Posted by Fiona Mostyn

“Physician heal thyself” – so says the well known Biblical proverb so often  used whenever the opportunity arises for companies to avail themselves of their own services.

On arriving at our offices on the morning of Friday 11^th March, we were met by a crowd of bewildered people standing outside. Our building is a large tower block in the centre of town populated with businesses of different sizes and offering a diverse variety of services across the whole business spectrum including football team management, recruitment, wind farm developers, charities and accountants to name just a few. We were informed by the building’s management that overnight on Thursday a hot water pipe had burst on the fifth floor leaking through the night and causing devastating damage to businesses on the 4^th and 3^rd floor. After the assessment of the situation, it was determined that 17 different businesses were affected in all. Of the 9 floors in the building, the 3^rd, 4^th and 5^th floors were declared unusable and businesses on these floors, including ours, were prevented from entering their premises.

So what to do next? Unlike many of the fellow tenants of the building stood outside in the street, all of our staff were briefed and immediately knew what we had to do next. Firstly, those present decamped to our local Starbucks and referred to our Business Continuity Plan. With our CEO present we had a hard copy of the plan available, which is always kept on his person, and immediately set to work on working through our staff communications via our mobile phones. Our telephones were immediately diverted and our IT back up systems and emergency management location was put on standby as we assessed the severity of the situation.

As more information emerged, it seemed that being on the 3^rd floor we had been one of the least affected offices, suffering only a small amount of water damage to the floors, and had fared better than our colleagues on the 4^th floor whose ceilings had fallen through and were facing up to 2 inches of water on the floor. Given the likely short term nature of the interruption and being Friday, we resolved to continue working from home via webmail and review the situation on Monday. On Monday morning we were back in the office and, after electrical testing, given the all-clear to resume business as usual despite being surrounded by dehumidifiers and smelly carpet!

Despite spending our working lives engrossed in business continuity, it still came as no less of a shock when we discovered we may have to invoke our own plan. It is also easy to forget the human aspect of the devastation which we don’t often come across in planning to be prepared. Having a plan in place did not make it any easier to see colleagues walking out of the building in tears, after first seeing their ruined offices or seeing the office management bearing the brunt of angry tenants who had no back up for not being able to access their premises. On reflection, we were prepared and our staff informed and confident of how we would continue, but it is not easy to sit smugly now when we know that other businesses in our close knit community may be in the next wave of statistics that we frequently quote, of businesses who do not survive such incidents.

Tweet

In the last few weeks there have been some well publicised negative feedback stemming from high profile business interruptions at Vodafone and Gmail. Negative messages about a company can now buzz around the internet with just a few clicks and the words themselves can be incredibly damaging. Here is a small selection of some of the negative comments on Twitter and Facebook:

“@vodafoneuk any chance we will be having a functioning network today? which IDIOT signed off your DR plan? (In W3 London still no service)

@VodafoneUK Why can’t Voda put something on their website telling customers what is going on! Not happy

@VodafoneUK Any estimated time for a fix? This is a joke, really is. Never had any of these issues when I was on #O2

@gmail First, GMail goes down (_still down_), then a #spam inundation. What next, Google, locusts? #gmailfail Tell users what’s going on!

I’ve been without network for two days now this will be day 3 yet you say network has been restored!!! you’ll still want paying on time I guess – 3 days!!! No you’ll want full amount or you’ll cut me off, whatever happened to good customer service…….”

Not something that anyone involved in a business wants to see, let alone get into the local or national media (e.g. the BBC’s Dot.Rory blog) who are now relying more than ever on social media to gauge the opinion of the public.

These events highlight several questions and key issues surrounding reputation management during a crisis.

• How can a business ‘control the message’ without going against the ‘spirit’ of social media or neglecting its personal connections?
• In an age where people expect more information more often how much and what sort of information should be placed on the internet?
• Can you engage proactively with social media in a recovery situation, or should your response be reactive?

