What is business continuity?
According to the Business Continuity Institute, business continuity management is defined as the “holistic
management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.”
Business continuity management is closely linked with disaster and emergency management, risk assessment, health and safety directives and various regulations. Failure to have a plan in place can result in damage to a business’ brand, image and finances. Ultimately, the lack of a plan could result in the failure of the business.
Recent regulation in the form of the Civil Contingencies Act 2004 should provide greater structure and consistency in the public response to emergencies. Primary and secondary civil ‘responders’ such as the fire service, police departments and health authorities are already obligated to develop their own plans. Local authorities will become fully responsible for providing business continuity advice and assistance to businesses and voluntary sector organisations by 15 May 2006. In the meantime, resources do exist to assist business owners with the development of a Business Continuity Plan (BCP).
Why is a Business Continuity Plan
(BCP) needed?
In recent years the global hospitality industry has taken a battering—both literally and figuratively. Incidents such as the Boxing Day tsunami; Foot and Mouth disease; terrorist attacks in Egypt, Bali, New York City, and London; and the SARS health crisis have each highlighted the need for the hospitality industry to establish or review the actions it takes in response to destructive events and emergencies. Many businesses will never experience terrorism directly; however, the threats of fire, theft, fuel crises, and other natural and man-made disasters are probable and
continuous. In addition, the topic of global warming’s effects has been continuously highlighted through the media. While its direct impact on the earth’s climate is debated, serious storms, floods, and droughts wreak havoc on regions around the world.
for the Hospitality Industry
Managing threats and building organisation resilience
➔
➔
Consider the following list of events, any of which could have a cataclysmic effect on hospitality, tourism and leisure businesses, and determine the probability of each one affecting your business:
• Cyclones and typhoons • Terrorist strikes and bombings • Fires, forest fires and ensuing smog • Vandalism and theft (including data theft) • Civil disorder and industrial action • Flooding
• Earthquakes • Fuel crises
• Computer and power outages, gas leaks and utility problems
• Epidemic and pandemic scale illnesses (SARS, flu, bird flu, foot & mouth)
• Drought
• Blizzards, snow storms, ice storms • Oil spills and man-made disasters • Transport accidents
• Key staff illness
• Disasters affecting suppliers and customers • Subsidence, landslides, mudslides
• Sabotage
• Tornados and wind storms • Hurricanes
In the UK, the Association of British Insurers (ABI) estimated in 2000 that annual flooding incidents would cause between £1 billion to £2 billion worth of damage per single event and, unfortunately, this estimate was confirmed in the flooding experienced in the UK later that year. While not as expensive as the aforementioned incident, flooding in Boscastle, Cornwall, in 2004 cost £5 million for damage to cars and property and between £5 million to £10 million for business interruption according to the ABI.These figures do not, of course, take into account the emotional and physical distress caused by
catastrophic events. A dire forecast by the ABI states that the annual cost of flooding in the UK could top £22 billion by the year 2080 if carbon dioxide levels continue unabated.
What happens if I—or my
business—fail to have a Business
Continuity Plan in place?
Experience has shown that businesses with regularly reviewed business continuity plans in place prior to an event are more likely to recover from the impact of the incident. Companies that fail to make contingency plans will find it difficult to sustain their business. For example, following the 1996 bombing in Manchester, over 600 businesses were affected and within six months 250 of these had gone out of business.The estimated costs of the bombing exceeded £600m. (Mid Beds District Council, 2005)
Many businesses—particularly small and medium business enterprises (SMEs)—will not survive a catastrophe.The London Chamber of Commerce and Industry conducted research on disaster recovery in 2003 and found the following:
• Only 17% of London SMEs have a contingency or security plan in place
• Only one in five of larger London businesses have any contingency or security plan in place
• 80% of large businesses in London have back up plans in place that would help them survive if they, or London, were subject to a terrorist attack.
