The aim of this section is to provide an understanding of what influences business resilience. It is intended to answer such questions as:
- How will you assess the internal events that impact on the ability to offer a continuous business service?
- How will you assess the external events that impact on the ability to offer a continuous business service?
- How can you check that you have carried out a thorough assessment?
Understanding What Influences Business Resilience
Every business is unique: with different Unique Selling Points (USPs), different staff, different locations, different financial situations, different business models and different decisions made on a daily basis. In this section we’ll take a closer look at where threats to your business might come from.
Depending on the type of work your company does, you could have very complex internal and external structure to your business. The larger the team, the more complex these internal factors become. It may be that you are a small enterprise with an extensive supply chain and network of contractors and partners for the purposes of flexibility. On the one hand, outsourcing labour means that any problems within your business don’t extend to the work being done by your contractors, but it also means your control over their own issues is more limited. Do you have reserve contractors and freelancers? Do you need to improve your lines of communication with these businesses to keep abreast of their own business resilience? Do you collaborate to improve efficiency? Do you safeguard against any loss of income brought on by them dissolving their business?
Also under the banner of “external issues” come wider influences on your business: political change, the national or global economy, transport and service infrastructures, etc. What are the implications if there is a postal or rail strike? What happens to your company if a new party comes to power or there is significant policy change? Is your business flexible enough and resilient enough to withstand these possible futures? And if not, what can you do to make your organisation more resilient? It is important for your business’s resilience to have continuity management in place which looks constantly at both the internal and external threats it faces
Assessing Internal Events that Impact on the Ability to Offer Continuous Business Service
If a leaky pipe causes your office to flood it is impossible to fix everything at once. So, what do you sort out first? Salvaging computer systems, filing cabinets or staplers? Calling the postroom staff or HR director? What about if a key member of staff falls seriously ill? Will this Single Point of Failure (SPoF) seriously compromise the running of your company?
At every turn there is a decision to be made when an internal event challenges the running of your organisation, and it is important that you have your critical activities clearly in mind when addressing a disruption in your resilience plan. Make these decisions in the heat of the moment and it could result in a short-sighted and potentially disastrous miscalculation, so having a plan in place for internal continuity made in a rational frame of mind will aid recovery.
Analyse the Risk
Assessing External Events that Impact on the Ability to Offer Continuous Business Service
A reliance on freelancers, contractors, partners and other forms of outsourcing is a feature of modern business. In the current economic climate, small enterprises are more and more frequently choosing to run lean and bring in expertise on a short-term or rolling contract basis to avoid the issue of large staffing costs and the resources/infrastructure needed to support them. And this presents a combination of benefits and challenges for business resilience conscious employers.
85% of organisations experienced at least one supply chain incident that caused disruption to their organisation in the past 12 months, while almost one in three experienced more than six. Business Continuity Institute and the Chartered Institute of Purchasing and Supply in 2011.
It may be that you use a pool of talent as and when necessary – a pool that isn’t affected if you face a crisis such as an office fire, allowing you to utilise them to pick up any short-term slack within the business. But you may also rely heavily on a single contractor, leaving you in danger should they close down. In recent years, there has been a swing towards employers asking more detailed questions with regards to business continuity plans when putting a contract out to tender – something particularly important when using external IT support. But even if you are a small enterprise it is in your interest to ensure that those businesses or individuals you work with are as conscious of the need to be resilient as you.
Here are some of the considerations to bear in mind when assessing the positive and negative aspects of your supply chain:
- How important are specific or individual suppliers to you?
- To what extent are you dependent on the work done by those suppliers?
- What are the implications if a supplier can no longer provide you with their products or services?
- Which suppliers are you most dependent on and how could you reduce your reliance on them or plan for a future without them?
- How much do you know about your suppliers and could your relationship be stronger with them to ensure a mutual business resilience?
- Are there ways you could work together to safeguard against problems in the market?
- Do your suppliers have their own business resilience plan, or at least a continuity plan, and could you help to improve it? Do you know how reliant they are on other suppliers, for instance?
