A worst-case scenario for swine flu earlier this year harked back to the days of the plague, with an estimated 750,000 dead and the need for mass graves across the UK.
So far, the pits are yet to be dug. However, scare stories of pandemics, along with the reality of natural disasters like floods and storms, and man-made horrors too, such as a terrorist strike, serve as a reminder that businesses need to have contingency plans in place for when the worst comes to pass.
At marketing agency Brand Learning, employees regularly have to travel abroad. Co-founder and joint MD Mhairi McEwan says: ‘We started thinking about contingencies, not so much for swine flu, but for other risks such as bird flu. We thought that if something like that could happen – a pandemic of any sort – we had better get our act together and think about what we would do.’
With the outbreak of a new strain of influenza, McEwan put out clear information and guidelines about the virus for employees: ‘What people aren’t so clear about is what happens if a member of their family gets swine flu. What we’ve said is that if you have the symptoms then stay off work and seek medical advice. If employees want to stay at home because of sick children or family members then they can have that sort of absence but it’ll be taken as unpaid leave.’
On a practical level, it also meant identifying key members of the workforce and ensuring they had remote IT access to be able work from home. ‘It’s somewhat easier for us – our business model is set around us working out of the office because of the amount of international travel we do,’ says McEwan. ‘When we had that very serious fall of snow at the beginning of the year, people couldn’t get into the office but we just carried on working as normal.’
Business critical
A report by the Chartered Management Institute shows that IT failure was the biggest source of disruption for businesses last year (40 per cent), followed by extreme weather conditions (25 per cent) and loss of vital personnel (24 per cent). Disruptions from fire and terrorist damage affected 5 and 2 per cent respectively (see table below), although the perceived threat of damage from fire and terrorism was much higher, at 48 per cent and 42 per cent.
Julian Thrussell, business continuity manager for standards and certification specialist BSI Group, observes that ‘many businesses don’t put in anything like the measures that they should’. He comments: ‘You don’t need to plan for a meteor strike or an earthquake. Problems are far more likely to arise from equipment failing or a key member of staff leaving. It’s the more common, everyday things that can be a serious threat to your business.’
Business Link adviser Ganesh Selvarajah agrees. ‘It’s important to look at where your business is most vulnerable,’ he says. ‘If you look at it in that context, you can plan around what you need when those parts of the business fail.
‘If you’re in a service industry, you’re obviously more interested in the people you have and not so much in products and data, so you need back-up plans if something happens to your employees.’
Everyday concerns
Not surprisingly, implementing a continuity plan may not be top of the list for an entrepreneurial-sized operation. Andrew Barnes, senior vice president for corporate development at business continuity software specialist Neverfail, says: ‘For SMEs, the main focus is on growing the business. You’ll probably realise you should be doing something about business continuity, but it’s not a priority.’
Thrussell agrees: ‘It doesn’t get done because small organisations tend to be more hand to mouth. It’s difficult to justify taking somebody off a fee-earning job to do something that might be viewed as purely academic.’
There is a business continuity management standard – BS 25999 – which companies can obtain, but Thrussell observes that it boils down to thinking objectively about your weak spots. ‘You might have to talk to your customers and ask: “If something goes wrong with the order we’re delivering to you, do you really need it within two days or could we get it to you in a week?” Frequently, you might find there is more flexibility from your customers than you initially thought, and they normally understand.’
The next step is to write out a contingency plan. ‘Think about what could go wrong and what processes are vital to both you and your customers. Unfortunately, too many people guess, and you can’t make the right decisions unless you take the time to assess the pressure points in your business appropriately,’ he adds.
It doesn’t have to be expensive, argues Business Link’s Selvarajah: ‘If you use your own people, you can do it relatively easily and cost effectively. Bringing in a consultant to do a forward plan is probably more appropriate for a mid-sized company.’
In practice, this means assessing your supply chain and identifying the essential employees in your company, and looking at introducing an IT back-up system. Selvarajah recalls working with a company that suffered a virus attack on its server and had no back-up, which proved disastrous for the accounts department. ‘Effectively, they had to try and rebuild their ledgers from hard copies,’ he says. ‘There were huge gaps and they were never sure who they had invoiced and what they’d lost in terms of revenue.’
Trouble indemnity
The big mistake is to assume that insurance will cover all eventualities. Jeffrey Nedas, the founder of accountancy firm Jeffrey Nedas & Co, who is representing several companies that are fighting for adequate insurance compensation after the Buncefield oil storage depot explosion in 2005, argues that too many businesses don’t give enough attention to their insurance policies.
‘It’s not so much their insurance coverage where they fall short, but in the indemnity period,’ explains Nedas. ‘Most policies have a 12-month indemnity period and some are pushing for 24 months. But in situations where you have a total loss, which happened to two companies at Buncefield, it’s been three or four years before they were trading effectively again. A short indemnity period lets the insurer off the hook at the end of that period and then you enter the realm of uninsured losses.’
Nedas also points out that you cannot underestimate the loss of potential revenue during a disaster or significant disruption in trading. ‘Most people have back-up for accountancy records and such like, but one of the hardest things of all is to assess what contracts you were in the process of negotiating and how close they were to being closed,’ he comments, noting that it’s important to keep the relevant notes and records to provide some kind of audit trail should a disaster occur. ‘A company has to ask itself the question: “If we were in a total loss scenario, would we be have enough evidence to support our claim?” I suppose it’s all about sensible and good management.’
Professional approach
Magnus Leask, information services director for the sports marketing agency Fast Track, which has an annual revenue of £20 million, observes that the installation of a back-up server has significantly improved service reliability: ‘One of the things that happened quite a lot – and it’s crazy given that we’re in the centre of London and next to Scotland Yard – is that we had power outages. There were a couple of instances when we had to send 130 staff home. That’s a pretty big financial hit.’ The decision was made to invest £100,000 in a system allowing power to be switched to another source in the event of an outage.
For other companies, such sizeable investments in business continuity aren’t necessary, but reviewing operations, highlighting important members of staff and reviewing various risks will help make a company leaner and more efficient.
Brand Learning’s McEwan argues that much of what she has put in place is nothing more than best practice, and the business appears well prepared for any resurgence in swine flu this autumn and winter.
‘We have refreshed our crisis contact list and made sure that we have really up-to-date information because often people move, change numbers or their circumstances change in some way. We’ve also given one person the responsibility of being a point of contact for employees – it’s all very well ringing the NHS, but it shouldn’t be necessary for the most basic enquiries.’
In a small island of 60 million people, disasters and mishaps can come in many different forms. Quick, easy-to-refer-to back-up plans and systems can make life a whole lot easier for your business. As Leask puts it: ‘We can’t have any downtime – it’s not an option.’
