Typically if and when people and organizations prepare for disasters, such scenarios are expressed in terms of if they occur rather than when they occur.
However, here in Cayman, the lessons learned as a result of Hurricane Ivan and its aftermath, have reinforced the message that disasters do occur and that people and businesses need to be prepared.
Unfortunately, executives of many businesses have learned the hard way that the value of risk mitigation is indispensable and critical to the viability, longevity and profitability of an organization. Enter the role of business continuity.
The ultimate goal of business continuity planning is to establish a contingency plan to protect an organization and its future from the effects of disaster. A reliable and tested BC plan can mean the difference between survival or failure in the face of such events that occur well beyond the control of an organization, and ultimately enable the continuity of the business’s key functions and operations.
This provides the organization with a competitive advantage in obtaining and retaining customers in the good times as well as in the face of disruption.
In fact it has been revealed that actions taken and decisions made in the first few hours of disruption to the business are critical and can have a significant financial impact. When faced with disruption, companies with effective business continuity plans in place were more likely to make the best business decisions and take the most effective actions to ensure that its critical functions were able to operate and able to deliver a minimum acceptable level of customer service without incurring significant additional expenditure.
A recent report in the Times of London revealed that one in five small businesses suffers some sort of severe disruption each year.
However, Computer Weekly magazine reported that 60 per cent of businesses that experience a severe fire or flood (and which do not have a business continuity plan in place) never recover.
The results of recent research have further indicated that an organization can expect to suffer serious disruption at least once every five years.
Such disruption may be the result of a variety of causes including loss of IT, people, power, telecoms, or skills; high winds, floods, or other in climate weather; threats to employee or customer health and safety; product safety concerns; negative publicity affecting reputation, image or brand; loss of access to site; disruption of supply chain; or fire or other environmental impact.
In the Cayman Islands, we have been preoccupied by preparing for our main threat, which of course is hurricanes; however, in light of being an island nation we cannot neglect our vulnerability to the variety of other possibilities that may pose the threat of disruption.
Though globally we have seen the effects of 9/11, Hurricane Katrina, the London Bombings of 7/7, and the like, a recent survey conducted by Deloitte and Touche LLP and the CPM Group indicated that only 50 per cent of companies surveyed have corporate business continuity plans in place.
The reasons accounting for the 50 per cent of companies that do not have business continuity plans in place were captured by the following:
• Denial. The mentality that it won’t happen to me.
• Underestimation of threat. The failure to recognize that threats are not just terrorism and hurricanes, but can take many other forms.
• Low priority. Acknowledgement of the need for business continuity, but listing it behind other pressing business issues.
• Underestimation of preparedness. Believing that backed up data and fire extinguishers will be sufficient protection.
• Cost concerns. The misconception that a robust business continuity plan is high cost and resource intensive. However the initiation of a comprehensive risk assessment and thorough business impact analysis is not financially draining.
On the flip side, the 50 per cent of organizations who did have a business continuity plan in place were influenced to do so as a result of the following:
• Regulatory compliance, i.e. Sarbanes-Oxley.
• Recognition of Risk Mitigation by Management
• Protection of Stakeholders i.e. Protection of shareholder investment.
• Recognition of Competitive Advantage and Financial Profitability in the face of disruption.
As many of us here in Cayman are acutely aware, the burden of having suffered through the experience of a major disaster causing disruption ignites a heightened level of future preparedness and risk mitigation.
While it is easy for us to become complacent during the hurricane off season, now is the time for organizations to develop, enhance and test their business continuity plans and to ensure that they mitigate a variety of threats.
By establishing a robust business continuity plan, a business avoids taking unnecessary risks and protects its people, clients, future, and profitability.
Julia Plumley, BA, ABCP, is a risk specialist and DRC coordinator at Deloitte. She is professionally certified to practice business continuity by both the Disaster Recovery International Institute and the Business Continuity Institute, for which Deloitte (Cayman) act as Caribbean regional representatives. She has a Bachelor of Arts, and Bachelor of Physical and Health Education from Queen’s University, Kingston, Ontario, Canada. She can be contacted at [email protected] or via + 1 (345) 814-3484.