All organizations are exposed to threats — threats to brand and reputation, threats to key operations and supply chains, threats to financial viability and threats to shareholder value.
The challenge is to remain competitive and successful in an increasingly complex global business environment. This is where a business continuity plan comes into play. The goal of such a program is to create a catastrophe resilient organization.
“But, in order to be effective, comply with regulatory and internal audit standards, and achieve industry best practices, the organization’s business continuity plan must have strong core competencies in six key areas,” says Jay Balluck, senior vice president and account executive, Aon Risk Services Inc.
The six key areas are: policy and organizational structure; threat identification and business impact analysis; developing preventive controls; developing recovery strategies; plan testing, training and exercising; and plan maintenance.
The ability to maintain continued operations and customer service after an incident has occurred is vital. If you can’t quickly recover, you won’t be able to provide your customers with the products and services they need, which could be a death knell to your organization.
Smart Business spoke with Balluck about business continuity plans, how to set them up and why they’re so important, no matter where you are or what you do.
What makes up a good business continuity plan?
At its core, a business continuity plan is a set of predetermined actions that will restore and/or maintain critical business functions by establishing alternative operations within an agreed upon maximum impact on the corporation’s profit and/or revenue stream. By developing advance arrangements and procedures, your organization will be able to respond to any event either before or as it’s happening. A comprehensive, well-managed plan will reduce expenses and disruptions to the continuation of business.
To set a plan in motion, a company must first assess its operations, identify potential loss exposures and develop a contingency plan to mitigate the adverse effects of these loss exposures to the business. This entails identifying and evaluating critical operations and formulating contingency plans using internal and external resources. Once you identify key outside resources, you need to develop them so that they can be easily accessed when the large loss occurs. Every aspect of the plan must be carefully managed to ensure that it does not fall short when it’s most needed.
Why is business continuity planning so important to an organization?
Studies have shown that 80 percent of companies that do not recover from a disaster within one month are likely to go out of business. Also, 75 percent of companies without business continuity plans failed within three years of a disaster. A University of Texas Study on catastrophic data loss showed that 43 percent of companies never reopened after a disaster, while 51 percent of companies closed within two years. Finally, an international study done by the Disaster Recovery Institute showed that an average IT system shutdown causes a loss of .5 percent of market share every eight hours, and within the first five days after a disaster a company can lose .5 percent of annual revenue.
What specific threats could a business face?
Organizations that recognize threats to their operations and develop functional response capabilities recover much more quickly than those businesses that have done little or no business continuity planning. There are several threats out there, including natural threats like storms, hurricanes and earthquakes; technological threats such as hackers and viruses; human threats like terrorism and sabotage; and contingent threats such as geopolitical threats and threats to your supply network.
You also have to pay special attention to disease outbreaks. The repercussions of inaction during a disease outbreak are numerous. However, the risks can be hedged by having robust crisis management and business continuity plans in place. It cannot be overemphasized that a truly effective business preparedness and response coordination mechanism cannot be managed in a vacuum.
Cooperation, collaboration and investment are necessary to ensure a safe environment for your employees, customers and clients, and to continue doing business in the event of an infectious disease outbreak. Understanding the role of the employer, government and public health authorities is a vital component in the process. Even with good prevention methods, your business may still be exposed to an infectious disease outbreak. However, with well-thought-out and tested crisis management and business continuity plans, the impact of an outbreak on your business may be significantly reduced.
Bottom line, why should a company complete a business continuity plan?
Businesses must be prepared to respond to interruptions, emergencies, crises or disasters. To do so effectively requires today’s organizations to recognize realistic threats and vulnerabilities to operational resiliency.
The main reasons you need a business continuity plan are:
- To protect the profit/revenue stream of the enterprise.
- To maintain customer service and credibility in the marketplace.
- To maintain shareholder and stakeholder confidence.
- To minimize an incident.
- To fully understand the degree to which insurance can facilitate recovery from an incident.