• 90% of businesses that lose data from a disaster are forced to shut within two years of the disaster
• 80% of business without a well-structured recovery plan are forced to shut within twelve months of a flood or fire
• 43% of companies experiencing disasters never recover • 50% of companies experiencing a computer outrage will
be forced to shut
• 43% of companies with a business continuity plan do not test it annually to ensure that it works
• 58% of UK organisations were disrupted by 11th September with one in eight severely affected
Business Continuity
Business Continuity
Every small, medium or large business needs to have a business continuity plan in place. By establishing a plan, businesses can ensure the minimum impact to their staff, guests and patrons, property, company finances and perhaps even the community at large.
How do I create a Business
Continuity Plan (BCP)?
There are a number of different sources providing information, from basic to detailed, on establishing a business continuity plan (see list at end of this document). Some fee-based plans are available through companies specialising in the creation of business continuity plans, but there are also sufficient free guides and materials for those who wish to put together their own plan.
Some of the key points to consider when creating a plan are:
• Identify and list potential events that pose a likely threat to your business
• Analyse how to minimise the risk of these event(s) affecting your business
• Start a BCP as soon as possible. Having a draft in place during an emergency is better than having no plan at all. An Integrated Emergency Management (IEM) system is used in conjunction with BCP. As mentioned in the Civil Contingencies Act, an IEM supplements business continuity and comprises six activities:
• Anticipation
"Horizon scanning" or being aware of new risks as they arise
• Assessment
Being prepared to modify plans to respond to new risks • Prevention
This often occurs through other legislation, such as initiating health & safety measures, flood defenses, etc. • Preparation
The process of preparing and managing emergency plans • Response and Recovery
Managing the response to the emergency and returning service to normal
Business continuity plans are concerned with creating resilience within an organisation thereby enabling it to maintain a smooth running service where it can continue to provide its ‘deliverables’.The Business Continuity Institute has created a Publicly Available Specification—PAS 56—that meets the requirements of the British Standards Institute. PAS 56 is a widely-accepted five-stage process for creating a BCP. A detailed review of the creation of a BCP is contained in Chapter 6 of the government document entitled Emergency Preparedness: Guidance on Part 1 of the Civil Contingencies Act 2004, its associated Regulations and non-statutory arrangements. (See References). Generally, the creation of a BCP should involve the following:
1. Buy-in
Obtain high level management support for the plan— it will fail without this support!
2.Team Work
Create a committed team that will be responsible for BCP development but will also remain in place beyond the development and launch of the plan. Many large organisations have a dedicated Business Continuity Manager, which is worth considering—particularly if the business is medium or large.
3. Understand Your Company
Analyse and understand your business’s key activities, its primary mission and its deliverables. Who or what does the business rely upon to meet its mission and how can these resources be maintained in a crisis? Will service level agreements entered into either by the company or its suppliers be affected by the event and, if so, how can this be minimised?
4. Identify and Analyse Risks
Identify risks (see page 2) and determine where the risks lie. Are the risks internal or external? Do they involve customers or staff? Performing a standard risk assessment should help clarify the areas and types of risks to which the company is most vulnerable. Determine the severity level and the frequency with which the event or emergency might occur. For example, is the business vulnerable during the hurricane or
Business Continuity
➔
5. Policy and Strategy
Once identified, create policies and strategies to maintain the company’s operations during the crisis.These should complement risk management and IEM strategies and use non-technical language whenever possible. Creating a checklist of contact details including emergency services, utility companies, insurers, suppliers, customers, along with a secondary list of specialist service providers such as temporary staffing agencies, plumbers, IT specialists, etc., should help the business address immediate needs. Consider, for example, whether the company can be relocated to other premises or whether temporary staff can be hired.This is also a good time to make certain insurance coverage is adequate.Think about the worst-case scenario. Is the company prepared?
6. Communicate
Develop a response to the incident and be prepared to communicate with staff and the public regarding the incident. A spokesperson should be designated and he or she should be prepared to issue positive statements regarding the organisation’s handling of the emergency. Staff must be the first to be informed followed by patrons, guests, suppliers and the public. Remember, you want customers to have faith in your company’s ability to deal with crises. Many will be unforgiving if there is a significant disruption to their service.The costs
associated with the loss of customers combined with the loss of facilities, for example, may result in the demise of the business.
