Every time an unusually severe business disruption occurs, the definition of a “worst-case scenario” is given new meaning.
While the pandemic serves as the latest reminder that organizations should regularly reevaluate their readiness for the next event, this year’s active hurricane season or West Coast fires also underscore the importance of organizations regularly revisiting their level of preparedness.
One reason why many smaller businesses fail to reopen after a catastrophic event is that few of them have a business continuity plan in place. Others have such plans, but they are often poorly drafted, outdated, and rarely if ever rehearsed.
The good news for financial firms is that if they effectively plan for the business impact of a disruptive event, they are more likely to survive it with minimum property damage, minimum employee and customer impact, and minimum lost revenue and reduced market share.
Planning is Everything
A business continuity plan is a document in which a broad range of information, policies and procedures are compiled and ready for use when an event disables the normal delivery of products and services. Each plan is unique, reflecting the business interruption risks and specific mitigation actions on a company-by-company basis.
An advisory firm must address a variety of different events and related business disruptions occurring to each facility in different regions of the country, such as its call centers. On the other hand, firms in a single region may confront a more limited range of disruptions, but the impact of a particularly long disruption can be more severe.
In either case, the business continuity plan anticipates different risks and provides a checklist of mitigation actions once a disruptive event occurs.
Developing the Plan
To draft a business continuity plan, it’s best to form a planning committee whose task is to develop the plan and oversee its execution. It is critical for a member of the senior executive team to champion the work of the committee to ensure their efforts are not derailed by the team members’ other responsibilities.
A business continuity plan generally consists of three basic components — risk assessment and mitigation, emergency response procedures, and business recovery procedures.
In developing the risk assessment and mitigation component, the planning committee typically contemplates a series of “what if” disaster scenarios.
Each scenario considers the vulnerability of each facility to a disruptive event, and then posits the potential impact on the business. A numerical system often is used to suggest the probability of an event occurring and its potential impact. This data helps inform the optimal mitigation actions.
For example, a financial firm dependent on an uninterrupted flow of power and communications to perform normal business operations might rank the impact of a highly probable event causing an outage lasting more than a week as a 9 or a 10 out of 10. Armed with this impact analysis, the organization can determine optimal mitigation actions to minimize adverse outcomes.
The emergency response component of a business continuity plan activates when a disruptive event occurs. An example is a hurricane that floods the premises of a firm, endangering employees, customers and business equipment like computers. Procedures on how to handle these hazards will help minimize their impact.
Finally, the business recovery component of the plan identifies specific procedures to be taken to resume critical business functions and operations to pre-emergency levels. The use of “what if” scenarios is helpful in assessing the impact of an event on different functions and operations, guiding optimal procedures in their restoration.
It is crucial that the business continuity planning committee updates all plan components to reflect the impact of recent disruptive events, such as the pandemic and natural disasters like hurricanes and fires. In other words, a business continuity plan is a living document that continuously changes.
Ben Rockwell is division president, Chubb Middle Market.