 |
Globalization is truly upon us. Increasingly, events that occur far from an organization's home-base often play a role in determining the continued survival of its business.
With growing threats from terrorism, global pandemics such as the bird flu, and the impact of corporate scandals including the likes of the Enron collapse, organizations simply cannot ignore the need to deploy strong business continuity plans (BCP).
Companies that have yet to implement a BCP risk damaging their corporate reputation, employee welfare and any fall-out on shareholder value. In short, becoming a "resilient organization" is nothing less than a strategic imperative that organizations should embrace.
KPMG defines a resilient organization as one that is able to make the right decisions at the right time. While the issues may be complex, flexibility and simplicity are essential in a BCP plan.
A recent KPMG whitepaper, titled Living on the frontline: The resilient organization (2007), revealed that half of the business continuity managers surveyed said their biggest concern was a disruption to the critical infrastructure of their organization or that of a supply chain partner.
Based on our experience, even minor disruptions can have an impact on a company's share value and reputation. The impact on shareholder value is directly linked to an organization's ability to respond to major operational disruptions, as these disruptions can put their organization's financial viability at risk.
Evolving business continuity requirements
In looking at a BCP, you should be aware of the key drivers that have an impact on your business. Know what the critical functions are in your organization, and document all the crucial systems and processes required to maintain a "business as usual" position under all circumstances.
It is therefore crucial that your BCP should not only address possible internal issues, but also the marshalling of internal resources within your organization. It should also take into account how key external stakeholders are affected, and any role these stakeholders may play in a crisis.
Resilient organizations are therefore those that can maintain their most critical operations and survive all but the most extreme forms of disruption.
The three mutually dependent areas your organization should address are:
- The human factor;
- Diversity of approach; and
- Coordination and collaboration.
In a nutshell, they simply mean:
- Remember the people;
- Diversify the approach; and
- Coordinate and collaborate.
During a crisis, the human resource (HR) function plays a critical role in keeping critical operations going.
The complex but vital response to a crisis should include accounting for employees, visitors and third-party workers at the time of disaster.
This includes understanding the balance of corporate and individual responsibilities. It also means being flexible in managing changes with regards to key people after a major disruption; or even a loss of life.
Any BCP should therefore:
- Define the people issues likely to come up when a committee is tasked to create a BCP;
- Ensure that the command and control roles of key people are clearly defined, understood and communicated to key people;
- Identify key persons who may be involved in a crisis and making sure they are adequately trained;
- Ensure both internal and external key communication channels are kept open in a time of crisis; and
- Look after the welfare of key staff, including their ability to keep in touch with loved ones during a crisis.
Diversify the approach
A good BCP should not be static. Neither should decisions be made simply by following prescriptions from an instruction manual. Instead, it should also take into account tried-and-tested alternative working arrangements.
As your organization's risk profile changes, your BCP should be continually reviewed, updated and validated.
Where possible, your BCP should be kept as simple as possible with roles clearly defined, and employees with key roles to play should understand what they need to do in a time of crisis.
Deploying technology and common global processes, or seeking alternative ways of working may also help achieve greater flexibility and diversity of options for critical business operations in a crisis.
Let's look at banking operations, for example. A major operational disruption may result in spikes in trading activity, which in turn increase demand on back-office support teams. If the country declares a pandemic flu outbreak, customers may switch temporarily from over-the-counter cash transactions to telephone or Internet banking.
These changes in customer demand may put pressure on staff, and may even create a significant backlog. The ability to move available resources or seamlessly transfer work resource to help meet changes in short-term demand should be considered and adequately addressed.
Achieving greater diversity in business continuity arrangements, at least for the most critical operations, is also vital. For example, by exploiting technology and reducing any impact of the human factor by deploying two or more alternative ways of working.
In addition, at least one of these diversity alternatives should be geographically decentralized. This facilitates a greater use of remote working capabilities. Examples include setting up split-site operations for some larger-scale critical functions or the transfer of critical operations to other global locations.
These options are not mutually exclusive or necessarily replacements for secondary recovery centers. Rather, they should be viewed as part of a blended mix of business continuity solutions.
Coordinate and collaborate
In a modern inter-connected world, the mentality that "it only happens to others but not to me" has to be a thing of the past. Many organizations are waking up to the fact that in some instances, their BCP cannot effectively deal with a crisis in isolation.
In some industries, an effective BCP considers the roles required of industry regulators or other associated organizations. Collaboration is therefore an important consideration.
BCPs that fail to include such considerations may compromise the response of other organizations in the industry.
A successful response may, therefore, hinge on a coordinated approach between organizations in an industry to invest in deploying protective measures collectively.
This calls for organizations within an industry to come together to facilitate an industry-wide BCP for the greater good of all in that industry.
For these industries, they should consider:
- Sharing experience and knowledge for developing an effective, collective response;
- Anticipating and planning for disruption to an organization's supply chain;
- Regular communication with regulators, civil authorities and emergency services to ensure coordinated action; and
- Participating in market-wide exercises and benchmarking activities. One example, is the industry-wide exercise conducted by the Association of Banks in Singapore, the Singapore Exchange and other government agencies in May 2006.
The resilient organization is likely to see returns on its investments, outperforming less effective respondents in a crisis. Even without a disaster, this resilience may promote more efficient and cost effective business continuity arrangements, ultimately promoting greater market confidence in the company.
Ho Wah Lee is executive director of risk advisory services at KPMG Singapore. The views and opinions expressed in this article are those of the author's, and do not necessarily represent the views and opinions of KPMG Singapore.
Play video
» Achieve enhanced server performance with energy-efficient blade technology
There are currently no comments for this post.