As the discipline of business continuity matures, many are flagging community resilience as the new and important trend - a more outward-looking practice being pursued by forward-thinking companies in a bid to further boost robustness in the face of adversity. But, as Sam Barrett asks, is everyone willing to share their plans?
Business continuity planning has developed significantly since it first made its way on to boardroom agendas. While the first plans focused primarily on restoring IT systems, today's most forward-thinking companies are devising plans that go well beyond the organisation itself, reaching out into the wider community - whether this means other businesses, residents or local services.
"Early plans were rather naive and assumed organisations had total control over their destiny," admits Lyndon Bird, technical director at the Business Continuity Institute. He says command of an entire situation might still be possible if there is an internal technical problem creating the interruption but, generally speaking, the drivers - and also the solutions - are found outside an organisation. "Nothing works in isolation; companies need to look to their communities when drawing up plans."
More community-based planning has already been flagged up as a key trend by specialist resource website Continuity Central. Among its predictions for 2008, it states there should be greater momentum towards community resilience, adding that good BCP must take into account the local community, working with it and within it to help make a company more resilient. Certainly, widespread co-operation makes sense. Major events such as floods, biohazards, pandemics and terrorism all affect the community and for any continuity plan to be effective it will need to include consideration of the broader issues.
Bill May, head of risk management at Crisis Survivor, explains: "It's essential to involve the wider society when drawing up BC plans. For example, response to a flood works best if it is community-wide. Planning to send your employees to a hall 100 yards down the road isn't ideal - especially if the flood affects those premises too."
Even smaller events can be better tackled through community-based plans. "We've seen several fire losses in metropolitan areas where the presence of chemicals on the premises has meant the fire service has had to put a 200 metre hazard zone around the building," says Allister Smith, property risk manager at Norwich Union. "This has significant implications on other firms in the area as far as denial-of-access is concerned and it would have benefited the businesses if they had been aware of this possibility when they drew up their plans."
Involving other parties in BCP is also prudent due to the inevitable interdependency of businesses with other areas of the community for their operations, such as suppliers and employees. Doug Barnett, head of customer risk management at Axa Insurance, offers the following example: "Where an employee's home floods, it is worth considering how it will affect them and what assistance you can offer as an employer. I have seen cases where recurring home floods has affected an employee psychologically to the extent where they're unable to sleep whenever they hear rain for fear it will happen again. Thinking about their needs and providing support where appropriate can make your business more resilient."
Going it alone
Putting together a BC plan in isolation can also be dangerous. Indeed, in the following example from Mr Bird, the plans in place could have potentially created an event more catastrophic than they set out to resolve. "A business consultant told me that he'd looked at the BC plans of some of his clients and found, in the event of a major disaster forcing them to evacuate their premises, they had all made provisions for their employees to congregate in one square. This would have meant approximately 800,000 people trying to gather in one small area."
In addition to ensuring neighbouring companies' plans do not conflict, working within the community helps to raise awareness of potential problems. "By engaging with other organisations you will have more input into your own plans," says Robert Hall, managing consultant at Marsh Risk Consulting. "Furthermore, organisations that might not have BC management in place may be encouraged to draw up their own plans. And all those extra eyes and ears will make the group more resilient from any threat."
Community BCM also has benefits beyond greater resilience and more effective recovery. Mr Bird comments that organisations should think about this in relation to their corporate social responsibility agenda. "As part of this, companies should be looking at what they can do to safeguard society. This can already be seen in some companies, especially those that are based in the community; for example, Sainsbury's is well-advanced in this area. However, sectors such as banking arguably have a smaller community presence and are less likely to have included community resilience in their plans," he says.
But getting people together to talk about BC issues is not always easy. Companies' plans may not be well-developed, which can prompt other firms to be resistant to sharing knowledge due to fear of losing a competitive edge.
But Mr Hall argues that this need not be the case. "Even where you're liaising with your competitors you don't need to share the finer detail of your plans to improve community resilience. Sharing broader ideas and discussing areas where your plans will affect one another enables parties to see the benefits."
There are other constraints too. Shaun Kelly, head of business solutions for Europe, Middle East and Africa at Crawford and Company, says that although community resilience is a useful concept, for many businesses it is nothing more than a dream. "While some very big businesses may be able to afford to do something around this, it's not an option for the vast majority of concerns as cost is a legitimate constraint to any organisation on all aspects of their activities, including BCM," he explains.
