BCP is a Company Strategy - not an IT Function

Posted on May 06, 2020 by Sandra Interdonato, One of Thousands of Performance Coaches on Noomii.

The Current Experience

The high profile crisis of Covid-19 has created world turmoil by how quickly and impactfully it has spread globally. Unprecedented disruption has occurred in our lives, businesses and the global economy.

Along with natural disasters and other crises, the surge of Covid-19 has raised awareness of Business Continuity Management (BCM). With this awareness, companies have an opportunity to refocus their attention on having a comprehensive and up-to-date Business Continuity Plan (BCP). This will prepare companies and protect them against evolving threats and avoid extended disruptions. It will also, if developed in a considered way, produce a competitive edge over less prepared companies. This is especially so if it is part of the company strategy and not left to the IT function.

Challenges and Missteps

The development and responsibility for the BCP is often seen as administrative. A plan required in the event of a crisis or disaster taking place. It is often relegated to administrative functions. In many organisations, when considering BCPs, the focus almost immediately turns to the IT function. This is often because many businesses can only successfully continue operations post a disaster or crisis, if the technical systems are intact. However worse still, is when the BCP itself is assigned to administrative functions like IT, because it is not deemed to add value to the business or contribute to the bottom line. Seen as a type of insurance, protection to have in place in case something goes wrong. This may mean it doesn’t get the attention it requires from the Board, and once planned it is shelved until it is needed.

Successful Company Strategies

Like any key initiative that influences the way a company operates, the BCP has to be viewed as a corporate activity that adds value to the business – an integral part of the development and implementation of a company’s strategy. When a company sets their mission and vision, the company strategy includes how they are going to get there and stay there.

Company strategies account for decisions and actions taken by a business in achieving the business goals and securing a competitive market position. However, it also requires consideration of what roadblocks, risks and disruptions may be faced. Any defect in the roadmap can result in the business being squeezed out of the market, being undercut on price, or finding themselves no longer relevant in a constantly dynamic and evolving marketplace. By pursuing a roadmap that has managed all such considerations, a company is more likely to be successful, because it has built a strategy with the BCP as an integral component of it.

In determining company strategy and effective corporate governance, the Board is key. It needs to make critical, strategic, financial and operational decisions, to seize opportunities and mitigate risks, which requires clear and considered leadership. The Board also considers how it safeguards the company and how it wants to sustain the business model going forward.

In thinking about the BCP – risk management – the Board needs to lead with agility and integrity in this dynamic and highly connected environment. At the same time, it needs to learn from this current crisis to build a more dynamic and resilient organisation going forward.

The responsibility for the BCP, as an integral part of the company strategy lies with the Board and in turn, senior executive leadership, the C-suite. The Board provides the emphasis required so that importance of the BCP is conveyed. The C-suite front and drive the BCP and communicate it’s significance. The C-suite in overseeing the entire organisation, the various locations and businesses, understand the exposure and level of risk, and are best placed to oversee the BCP.

Visible Board commitment including budgetary support is crucial to ensure BCP success in being adequately resourced and managed. It ensures adequate focus is given to the BCP and creates alignment across the business. Additionally, it fosters a positive and proactive business continuity culture. This assists the integration of the BCP as part of the company’s strategic and management philosophy.

To ensure business alignment, it is important that relevant business and support functions are involved. Various functions need to be involved, as different aspects of the organisation are likely to be impacted during a crisis or disaster. They hold responsibility for the ongoing maintenance, implementation and communication of the BCP. When a crisis or disaster occurs, staff are clear on who needs to be involved, what their role is and what actions are required.

During the BCP planning process, how people, assets and data in the organisation are to be protected needs to be addressed. Additionally, the processes and technology which are required to ensure the BCP can be activated, needs to be clear. The BCP focusses on ensuring that personnel and assets are protected and able to function. As these eventualities have been pre-determined and planned for, the company is not encumbered in the event of a crisis or disaster.

Some Key Considerations

In planning the BCP, the following need to be considered and worked through.

Risk identification
Proactive identification of potential business risks, determining how those risks may impact operations, and having the ability to transfer, mitigate and manage these risks.
- Do we understand all our risks?
- What is the likelihood and scale of impact of such risks?
- Can we insure or transfer any risks?

Essential business processes
Identify important business functions that need to be maintained or restored during a business disruption.
- How will accounts payable, accounts receivable and payroll be administered?
- How will staff work offsite?
- How do we continue to service our customers?

People and resource planning
Identify which key individuals are required both internally and externally to undertake the work required and the resources needed
- Who is key to day-to-day operations?
- Which external service providers do we need the support of?

Corporate alignment, support and empowerment
With the Board backing and senior leadership directing the BCP, the company should instil a positive culture around this. Key individuals should feel empowered and supported to undertake their role
- Do staff feel confident and empowered to take on the responsibility?
- Do they feel this sense of ownership?

Communication & Public Relations
Leaders need to be at the forefront of communicating the status of a crisis or disaster, and the company’s plans to address and respond to these. It is essential that companies communicate early, consistently and frequently. Crisis communication planning is a critical component of this, where the company needs to consider external communications. This may be to the public, stakeholders, investors, suppliers, regulators and third party service providers.
- Do we have a crisis communications plan?
- Do we have assigned and trained spokespeople?
- Do we have a communication protocol we can follow?

Ongoing testing and commitment
The BCP procedures should be tested regularly to ensure that they work. The BCP along with risk registers and business impact assessments, should be reviewed, updated and tested periodically, and at least once a year, to ensure they remain relevant and up to date. Full walkthroughs and scenario testing should be used as best practice in assessing the robustness of the BCP. Companies should look at the BCP in an analytical way to determine what potential weaknesses exist and what additional measures need to be put in place.

When the BCP is planned in a considered way, with resources allocated and key personnel who are clear on their role, business activities become more efficient and effective. This allows businesses to leverage their strengths and use these as a competitive advantage to more strongly position their company, both during normal times, but especially during a crisis or disaster.

Concluding Thoughts

Effective leaders understand they have a critical responsibility to ensure the continuity and resiliency of their company operations. They need to be aware of potential obstacles and risks. These leaders develop strategies including resiliency and agility. This is especially so when faced with the prospect of an interruption arising from a crisis or disaster. Effective leaders know the BCP forms an integral part of the company strategy of how they stay in business and remain competitive. They know the BCP is not an IT function.

Effective leaders:
- Take a proactive approach to crisis situations and business interruptions
- Recognise the competitive advantage they enjoy from having a comprehensive and well planned BCP
- Understand the benefits to the company of being agile and resilient in both normal and especially abnormal times
- Put in place the people, processes and technologies necessary
- Provide confidence in demonstrating to their employees, shareholders, business partners and regulators that they can recover operations quickly and efficiently after a crisis or disaster

Strategies which incorporate BCP, enable companies to pursue their business plan proactively, confidently and efficiently. Without this, the company is vulnerable to unpredictable and unforeseen events where it is exposed and forced to react.

In the case now of Covid-19, the test will be to see which companies had well thought out BCPs endorsed by the Board, led by C-suite and tasked by business functions. The companies which were prepared with robust and up-to-date BCPs, will be those agile enough to move swiftly, activate these for the current working conditions and adapt to current needs. They will achieve better success and even find themselves with a competitive edge over their competition.