Business continuity and resilience planning have not always been a priority for many organisations. Jon Herbert considers what lessons can be learned from a recent study on the pandemic response.
Generals, it is said, tend to prepare to fight the last war — usually for want of more up-to-date information and intelligence.
As a new enemy, Covid-19 has shown that pandemics can be complex, dynamic and unpredictable.
However, there are also effective ways to prepare for major crises. For many businesses, the key is flexibility, agility and learning how to adapt imaginatively not only before and during the height of a crisis but also in the recovery period and into an unfamiliar future.
The aim is to cut delay and act more effectively and earlier, according to a new study by the Business Continuity Institute (BCI), Coronavirus: a Pandemic Response, which also warns that we have a 3–5 year window of opportunity before corporate memories fade.
The BCI report
Underscoring the role of business continuity professionals, and the challenge of turning esoteric organisational resilience terms into common language, the BCI report looks at how a diverse range of organisations did — or did not — prepare for the largest health and economic crisis experienced by the modern joined-up world.
The report considers the different approaches boards and in-house departments involved in risk identification, analysis and response took initially and then modified once it became clear that the worst-case pandemic scenario was not just a remote possibility but a real threat.
It concluded that even organisations that prepared and rehearsed for an epidemic well in advance would do things differently if faced with Covid-19 again. The “old normal” is no longer an option for most companies, even if part of a well-prepared strategy.
How decisions were taken in the pandemic
The study examines in detail how preparations were made before the current pandemic was recognised, noting the months in which companies began to take action.
Importantly, it looks carefully at who was involved in decision-making and how organisations rate themselves retrospectively, adding that Covid-19 demonstrates the benefit of a comprehensive and well-maintained business continuity programme, as recommended by BCI guidelines.
Approaches were different. Organisations with tested plans were able to respond quickly and competently. Others relied on active horizon-scanning to detect early signs of what was emerging from China to give senior management a head start in response preparation.
But the speed and scale of the unfolding pandemic took many by surprise. Even organisations with pandemic plans in place found that they could not adjust easily to the “broad impact and global nature” of coronavirus disruption.
Describing Covid-19 as a “grey swan” event — potentially very significant and very possible, but unlikely and so often overlooked — the study found that many companies responded too late.
In figures — statistics from the report
A deeper analysis of responses is helpful. Where boards led the response but were unwilling to act before sensitive strategic issues were resolved, 34.2% acted before 1 February 2020. In contrast, when business continuity teams led, the figure was 53.9%.
How companies reacted to warnings is also interesting. Siloing information was common, others saw warnings as “alarmist”. In some cases, boards either took over or simply ignored existing business continuity plans.
About 40% said they had pandemic plans in place based on previous epidemics, but this did not mean they necessarily worked — only 66% said they were successful. Others preferred to use impact-based planning where the watchword was “agility”. Some 25% are now revising their recovery plans.
Rehearsal is important. Of the organisations who had actually rehearsed their plans in the last six months, nearly three-quarters said staff were well-prepared, compared to one-third of those who had not rehearsed.
About 25% of organisations plan to go back to their old business model; 54% know they will not. Some have discussed new business opportunities. Others worry that old products and services are no longer viable.
Marking their own score cards, 7.4% say they were extremely well-prepared, 44.4% well-prepared, 38.3% somewhat prepared, 8% badly prepared and 1.9% extremely badly prepared. Of those who said they were successful, 56.8% had pandemic-specific plans in place, 48.8% generic plans, while 11.7% said they had no plans at all.
Nearly 80% of organisations felt they were prepared in terms of cybersecurity going into the pandemic, with some 64% saying they were prepared for homeworking. Those who reported problems setting up staff remotely, or networks not being able to cope, highlighted the importance of having a tested plan in place for remote working.
When asked to pinpoint positive aspects of their planning, 64.2% said leadership, 47.2% an inclusive planning project, 47% an agile approach. On the negative side, 49% had not considered a global lockdown in their planning, 41.1% thought initially that conditions would return to normal, 32.9% failed to consider the financial impact. Of those that thought their staff were well-prepared, 35% had never rehearsed their pandemic plan.
Sourcing information is critically important. Of those interviewed, 94.8% used Government information, 92.3% global sources, 78.3% new sources such as social media, 67.2% sector data, 62.0% relied on company advisors, and 58.8% belonged to an industry association.
The two areas where organisations felt least prepared were the problems with supply chains arising from the pandemic, as well as the requirements for social distancing. Most organisations were aware of social distancing as a concept, but it was rarely considered in planning.
When asked how often recovery issues were discussed, 24.1% said daily, 38.9% weekly, 3.1% fortnightly, 3.9% monthly, 4.6% quarterly and 14.7% as and when.
Preparing for the unexpected — lessons learned
The top worries for organisations going forward are 63.4% financial instability, 45% low staff morale, 38.2% lower product demand, 36% loss of talent and 30.2% loss of customers.
One positive, however, has been to raise the organisational profile of resilience disciplines focused on coping and living with phenomena which cannot be avoided. Some 66% of interviewees said they want to increase their resilience investments at all levels.
In tandem, many companies foresee adopting permanently many of the new operating methods discovered under lockdown.
These typically include occupying offices more flexibly with more homeworking opportunities (or not at all and working remotely), revisiting priorities, re-imagining solutions, overhauling planning methods and exercises, and stepping outside normal business comfort zones. Some 62.5% reported improved technology resources, and nearly 59% think the pandemic has led to better communication processes.
Noting that the old normal will never return, the BCI report suggests that organisations should begin their pandemic planning around three basic assumptions.
Governments will always try to slow or halt a disease to protect health services and find a vaccine.
Government measures inevitably have an economic impact.
Because pandemics are global, supply chains and distribution channels are vulnerable.
This means that companies must not only prepare for the disease itself but also Government measures and their knock-on effects.
The report suggests that one of the first questions for organisations — if they are not classed as essential services — is whether they are going to attempt to continue operations in spite of any health protection measures implemented by the Government. If so, would this be in a simpler, interim form? Or would the organisation shut down completely and wait for restrictions to be lifted?
The Covid-19 pandemic has underlined the importance of business continuity, resilience and recovery planning for “grey swan” events. Plans need to be rehearsed and resources allocated before the event. Flexibility is key and it may be that certain members of staff need to be empowered to enact changes faster.
As the BCI report concludes, however, many organisations are still not out of the woods and “only time will tell which have been the most successful strategies to have been adopted”.