Business Continuity Planning (BCP) and Crisis Management (CM)

“Noah built the Ark before it started raining”

You might be wondering what Noah and the Ark has to do with business. Like with most things (if not all) in life, one of the contributing factors to success is planning and preparation. Business is no different. A BCP (Business Continuity Plan) is essentially the business asking itself:

• What could potentially go wrong?
• What should I do to prevent it from going wrong?
• What actions should we take if it does go wrong?

The above is asked from the viewpoint of determining negative factors that could impact the ability of the business to continue delivering a product or service. This is applicable to all organisations, from big corporates to SMME’s (Small, Micro, Medium enterprises).

Business Continuity Planning (BCP)

The BCP or business continuity management process covers the following points:

• Determining what the acceptable predefined levels following any disruptive incident should be
• Identification of threats (risk assessment)
• Quantification of impact per risk identified
• Identification of mitigating actions to prevent the risk from coming to fruition
• Identification of mitigating actions for when the threat or risk becomes a reality
• Building a framework to deal with the threat to stakeholders
• Clear Roles & Responsibilities (From the leader to the shop floor worker)
• All processes must be documented
• Proactive testing includes:
  • Simulating the threat
  • Testing the effectiveness of the mitigating actions identified
  • Evaluating people’s knowledge of the process to be followed and actions to take
  • Taking the learnings and updating the BCP

Application of the process should preferably be completed with inputs from a cross functional team or business advisor.

Risk Assessments (RA)

A risk assessment is an attempt to identify all potential risks (events or factors) that may harm an organisation. It also includes the process of analysing and evaluating the risk factors or events identified. These must cover both internal and external risks. Once the risks have been identified the analysis and evaluation should cover the following:

• Task 1: Determine the probability of occurrence
• Task 2: What is the ability of the organisation to detect when the risk will occur
• Task 3: What will the severity or impact of the occurrence be on the business

The above three tasks must be done using a rating scale with each risk receiving a score. Multiplying the task scores will result in a Risk Priority Number (RPN). This can be arranged in descending order to enable you to decide on which risk factor to focus on.

Example: Each task and RPN calculation must be completed per risk factor identified.

Task 1: Probability of the risk occurring with 1 being it will never occur and 10 being that it will definitely occur.

Task 2:  Is it possible to have early warning indicators? A score of 1 will mean it is possible and a score of 10 will suggest that we can almost certainly not be able to detect when the risk will occur.

Task 3: When it does occur, what will the severity on the business be, with 1 being not severe and 10 being extremely severe (Loss of life, extreme financial loss, etc).

RPN = Task 1 x Task 2 x Task 3

Note that there are various other methods to get to some sort of RPN score which can be considered.

Crisis Management

A crisis is characterised by immense danger and harm to people, the environment and business. It is also defined as a time when difficult decisions must be made. Crisis management is concerned with responding, managing and recovering from either an unforeseen event or an identified risk that escalates. Remember, be very aware of the danger the crisis brings but be equally aware of the opportunity it could bring.

As per the illustration crisis management can be sub-divided into three categories based on the intensity of the crisis and the time frames involved.

Under each category, I have listed the actions that would be involved.

• Pre-Crisis
  • Risk Assessment
  • Brainstorm for the obvious & the not so obvious risks
  • Use historical occurrences to make inferences (example: The Spanish flu was an indication that we could experience a re-occurrence of something similar and now we are dealing with Covid-19)
  • Use insights provided by various subject matter experts and world leaders (example: the speech by Barack Obama in 2014 talking about investing in our readiness for a pandemic)
  • Identify who will be affected (internal/external)
  • Not everything is foreseeable but generic categories can be determined
  • Have a clear set of policies and procedures that deals with early detection and prevention
  • Formulate strategies and  tactics  to deal with each crisis
  • Have a communications plan for internal and external stakeholders
    • The communication plan must cover what you do before, during and after a crisis. Remember if you do not communicate, people WILL fill in the blanks
  • Test and update

• Crisis
  • In times of crisis hopefully you can activate your crisis management plan / BCP as the crisis has been identified in the pre-crisis stage
  • Be decisive & humble (Don’t beat around the bush)
  • Be honest
  • Have a customer first mentality
    • All internal and external customers/stakeholders must be considered
  • Focus on the people
  • Show empathy
  • Do the right thing
  • Activate your communications plan

The below table highlights some of the DO’s and DON’T’s

• Post Crisis
  • Yes – Definitely do a post-mortem to learn
  • Do not forget to continue to focus on who has been negatively impacted (People, Environment, etc)
  • When you judge yourself, judge yourself on the following:
    • Your ability to minimise damage
    • Did you find potential successes?
    • Did your reputation stay intact or increase?
    • Where you seen as a credible brand by internal and external stakeholders?
    • Did the pubic see you as honest & transparent?
    • Are you perceived to be a part of the solution or problem?

Conclusion

The above has been my humble attempt to shed some light on what BCP’s and crisis management is all about and some of the typical approaches and considerations. Whilst there is a substantial amount of literature in the public domain, I believe one of the key success factors is that you find a pragmatic implementation approach. Remember if you don’t have a BCP or crisis management plan now is as good a time as any to start the process.

This article has focused on describing what a typical BCP and crisis management process would look like if done in a proactive manner. It also assumed that any crisis that strikes is covered in your BCP and hence managing the crisis is “easier”. Have a read through another one of my articles, Crisis Management: What do I do now that Covid-19 is here and negatively impacting my business? This article will give you some insights into some of the approaches that can be taken if the Covid-19 pandemic caught you off guard.

Author

Dr Kenneth Moodley is an experienced supply chain and business professional with over 25 years’ experience. He has a demonstrated history of working with both big corporates (example: Unilever & The South African Breweries) and SMME’s (Productivity SA) in various industry sectors as a senior Supply Chain Specialist, Leader and Business Coach.

Let’s Take Your Business Further. Ask me how.

Further reading and References

1. Waryjas, MA. Effective Crisis Management
2. Oparanma, AO. Crisis management to ensure effective and continuous performance
3. Effective crisis management: Tools and best practice for the new millennium
4. Bundy, J.Pfarrer MD, Short CE. Crises and Crisis Management: Integration, Interpretation, and Research Development