- Are you convinced that you are one of your suppliers’ priorities should they suffer a disruption?
- Are you a major client or a minor income stream to them?
And what of wider external concerns? Those are more difficult to manage or influence. Although the warning signs might not always be as obvious or give as much time to prepare – for example, in the case of a flood or severe weather events – having a strategy in place and carrying out a plan of action in response to these events can still be done. Remember, you won’t just have to consider your own inconvenience in this type of event, you’ll also have to cater for that of customers. Can they get to where they need to be to buy your product? Is there a way you can reach them if they are stuck at home? You only need to look at the impact snowy conditions have on high street retailers to understand that this can be a big concern.
One way of identifying and assessing events is through PESTLE Analysis – breaking disruptions into Political, Economic, Social, Technological, Legal or Environmental factors. Understanding the risks can also help you to identify weak spots in your business – factors that could be improved and incorporated into your organisation’s business plan. And understanding how your customer is affected under difficult situations may open new doors to you – could you introduce a courier service rather than using traditional post, for instance? Should that have been part of your distribution network all along?
Perform the same risk assessment for the different components of your supply chain and wider external factors. Once you have done this you will be left with a clearer idea of where your enterprise’s vulnerabilities lie and how significant they might be to the future security of your organisation. You’ll be able to group the internal and external events into the one of four risk categories.
1. Accept – Where the impact of the threat is likely to be small or insignificant and there is little risk of your enterprise failing because of the threat, you may choose to accept the risk (e.g. a hot summer is predicted but you choose not to employ a full time medical professional in anticipation of someone suffering burns or heatstroke).
2. Monitor – Sometimes it is quite likely that an event will take place (e.g. a swing in exchange rates) but the impact on critical activity is typically low. This might not warrant a business taking direct action beyond monitoring the change and assessing the likelihood of any swing worsening. If this posed a risk to your business you may wish to outline how much a rate can swing without posing a critical risk within your resilience plan.
3. Stop – If an event is likely and the impact is expected to be high (an office built on a flood plain, for example) then urgent action should be taken. If taking steps to reduce the risks aren’t realistic (building a barrier) then the resilience of your business demands that you actively plan to move location and stop trading from the current premises.
4. Plan – Plan for continuity – You might find that certain events are extremely unlikely to happen but that the damage done by the threat would be significant to the business (a group of key staff winning the National Lottery and all resigning immediately). Having plans in place for these eventualities are advisable as long as the cost of implementing them are not prohibitive (ensuring that key staff are on long notice periods, for example and that their day-to-day work is documented and easily picked up should someone need to be brought into the roles in question). The exception to this would be when the cost of continuity is far more likely to bring about the business’ failure than the event itself – building an office in a subterranean bunker to protect against a nuclear attack, for instance.
Assessing the effects of a disruption can be done using a business impact analysis. Here’s a graph to illustrate how business resilience should play out on an organisation’s productivity.
The Resilience Curve – Zurich Insurance
How Can You Check that You Have Carried Out a Thorough Assessment?
You will have to constantly update the list of threats to your business over the years. Ensuring that you thoroughly assess each disruption is important to understanding the nature of the risk you face. First, make sure you address as many risks as possible. You can use the National Risk Register to help you do this. It provides information on the most serious national risks and sets out the consequences of these risks. It is freely available at www.cabinetoffice.gov.uk/resource-
library/national-risk-register and is updated on a regular basis.
Many regions also maintain community risk registers identifying specific threats to that area. See http://www.northumberland.gov.uk/default.aspx?page=2229 as an example. A quick search on Google for “community risk register” in your areas should provide information relevant to you.
Don’t just rely on your own input when it comes to assessing risks and identifying potential threats either. Use the staff around you, members of your supply chain and the customers you serve to get a full picture of what might be faced. There will undoubtedly be some low-level issues that your staff and suppliers handle on a regular basis that you have never come across. By creating feedback loops to management in charge of business resilience and continuity, problems, opportunities, threats and innovations resulting from these risks can be passed up the chain efficiently. The more input into an assessment you can get, the more comprehensive it will become.