This week I mark the six elements of the business continuity lifecycle out of 10, based on their effectiveness during the COVID-10 outbreak.
As coronavirus continues to spread apace and it is announced that schools in the UK will be closed down today, I thought I would do a bit of a review and see how well business continuity stands up when faced with a real incident. I always say that when rolling out business continuity there will usually be a new risk which we discover. This adds to the resilience of the organisation, but in the end, business continuity is all about making sure that all the development and plans actually add value when an incident occurs. This week I thought I would go through the six elements of the business continuity lifecycle and mark them out of 10, to see whether they hold up or are found wanting during this ongoing incident.
1. Policy and Programme Management
I think almost all organisations have been blindsided by the coronavirus and are scrambling around to respond. My own organisation is looking at how we could respond to the requirements of our clients and we have realised that really we should have been thinking about them a month or six weeks ago. It is also obvious that the government was unprepared and has been making up its plans and responses as it goes along. Most of the plans and documents they are using are ones left over from the last pandemic. I don’t know why when we saw cases expand in China, we didn’t realise that obviously COVID-19 would spread beyond China. I always say that our role as business continuity professionals is to horizon scan and look out for new risks, but many of us, including the government, didn’t identify and prepare for this new threat. Perhaps it is not the business continuity process which failed but our risk management skills. Due to this, I mark policy and programme management 3 out of 10.
A pandemic was one of the more likely and highest impact risks in the UK government’s risk assessment. I am not sure we informed staff of this and I think we were more concerned with the loss of buildings and IT, which we thought were more likely. It is not the awareness process that is an issue but practitioners’ evaluation and communications of the risk, so in this case I give awareness 5 out of 10.
As we head, I think, inexorably towards full country lockdown, the ability to maintain all operations will be difficult and I think we will have to start to decide on what activities we will continue and which ones we might suspend. If we are in lockdown for 2-3 weeks then we might be unable to continue some of our activities, so if we have evaluated our MTPS correctly, we should be able to understand how long activities can be discontinued before they have a major impact on the organisation. RTOs should also tell us the priority activities which we need to keep going. In carrying out our risk and threat assessment most of us will have identified that loss of people is a threat, but I don’t think it was possible to identify the circumstances of the pandemic and prepare for it. Most of the impact of this pandemic is not the impact of the actual disease, but the impact of the measures the government has taken to prevent the spread, so for analysis, I would give it 8 out of 10.
All the strategies and solutions for loss of people that have been developed and put in place, I suspect would not be appropriate in this incident. Staff working from home is a successful strategy in this case, but those who have purchased work area recovery, this has no benefit in the current situation. I think for the working from home strategy, which many have developed, I would give design 7 out of 10.
I suspect that most people are using their business continuity structure to manage this incident and as a decision-making framework. They should be using their incident management skills to manage the incident, communications channels to keep staff and stakeholders informed, and also to feed information from the operational departments or business units. Organisations who didn’t have business continuity plans in place have had to quickly invent teams who will make the decision on their organisation’s business continuity response. For implementation, I give business continuity 9 out of 10.
The management of information, working as an incident team and practising responding to a scenario, for those who have been regularly exercising, will hold them in good stead for managing coronavirus. However well you plan you will always have to adapt your existing response to the current incident, so exercising will help with this. For validation, I mark business continuity 9 out of 10.
Apart from poor horizon scanning, I think business continuity has stood up well against coronavirus and that prior implementation of the full lifecycle has helped organisations respond to the threat of COVID-19. The real proof will be after the incident is over, but I think business continuity has had a benefit. It will be interesting to get people’s views and to see, from those who have embraced resilience, which part of it was useful and added value. Best of luck to all readers of the bulletin, we will get through this!