Increasing organisational resilience through business continuity management

Business Continuity Management (BCM) helps increase organisational resilience by identifying priority activities, developing suitable strategies and solutions for continuity following disruption and allocating necessary resources to minimise the impact of disruption.

The outbreak of the global COVID-19 pandemic in late 2019 led to many organisations referring to their Business Continuity Plans (BCPs) for guidance. Many found that the analysis carried out to develop and document BCPs was extremely useful, even if specific continuity strategies for responding to a pandemic had not been considered. 

Even organisations that have invested heavily in BCM need to ensure arrangements have been put in place for responding to a pandemic, in particular recognising that many restrictions on normal life could be imposed by local and national governments.

Business Continuity Lifecycle[i]

In order to develop BCM arrangements consistent with good practice, organisations should follow a standard process.

Policy and Programme Management

• Establishment of the organisation’s BCM policy
• Alignment with the organisation’s strategic objectives
• Defines how the BCM system will be implemented

Analysis

• Business Impact Analysis
• Risk Assessment

Design

• Identification and selection of business continuity strategies and solutions

Implementation

• Development of business continuity plans (BCPs)
• Includes response framework and structure

Validation

• Testing and exercising BCM arrangements
• Maintenance and updating
• Management reviews and audits

Embedding

• Integration of BCM into ‘business as usual’ culture of the organisation
• Inclusion of BCM considerations in any organisational change

Particular key aspects of this process that require additional effort when planning for a potential pandemic are the analysis and design stages.  The following ten-point plan should be incorporated into any previous BCM thinking[ii].

1. Ensure you are clear on the organisation’s priority activities (time-critical) in the event of loss of resources.
2. Prepare for unexpected absences, particularly in priority roles (i.e. identify cross-trained staff, succession plan where possible).
3. Modify policies to give greater flexibility to normal working arrangements.
4. Establish and confirm welfare policies.
5. Reinforce internal peer support or other welfare mechanisms such as employee assistance programmes and occupational health support.
6. Implement a clear and regular communication strategy across the organisation.
7. Ensure the workplace has adequate supplies of cleaning and hygiene products.
8. Communicate the pandemic continuity strategy across the organisation.
9. Assign someone in, or close to, the leadership team to monitor official information sources, advice and assistance from government, health and other relevant agencies.
10. Avoid use of social media as a source of trustworthy information, and reinforce this to employees.

Pandemic planning considerations

In developing strategies and solutions for handling a pandemic, most organisations have to use a combination of more traditional BCM arrangements including those developed for denial of access to facilities, unavailability of personnel, failure of or limitations on technology and failures in the supply chain. Particular points of note in the COVID-19 outbreak included:

• Implementation of more remote working than had ever been tried before.

• Remote access capacity tests carried out, and greater capacity obtained where necessary, as well as purchase of hardware for employees who were usually office-based.

• Implementation of shiftwork in organisations that normally operate in core hours.

• HR policy changes necessary to cater for such operational change.

• Increasing use of video and tele-conferencing.

• Ensuring applications used are available to staff and third parties, and information security requirements are met.

• Identification of wider supply chains, accessing supplies from various regions of the world.

• Normal quality checks may need to be accelerated.

• Plans need to consider issues around global travel disruption.

• Border closures, airport / port closures, effects on both imports and exports.

• Widening of customer base to try to limit impact of any customer closing and not requiring supply.
• In some cases, altering product mix to cater for a wider range of customer sectors.
• Continuous assessment and revision of BCM arrangements.

• Unlike many other types of business disruption, there was a need for different arrangements as the situation changed.

• Preparing risk assessments and return to work plans for post-pandemic.

• Interim arrangements for a phased return to opening business premises, focus on health & safety.

Changes for the future

The ways in which organisations have had to adapt due to COVID-19 have led to changes in the way they think about risk management in general, and BCM specifically. It is likely that the implications from this situation will lead to:

• Much wider importance given to BCM by boards and senior management
• A greater focus on building organisational resilience
• Further integration of BCM with the organisation’s wider risk management programme
• Greater focus on risk management and BCM from regulators, investors, insurers and customers
• A need for organisations of all sizes to develop BCPs for their operations, including those that have not done so historically.

Ensuring an organisation is as resilient as possible, whilst understanding operational priorities in recovering from severe disruption, would have helped many businesses transition more effectively during the pandemic. Harnessing lessons learned from this situation, together with ensuring normal business risks are managed, means that business continuity is as important as ever.

How can Gallagher help?

• Reviews and gap analyses of existing arrangements
• Business continuity and pandemic plan development
• Testing and exercising of current plans and teams
• Bespoke training in all BCM subject areas

The Major Risks Practice of Gallagher are Associate Partners at Airmic. For more information, please contact Mark Rubidge, Director at Major Risks Practice: Mark_Rubidge@ajg.com.

[ii] Adapted from Business Continuity Institute - Pandemic Resilience – A Continuity Perspective February 2020

Disclaimer

This note is not intended to give legal or financial advice, and, accordingly, it should not be relied upon for such. It should not be regarded as a comprehensive statement of the law and/or market practice in this area. In preparing this note we have relied on information sourced from third parties and we make no claims as to the completeness or accuracy of the information contained herein. It reflects our understanding as at 16 June, but you will recognise that matters concerning COVID-19 are fast changing across the world. You should not act upon information in this note nor determine not to act, without first seeking specific legal and/or specialist advice. Our advice to our clients is as an insurance broker and is provided subject to specific terms and conditions, the terms of which take precedence over any representations in this document. No third party to whom this is passed can rely on it. We and our officers, employees or agents shall not be responsible for any loss whatsoever arising from the recipient’s reliance upon any information we provide herein and exclude liability for the content to fullest extent permitted by law. Should you require advice about your specific insurance arrangements or specific claim circumstances, please get in touch with your usual contact at Gallagher.

Arthur J. Gallagher Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: Spectrum Building, 7th Floor, 55, Blythswood Street, Glasgow, G2 7AT. Registered in Scotland. Company Number: SC108909