7. Maintenance, Review & Training
Maintain, review and update the BCP on an annual basis with the assistance of the dedicated BCP team. Make certain the updated BCP is shared with all staff on a regular basis.Training might include the actual acting out of the BCP to assist staff in understanding the
procedures that should be followed.These practice runs will familiarise staff with the plan and also assist with refining the BCP process.The plan won’t work if personnel aren't aware of it or know how to use it. In the hospitality industry, the high turnover of staff in any one facility guarantees that some employees will not have had the opportunity to be briefed about the BCP. The addition of the BCP to new employee inductions should remedy this problem. Make certain that updated copies of the BCP are located at accessible sites beyond the company’s offices, such as staff members’ homes.
Conclusion
Companies with the foresight to create and incorporate a Business Continuity Plan are helping to ensure their continued existence in an uncertain environment. By preparing for the unexpected, you too can secure your company’s greatest chance for surviving a catastrophic event.
DISCLAIMER
This HCIMA Management Guide is intended as a brief summary to the topic. While the information it contains is believed to be correct, it is not a substitute for appropriate professional advice.The HCIMA can take no responsibility for action taken solely on the basis of this information.
Business Continuity
REFERENCES
Association of British Insurers (ABI), April 2005
Safe as Houses? Flood risk and sustainable communities. [online].
Available from:
www.abi.org.uk/BookShop/ResearchReports/floodmanifesto.pdf[accessed 17 August 2005].
Business Continuity Institute (BCI)
Glossary of General Business Continuity Management Terms. [online].
Available from:www.thebci.org/Glossary.pdf
[accessed 17 August 2005].
Civil Contingencies Secretariat
28 July 2005. Letter to Key Stakeholders. Civil Contingencies Act Regulations
and Guidance. [online]. Cabinet Office.
Available from:www.ukresilience.info/ccact/2807stakeholders.pdf
[accessed 17 August 2005].
Emergency Preparedness Guidance on Part 1 of the Civil Contingencies Act 2004, its associated Regulations and non-statutory arrangements. [online]
HM Government.
Available from:www.ukresilience.info/ccact/emergprepfinal.pdf
[accessed 17 August 2005].
Mid Beds District Council, June 2005
Mid Beds Business Newsletter. Issue 2. Available from:
www.atcm.org/newsletters/docs/29-BusinessNewsletterIssue21.pdf [accessed 17 August 2005].
BCP SAMPLE DOCUMENTS
For an extensive list of free, downloadable documents see: London Prepared, General Checklists & Templates at:
www.ukresilience.info/londonprepared/business/businesscont/templates.htm
The 10 Minute Assessment
www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/1 0-minute.rtf
Things to Consider When Developing Your Strategy
www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/d evstrat.rtf
What Might Happen?
www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/h appen.rtf
Worst Case Scenario
www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/ worst.rtf
DTI: Understanding Business Continuity Management (with 10 point recovery plan)
www.dti.gov.uk/bestpractice/assets/security/understanding-business.pdf?pubpdfdload=05%2F625
MORE INFORMATION RESOURCES Business Continuity Institute
www.thebci.org
Disaster Recovery Institute International (DRII)
www.drii.org/index.cfm
Home Office
www.homeoffice.gov.uk
Hotel & Catering International Management Association
www.hcima.org.uk/publications
London First
www.london-first.co.uk
London Prepared
www.londonprepared.gov.uk
Metropolitan Police Service
www.met.police.uk
MI5 Security Advice
www.mi5.gov.uk/output/Page5.html
UK Resilience
www.ukresilience.info
DOCUMENTS AND BOOKS Home Office
Business as Usual; Maximising business resilience to terrorist bombings, a handbook for managers
www.ukresilience.info/contingencies/business/business.pdf
London Chamber of Commerce and Industry
Disaster recovery: business tips for survival. (May 2003)
www.londonprepared.gov.uk/business/lcc_disaster_recovery.pdf
Expecting the unexpected; Business continuity in an uncertain world
www.londonprepared.gov.uk/business/london_first.pdf
Weathering the Storm; A crisis management guide for tourism businesses.
Lynch, Mary. 2004.Troubador Publishing. Book available to purchase at:
www.troubador.co.uk/book_info.asp?bookid=176
How Resilient is Your Business to Disaster?
