In today’s bulletin, Charlie discusses his thoughts on the industry that is business continuity and how he believes COVID has negatively impacted it.
Nothing particular in the news piqued my interest this week, therefore, I decided to give my thoughts on ‘Is Business Continuity One of the Victims of COVID?’. I think in a number of areas, business continuity (BC) was lacking when it came to responding to COVID and some may start to question the validity of BC.
The areas I feel business continuity has been found wanting are as follows:
1. It was very clear from the point of view of someone living in the UK that the pandemic was a very high-risk situation. However, on the whole, people didn’t prepare very well for it because it was thought of as too difficult. Where there were plans written, they all revolved around checking your employee’s temperatures before letting them in the building, and how to operate with 10-25 per cent of your staff having to isolate. As you can imagine I see a lot of plans, however when it came to pandemic plans they were only a page or two! As we have all managed responses to COVID, we know that the response is much, much more complex.
Secondly, the response to lockdown, shutting down whole sectors of the economy, social distancing and mask-wearing – I have yet to see anyone who had this in their plans previously. If we had a known threat, why weren’t business continuity professionals prepared?
2. The converse of point one is that if risk management is so great and comprehensive, why were so few of us prepared? Is risk management a paper exercise in meaninglessness, where it all looks good on paper, but if it doesn’t actually lead to action and mitigation then what is the point of it?
3. Much of the mental effort and the time of business continuity goes into the Business Impact Analysis (BIA). When COVID came along the BIA was not used as it was irrelevant, organisations were not prepared to stagger the recovery of activities. They wanted all activities back NOW and at 100%.
4. Many organisations that didn’t have business continuity plans made up their response as they went along and still survived.
5. Many organisations have spent lots of money on work area recovery (WAR), only to find on the whole they didn’t work during a pandemic. For many organisations, they didn’t have work from home plans, nevertheless within days or weeks they all their staff working from home.
6. I have had discussions with a number of organisations when developing their business continuity solutions/strategies, about whether they should have laptops on contract so that they could access them at short notice. I have not heard of any organisations who had trouble getting laptops, they might have had to wait a few days or a week or two, but they got them eventually. Why spend money on strategies that are not really needed?
7. No matter how good your business continuity plan is and how well prepared you are, if the government shuts down your entire sector, if you aren’t allowed to trade or your customers are not able to use the services you offer, then a business continuity plan is not going to make any difference.
8. For many business continuity managers, their role is seen as an administration role – churning out plans, updating documents and making sure the organisation is compliant and all the boxes are ticked. Some business continuity people are not used to having to have a role in the response and may have felt uncomfortable with this role. I wonder if many organisations called on business continuity people to help in the response, only to find they weren’t actually very good at the response role?
9. Once the initial response had been carried out, the response to COVID became very much a health and safety issue, making sure that regulations were implemented and the correct rules were followed. Business continuity professionals that were involved in the response became glorified admin people, carrying out a whole load of tasks in response to the actions decided by the COVID response team. There was not much point in their normal role during the pandemic, as nobody wanted to partake in exercises and plans didn’t need to be updated until COVID was over. So the business continuity professional got assigned to all sorts of minor projects and tasks, as they were someone who was spare without a huge amount to do.
That’s the bad news for our profession, but the good news is that there really is nothing coming up to replace business continuity so although it does have its flaws, there is nothing in place to replace it with. Everyone thinks organisational resilience is a good idea, but nobody can agree on what it is and there’s no ‘official’ process which you can demonstrate compliance. Operational resilience is pushed by the financial sector, and to me, it is a rehash of business continuity – there is fundamentally nothing new, it’s just a different way of looking at the elements of business continuity. Academically, there are no new big ideas and ways of thinking. So, business continuity for all its flaws in the meantime is here to stay, and you can all breathe easy knowing that you will be in the job for a little longer and mortgages will still be paid!