Many businesses were simply not prepared for the level of disruption COVID-19 would cause. It would be safe to assume that most enterprises were somewhat blindsided by this event.
In fact in early March 2020 (pre-lockdowns), the consulting firm, Mercer, found that 51% of companies around the world had no business continuity plan to address the impending pandemic.
These days, organisations place themselves at a disadvantage — and at risk — without business continuity planning.
But what exactly is business continuity planning (BCP)?
Why is it needed?
And what is the board’s role in ensuring the resilience of the business throughout a crisis?
What is Business Continuity Planning (BCP)?
Business Continuity Planning (BCP) is the framework by which organisations protect and sustain business functions during a disaster (natural or man-made, e.g. pandemic, cybersecurity breaches, etc.) It seeks to ensure that firms can prevent, respond, and recover from business disruptions.
What is the difference between BCP and Disaster Recovery Planning?
Disaster recovery planning focuses on data and technology accessibility, infrastructure, and systems recovery so that business continuity can take place. BCP, on the other hand, places emphasis on all areas of the business which are necessary to keep it operational.
In simpler terms, disaster recovery planning can be viewed as a subset of business continuity planning.
However, it is important to note that these two plans are interlinked and must be viewed cohesively.
Business continuity is not possible without disaster recovery. Disaster recovery cannot guarantee business continuity.
Why is Business Continuity Planning NEEDED?
1. Mitigate financial, operational and reputational risks
Business disruptions can affect the organisation’s ability to operate efficiently as well as deliver on goods and services to customers. These can significantly impact the company’s bottomline.
But what is often overlooked is the reputational damage that can be incurred by the organisation’s failure to withstand shock and fulfil contractual/legal obligations (or comply with regulatory requirements). This can be just as damaging for the business in the long-term, especially as it tries to protect shareholder value.
2. Guide recovery efforts for business operations and/or IT services
BCP establishes a carefully evaluated and measured plan that minimises the time to recover and resume operations. Preparation is key: a tested business continuity plan also mitigates the risks associated with being blindsided due to inadequate impact analyses.
3. Protect the safety of employees and other critical organisational assets and processes
BCP factors in the welfare of employees as well as the protection of other integral assets and processes throughout the crisis.
Five Benefits of Business Continuity Planning
1. Increase resiliency and survival following a disruption
Similar to what was discussed in the section above, BCP increases the likelihood of resiliency and continuity during catastrophes or disasters. It marries tactical requirements that are necessary to keep the business going with a strategic framework that will lead to long-term success.
2. Familiarity and awareness of mission-critical business processes
BCP requires the identification and analysis of processes and assets that the business can or cannot do without. This can result in a deeper level of understanding of the organisation and the environment in which it operates.
3. Competitive advantage
An effective BCP can place the organisation at a competitive advantage in situations of general uncertainty — especially if competitors are struggling to survive a shock. By covering all bases in the planning phase, firms are better suited to weather change and resume operations when others might not.
4. Establish trust, leadership and commitment to all stakeholders and shareholders
The process of BCP exhibits a dynamic and active role and approach to risk oversight. It is an exercise that demonstrates strategic leadership, foresight, and initiative so as to be able to protect critical assets and the interests of all stakeholders.
5. Satisfy legal, regulatory, and supplier compliance
BCP can help provide a level of assurance that organisations will continue to work within established legal and regulatory frameworks to meet and fulfil obligations to clients and suppliers.
The Role of the Board in Business Continuity Planning
There is the school of thought that believes that BCP should be left to management, while some posit that the role of the board (though not as obvious) is integral to the business continuity plan. It is worth exploring the latter.
These are the roles of the board to ensure business continuity and resiliency:
1. Establish Business Continuity Planning as an important enterprise-wide initiative
The board needs to place ample priority on BCP initiatives.
The board is responsible for setting the overarching BCP agenda, approving BCP policies and activities (such as employee awareness training), allocating the budget and resources to develop, support, manage, and maintain the different components of the business continuity plan.
As these are rolled out, the board should be instrumental in communicating that BCP cannot take place in vacuums or functional silos. The entire management team needs to work as a unit for feedback and information gathering.
Lastly, the board’s role in leading BCP initiatives is to review the strategic alignment of the business continuity plan with the organisation’s culture, purpose, and set of values from inception to execution.
2. Ensure board operations, systems, and processes remain in place
The points above will become moot if the board can’t effectively discharge their duties due to the disruption of board systems and processes. For the business to continue, boards must be able to meet and lead during a crisis.
A recent article by KPMG brought to light two technological challenges that organisations had to face as employees worked from home during the pandemic:
a.) the lack of remote access technology
b.) the lack of digitised business processes
Suffice to say, this was a challenge for many boards as well. Therefore, it would be prudent for boards to consider making investments that will allow them to carry on with their activities during a crisis. One such investment might be in board management software — or board portals.
Board portals address the two pain points cited by the KPMG article above.
Board portals, such as Boardfolio, digitise board meeting workflows from end-to-end, eliminating paper-based processes while allowing boards to communicate and collaborate remotely 24/7 — in a highly-secure environment.
(Note that security is of paramount importance because cybercriminals seek to exploit the vulnerability of organisations in stressful situations to further disrupt operations. For more on this, download our e-Book on boards and e-mail cybercrime.)
The adoption of such technologies enables the board to focus on strategic governance when it is needed most.
3. Create a Crisis Communications Plan
The board should establish clear communication procedures especially during business disruptions. It may even want to form an ad-hoc committee to monitor and address communication activities throughout the crisis.
The board needs to work with management to assure stakeholders (i.e. employees, customers, suppliers, partners, investors, or key donors) of business continuity. As with any communications plan, consistency of message across all communication channels is imperative. Transparency is key.
Internally, the board should agree on reporting requirements it expects from management, factoring in the level of detail required and the frequency they should receive them.
Seamless communication to and from the board enables a better crisis response and informed, effective decision making.
4. Proactive approach to overseeing risk controls
The board is responsible for setting an enterprise-wide risk management framework. It is also responsible for shaping the risk policies and risk appetite of the organisation.
As management presents its business continuity plan, the board must make that all aspects are aligned with the risk appetite of the organisation. It also needs to carefully assess the plan’s impact on risk exposure and on the business’ long-term strategy.
Business disruptions are not a matter of if they will happen, but rather when they will happen. It is important to be prepared and to stay ready.
There are many lessons to be learned from the pandemic but this one stands out:
Those who were prepared were not only able to continue on with business operations, but managed to thrive under pressure. This alters the definition of business resilience to a degree. It is no longer simply about withstanding shock and change — but also creating value when it is least expected.