Make resilience part of your business continuity plan

posted by Rachael Elliott
28 August 2020

Resilience planning is imperative for surviving any supply chain disruption, yet when faced with Covid-19, most companies fell short in their response. So if you haven't already, now is the time to revisit your business continuity strategy. Leading expert on business continuity, Rachael Elliott, explains where to start.

Business continuity is all too often an overlooked resource. In companies fortunate enough to have this function, it’s generally considered the department that leads on the operational response to incidents and crises. While this is largely true, increasingly the discipline is being perceived as a critical piece of the resilience jigsaw and, as such, business continuity professionals are gaining a voice in boardrooms when making key strategic decisions.

Following the Covid-19 outbreak, one of the questions that surfaced was: how can we better use the knowledge and expertise of business continuity professionals at an earlier point, to inform the procurement stage of contracts? For instance, research carried out for the Business Continuity Institute’s (BCI) 2019 Supply Chain Resilience report showed that 12.2% of supply chain disruptions occur among Tier 3 suppliers and beyond – yet more than two-thirds of organisations (67.7%) fail to question the business continuity arrangements of suppliers within those tiers.

Due diligence pays

Covid-19 wreaked havoc upon supply chains to an extent most wouldn’t have experienced in a lifetime. With major manufacturing hubs closed in the Far East and limited transportation able to carry stock around the world, many organisations that relied on rapid transportation of goods (eg. for just-in-time manufacturing) found they were unable to get hold of key components, so were forced to halt production.

In contrast, companies that had performed sufficient due diligence before the coronavirus took hold typically had alternative suppliers from other nations and regions waiting in the wings, in preparation for such an occasion. However, in this instance, even Apple – a company widely considered to have one of the best managed supply chains in the world – reported difficulties in acquiring goods due to the outbreak.

Interviews carried out as part of the research also revealed that many organisations still assume a supply chain is safe simply because goods are manufactured in Europe – the longer supply chain is not even considered.

Cross-functional teams

There’s much discussion within the business continuity sector at the moment about the concept of organisational resilience: by ensuring improved communications and working practices between departments, the organisation is better placed to plan, adapt, respond and recover from major disruptions, such as pandemics.

Many organisations form cross-functional risk teams or emergency management centres to ensure key departments – such as IT, business continuity, risk management, crisis management, physical security, HR, procurement and facilities management – work together to combat crises effectively.

In this respect, Covid-19 has actually been a positive force for change, driving the urgent need for organisational resilience and helping make cross-functional working the incumbent practice for more organisations.

Know your suppliers

Recent BCI research shows that prior to Covid-19, less than two-thirds of organisations (61.9%) had a cross-functional risk or emergency management team. Now, this figure has risen to nearly 90%. However, while these practices are proving to be a force for good, procurement is rarely mentioned within this ‘resilience jigsaw’.

The report, Covid-19: The Future of Supply Chains indicates that even the largest organisations had failed to perform the correct due diligence at tender stage to determine the location of their suppliers at Tier 2 and beyond – a step that could prevent over-reliance on a particular geography.

So when the current pandemic hit, many companies that thought they were supply secure had the rug pulled from beneath them as they soon unearthed reliances on the Far East they had previously been unaware of. The resulting business interruptions were compounded for those with balance sheets already weakened by a fall in customer demand, and cash flow became a very real issue.

Get clear on grey rhino events

The role of business continuity is to ensure an organisation can keep functioning through an operational disruption. Generally, this is through events such as IT or telecoms outages, cyber attacks, weather-related disruptions, seismic activity or fire.

The common factor among these disruptions is that they have a defined endpoint; ie the disruption happens and business continuity strategy helps the company to stay afloat while the problem is rectified. The difference with a pandemic – and particularly one where no vaccine has yet been discovered – is the unpredictability of spread, the global reach and the lack of a defined endpoint.

Although companies are now working to overcome the difficulties of having no defined cutoff, the major issue with Covid-19 was that organisations were simply not prepared for a pandemic of this scale to strike, at least not in 2020.

Every year in February, the BCI publishes its Horizon Scan report to determine the prime threats that resilience professionals should bear in mind for the coming year. This year’s report showed communicable disease as second from bottom of the list of concerns. Ominously, the survey closed on 31 December 2019 – the day before coronavirus hit the mainstream media.

Covid-19 has, therefore, highlighted the need for organisations to be prepared for the unexpected. Often called ‘grey rhino’ events, these are highly probable, high-impact events that are frequently neglected in preparedness plans. Even among companies and groups that had planned for pandemics, many had based their strategies around lower-scale pandemics or epidemics, such as H1N1 (commonly called Swine Flu), MERS (the Middle East Respiratory Syndrome) or the Zika virus.

