify the plan’s limits. Although a BCP should include detailed incident response procedures, it is not always possible to plan for everything. Be realistic about what can and cannot be planned for, leaving room for key personnel to make decisions as incidents occur.

Seventh, test the plan. Assess the effectiveness of the BCP by running practice drills and ongoing staff training. Procedures should be updated as necessary, with any changes communicated to all key stakeholders.

“The main elements of a BCP are an analysis of what the organisation values and stands to lose, priorities and deadlines, a prescriptive incident response plan, crisis management plan, scenario-based recovery plans and key role definitions,” adds Mr Robinson. “BCPs need to be slim enough to use but comprehensive enough to guide the reconstruction of a potentially complex operation, including production lines, automation and commercials.

“Some businesses operate individual runbooks for each continuity threatening scenario,” he continues. “These are effectively miniature BCPs, contextualised for the situation, which simplify the response and decision-making process and reduce the amount of content that needs to be read and understood by the BCP team. They can also be easily adapted to cope with many scenario variants.”

Insurance and BCPs

An essential aspect of any BCP is insurance, as it provides a financial mechanism to pay for the reinstatement of assets and indemnifies businesses for the loss of profits. However, even though they are inextricably linked, business interruption (BI) insurance is a separate entity and often arranged separately from a BCP.

“BI insurance generally repays lost profit from the point of incident for, say, 18 months or two years thereafter,” affirms Mr Robinson. “If the business fails, the insurer loses both the payout and the possibility of clawing back its outgoings via premiums, often across a portfolio of policies. Through an effective BCP the insurer would be more assured of recovery within the cover period, ideally through regular realistic testing of the BCP.

“The insured benefits from raised client confidence and competitiveness, a wider choice of insurance products and a stronger negotiating position,” he continues. “A BCP should also support the calculation of a more accurate BI sum and indemnity period, since impact rates can be better defined and proven recovery capability taken into account.”

Evolving landscapes

In an uncertain world, the ability to confront the challenges posed by threats across numerous risk categories is vital. Thus, businesses must adapt to survive and thrive by safeguarding their interests and creating opportunities.

“In the space of perhaps 20 years, the threat landscape has changed beyond recognition,” concurs Mr Robinson. “Cyber attacks are now commonplace, we have endured a pandemic, and face the direct and indirect effects of climate change. The latter promotes ‘traditional’ insurance risks of fire, flood, power outages and so on, taking us full circle to the original drivers for a BCP.

“We have also seen how politics, including Brexit, Taiwan and conflicts in Ukraine, Gaza and Yemen, affect trade and movement, and upcoming elections promise to add further twists to this tale,” he concludes. “The message to businesses is to look ahead and be ready to adapt. Every risk situation presents problems and opportunities and there will be winners and losers. We need to watch, analyse and act.”

While the threat landscape has challenged many business leaders, managing through uncertainty is possible. In this respect, the existence and effective execution of a BCP could very well be the difference between recovering from a disruptive incident or not. For businesses, it is an indispensable asset in balancing risk in volatile times.

© Financier Worldwide

BY

Fraser Tennant