However, the proponents argue that the expense of putting such BCPs together is small compared to the risks an organisation might face without them. "Around 80% of companies that suffer a major disaster go bankrupt according to National Audit Office figures," says Mr Smith. "On top of this, 20% of small to medium-sized enterprises will suffer a disaster every five to 10 years so it pays to have plans in place."
But things are improving. The Civil Contingencies Act 2004, which came into effect on 1 April 2005, requires local authorities to educate businesses about the need for BCP and assist them with their plans. "By the middle of 2007, all local authorities should have had a scheme in place to help educate businesses about BCM," says Mr May. "This will help organisations to look community-wide when creating BC plans."
Mr Smith says he has seen evidence of this starting to happen. "It's still early days but giving local authorities this responsibility has meant BCM now has a higher profile in the business community. A decade ago you would have had to explain what it was but now there is much more awareness."
Although awareness may be growing, Tim Garland, business continuity manager at Towergate, fears local authorities may be out of their depth. "They won't necessarily have the expertise to do this," he says. "They should be inviting insurers and loss adjusters in to help with this education process." Mr Bird agrees. He believes that rather than adopting the role of educating local businesses about BCM themselves, local authorities should be facilitating discussions with input from more experienced bodies. "These authorities should be helping to bring communities together so they can create robust BC plans," he adds.
Perhaps even more pressing are the budgetary constraints local authorities find themselves under. Tight budgets make it very hard for them to include practical BCM advice among their services. In their place, parts of the insurance community are taking steps to facilitate broader planning activity. For example, Mr Garland says that his firm regularly holds seminars on BC, inviting local companies along to share their experiences. "We'll cover the background to an issue - for instance flooding - and this will open up discussion about how it might affect a business and its community," he explains. "Where companies aren't competing against each other, they don't have any issues about sharing their plans."
The government has also pushed this issue up the agenda, setting up a series of regional resilience forums around the country to bring interested parties together to discuss BC challenges. Mr Hall, who attended a meeting of the London forum, says it was a useful exercise. "It was a good way to share ideas and exchange views; it's definitely a welcome development."
Understandably, disasters can also result in greater willingness to share information and plans. After the floods in Carlisle, businesses and other parts of the community worked together to draw up a strategy for future events. Although such reactive measures should help safeguard them in the future, some commentators believe they are too late. Mr Garland explains: "Any opportunity to have a forum should be taken. Standards can be followed - for example PAS 1188 for flood protection products - which will help to guide discussions."
A degree of scepticism
Others remain less convinced by the community resilience argument. Mr Kelly says, from a loss adjuster's perspective, he does not believe it brings any further value. "It won't improve business resilience for an insured that already has a perfectly good BCM plan in place," he adds.
And some insurers do not believe taking BCP to this level should be automatically rewarded in financial terms. "Businesses shouldn't expect a discount just because they've incorporated community resilience into their plans," says Mr Barnett. "There are still far too many companies that haven't even got a basic plan in place. If they can demonstrate they've made their business more resilient then they'll receive more quotes and may get a keener price as a result of the greater competition."
However, while it could be argued that community resilience on its own isn't going to deliver significant financial benefits to organisations adopting this approach, the BCM experts believe it's an important part of their discipline. "Community resilience must be part of a good BC plan," argues Mr May. "You'll always get better results if you plan in conjunction with other parties that could be affected."And while some members of the jury may still be undecided, the vote is most certainly swinging.
Community resilience is one of 2008's hot topics in business continuity circles.
For example, UBS's UK head office is located in London above Liverpool Street station. This location, with mainline and underground stations running beneath it as well as numerous shops and other businesses, means the group looks to include all these parties in any business continuity planning it undertakes.
Similarly, HSBC in Canary Wharf has a large shopping centre underneath it and many other businesses and transport links close by. The bank, therefore, needs to consult with all these parties whenever it draws up its BC plans. Robert Hall, managing consultant at Marsh Risk Consulting, comments: "Both companies have involved all these other businesses in their BC planning; it makes sense. If they are going to have any chance of recovering quickly after many of the insurable risks, they need to include the plans of other organisations."
- Analysis: The future of pricing – Data and technology
- Insurance Post wins best publication award
- CMA price cap proposals could put pressure on 'weak profitability' in insurance
- Roundtable: Digital Transformation – to what extent has hype turned into action?
- Analysis: The future of pricing - A responsible revolution
- Insurtech Wrisk gets access to over 40 motor brands with Allianz deal
- Analysis: The future of pricing - Tightening the noose