The BCI guide to business continuity: 

1. Determine whether the organisation will continue operations regardless of the health protection measures needed

Some organisations, such as emergency services or other essential service providers and regulated industries, will have no option but to continue operating in the event of a pandemic scenario. However, for others, they can choose whether to continue working in an altered form (eg implement an interim operating model) or shut down completely and wait for restrictions to be lifted.

While shutting down may not seem appealing, it can provide organisations with time to plan for a post-pandemic working environment, and even consider new products and services to offer in a new market landscape. For others, partially shutting down or reducing operations can help to meet new or temporary workplace conditions, for instance social distancing measures.

2. Ensure planning assumptions include the ability to operate priority activities with the restrictions of a pandemic scenario – and keep the Board and Executive team involved

It seems obvious, but priority activities may change during a pandemic. Some BC professionals have faced management opposition to pre-defined priority activities, despite it being in the business continuity plan. It’s important to have key members of the Board and Executive team involved in the planning process so they can input into discussions at an earlier stage, to prevent disagreements down the line.

3. Adaptability and flexibility

Devising plans that will be adaptable in a fast-changing environment is crucial to ensuring a business can continue to operate in a new and unknown environment. Even the most detailed business continuity plan could not have considered every single intricacy associated with Covid-19, but those with the flexibility to adapt are the ones most likely to emerge from the pandemic and thrive.

4. Consider scenario-based plans

Impact-based plans, such as dealing with mass working from home or sudden loss of supplies, are more effective than those built for a specific hazard. 48% of firms with a pandemic plan said it proved sufficient, as opposed to 59.8% of firms with an impact-based plan.

5. Explore ‘lite’ plans for specific departments, which are built around the Business Impact Analysis

One of the major complaints by business continuity professionals is that BIAs are ignored by senior management with little time to read them. Some organisations have found it easier to gain buy-in for their plans by writing jargon-free ‘lite’ versions for specific departments, which are built around the central BIA, but only contain necessary detail for that specific part of the organisation, making it more readable.

6. Establish a cross-functional risk team or emergency management centre

Pre-Covid-19, under two-thirds of organisations (61.9%) had a cross-functional risk team or emergency management centre. The pandemic saw this rise to 88.5%. Many resilience professionals talk about their frustration with siloing of information during an emergency response, with work being duplicated and some departments effectively opposing each other.

But a cross-functional team ensures greater collaboration between departments, which should ultimately lead to a more resilient response. From a procurement perspective, centralised coordination of procurement efforts can help reduce duplicate spend and stop departments competing with each other for supplies.

7. Carry out deep due diligence of your critical suppliers and embed resilience in the supply chain

While most know their critical Tier 1 suppliers, problems deeper within the supply chain often cause significant disruptions. Knowing a critical supplier has a business continuity plan is not enough. Ensuring plans are fit for purpose – even exercising them, where appropriate – provides assurance and insight of suppliers in Tier 2 and beyond. This should ideally be carried out at the initial tender stage and integrated within the request for proposal and contracting process to ensure continuity and resilience are recognised as a key to the overall supplier relationship.

8. Continue regular communication with critical suppliers

During a major crisis, your organisation won’t be the only one rethinking its strategy – your suppliers will be too, and they are critical for ensuring you can deliver to your own end customers. For instance, at the start of the Covid-19 pandemic, a critical supplier may have been confident about its financial security, but the longevity of the situation meant financial situations could change rapidly.

BCI research showed that over half (57.2%) of organisations communicated with their suppliers once a week or more during the initial stages of the pandemic. Some claimed to have had almost daily conversations with critical suppliers. Regular communications and the resultant good relationships formed with suppliers help to give early warnings of potential issues and could have the cross-benefit of ensuring preferential rates and terms once business returns to normal.

9. Share knowledge

In a nutshell, as an effective procurement professional, you need to ensure that where you have business continuity professionals available, you make use of their skills at all relevant stages in the strategic sourcing and management process.

  Rachael Elliott is head of thought leadership at the Business Continuity Institute (BCI).

This position can be based at our headquarters in Dover or any one of our overseas offices.
Between £50,000 - £60,000 depending on experience
Megger Group
East London
East London Waste Authority
CIPS Knowledge
Find out more with CIPS Knowledge:
  • best practice insights
  • guidance
  • tools and templates