These aren’t questions that can be easily answered but it is clear that, as in many cases, proper planning will go a long way to mitigating the effects of any incident damaging to a business’ reputation. Although their BS25999 certified Business Continuity Plan may not have worked 100% this time, Vodafone will no doubt be learning the lessons and will be even better prepared should another problem occur. This continual improvement is a vital step when it comes to actually activating your plans to get the most out of them. A recent survey on the activation of disaster recovery plans showed that many plans have problems but “none of the activations reviewed resulted in complete failure.” A BS25999 aligned or certified plan builds resilience into an organisation and helps it to cope with changes and new developments which might otherwise harm inflexible businesses that aren’t keeping up-to-date.

Whether these events will do long term damage to the reputation of Vodafone and Gmail as reliable technology platforms remains doubtful, there were even some supportive comments on Facebook. However the place of social media in our society is only going to expand alongside its ability to damage the reputations of businesses, making good planning more vital than ever.

Tweet

With the new ISO standard for Business Continuity (22301) currently at the enquiry stage (or 40.20 in standards language), another continuity standard will be added to the fold. What should those looking for gold standard continuity be looking for and what impact will ISO22301 have on the continuity standards stage?

What are the standards out there?

Here are just some of the standards that exist around continuity.

• BS25999 – Specification for Business Continuity Management
• ISO22301 (not yet published) – Societal Security, Preparedness and continuity management systems
• BS10012 – Data Protection, Specification for a personal information management system
• BS25777 – Information and Communications Technology Continuity Management
• BS31100 – Risk Management Code of Practice
• ISO31000 – Risk Management, Principles and Guidelines
• ISO17799 – Information Technology, Code of practice for information security management
• NFPA1600 – Standard on Disaster/Emergency Management and Business Continuity (USA)
• ISO22399 – Societal Security, Guideline for incident preparedness and operational continuity management
• ISO24762 – Guidelines for Information and communications technology disaster recovery services

What should you be looking at?

There is only one standard that exists right now that will give you peace of mind and a robust business continuity plan. BS25999 is THE industry standard and puts in place a full management system which will allow your organisation to survive a denial of access to your critical business functions, even in the event of the unforeseen. The British Standard is also completely certifiable allowing you to easily demonstrate your organisation’s commitment to resilience.

This is not to say that other standards are unimportant, but when it comes to Business Continuity, only BS25999 will give you a complete continuity assurance from IT to office space.

What about ISO22301?

Where then, will ISO22301 fit into the picture when it is eventually published? All the indications point to ISO drawing heavily upon BS25999 for its continuity standard and any changes will probably be very minor. There has been some suggestion that there will be less focus on contingency arrangements, but this is very unlikely to affect organisations looking to add ISO22301 to an existing BS25999 certification. If you’re thinking of waiting for the new standard before committing yourself it would be better to start now because the ‘good management systems’ principals will remain constant. The quality assurance and commercial benefits to your organisation of acting now will FAR outweigh the negligible (if any!) costs of tweaking your arrangements to the new standard.

By Tony Gimple

It’s been a busy year for the business continuity world with many major crises. Here are some of the major events and statistics of 2010.

January

The Government commissioned a review of England’s transport resilience in the wake of heavy snow.

• 58% of small business decision makers claimed they suffered as a result of the heavy snow
• The Environment Agency reported the cost of the 2007 summer floods on homeowners and businesses was found to be £2bn

This year the figures look to be even worse.

February

The Federation of Small Businesses published the results of their survey into the effects of the winter weather.

• One in seven employees struggled to get to work
• 40% of businesses suffered a disruption of services and goods
• 29% of businesses saw a loss of growth and demand
• 18% lost access to their premises
• 11% had to close completely!

March

In March the Chartered Management Institute published its regular Business Continuity Management survey. It found that:

• 93% of businesses were affected by the snow
• 79% of managers felt that their continuity plan reduced the impact of the disruption

April

April was a month of big worldwide news. The explosion of BP’s Deepwater Horizon Oil Rig caused a massive oil spill in the Gulf of Mexico, an unpronounceable Icelandic volcano grounded air traffic and there was a financial meltdown in Greece.

May

May saw the British general election and the formation of the first coalition government since World War Two. The Conservatives and Liberal Democrats set out a coalition agreement which contained, amongst other things, an aspiration to spend 25% of the procurement budget with SMEs. Also in May the BCI published its report into the link between continuity management and business insurance, finding that a business continuity management system could help insurers and businesses in a number of profitable ways.

June

Marsh published their report into BCM in the EMEA. Their main finding was that business continuity is becoming an integrated part of organisations’ overall approaches to risk and risk management. Some notable statistics were:

• 83% of respondents felt that senior managers understood and provided support for business continuity
• 67% felt that their continuity arrangements covered supply chain risk
• Between 2008 and 2010 13% of businesses surveyed had suffered a major loss due to supply chain failure

July

Data security began to come under closer scrutiny in July with the first batch of documents released by whistle blowing website WikiLeaks. The cost to businesses of the Buncefield oil depot explosion was revealed to be nearly £10m and a new National Flood Emergency Framework for England was published by DEFRA.

August

In August Crisis Survivor welcomed two new faces to the board of Directors. Michael Walker became our Chairman and Richard Vardy became a director. Both appointments have bought a wealth of experience to the company. We also announced our partnership with Cowens Survival Capability.

September

In September the Crisis Survivor team grew again with the appointment of Fiona Mostyn as Marketing Manager. Fiona has brought a great deal of experience to the company having previously worked on communications and marketing initiatives across a range of sectors from finance to software.

October

October saw the coalition government announcing its Strategic Defence and Security Review which anticipated cyber attack as being the most dangerous threat facing the UK and its economy today.

November

In November the Minister for the Cabinet Office, Francis Maude, laid out a package of measures to make procurement easier for SMEs, which include a new online portal to go live in March 2011 as well as an online consultation of SMEs experiences with government procurement.

A report by CII found that:

• Whilst 90% of claims practitioners thought that a continuity plan could make a difference to insurance claims
• only 45% of brokers thought the same

December

This month we’ve seen the dangers to private businesses of cyber attacks with the websites of Visa, Mastercard and Paypal being targeted by pro-Wikileaks ‘hacktivists’; and, to finish the year where it started, yet more chaos and business interruption caused by heavy snow.

An article in Insurance Times revealed that:

• Weather was the greatest cause of business interruption, followed by loss of IT, utility outage and supply chain failure
• Business continuity is rated “highly” or “very highly” by 79% of senior managers
• 47% of respondents require their suppliers to have a business continuity plan

Crisis Survivor would like to wish you all a very Happy Christmas and a prosperous and safe New Year.

Cyber threats have hit the headlines in a major way since the WikiLeaks embassy cables story began to hit the media. Initial government concerns were about the security of their own documents, hoping to avoid the acute embarrassment currently being felt in Washington. However David Cameron’s national security adviser has raised greater concerns about the security of government websites in the wake of the high profile ‘hacktivist’ attacks on commercial websites.

Businesses of all shapes and sizes need to sit up and take notice of this threat, particularly in light of the SDSR identifying it as a ‘tier 1’ threat to national security AND the national economy. A recent study by Ipsos-Mori on behalf of cyber security specialists Detica found that most of the large companies surveyed felt their cyber security was up to the task, a view no doubt shared by Visa, Mastercard and PayPal who all suffered some interruption from the attacks of the hackers.

In the same survey over half of the respondents felt that an attack which exposed customer data or internal decision making processes would harm their competitiveness. I know that if I was worried about my personal data being secure at a company then my business would go elsewhere! For many companies this loss of customer confidence and reputation stemming from a major crisis can mount up on top of business interruption to devastating effect.

If there’s one thing to be learnt from this story it’s that businesses need to have rigorous and effective IT security/management systems AND a plan for how to deal with the worst should it occur. It’s no use saying that the ‘Titanic is unsinkable’ and then working out what to do AFTER there’s a great big hole in your boat!

It’s not surprising that lots of small and medium sized businesses are worried about the impact that the harsh winter weather is having on their ability to function. Lloyds TSB Commercial found that the snow and ice at the beginning of this year cost SMEs £7bn and, according to YouGov, 58% of small business decision makers felt that their company suffered from the extreme weather despite over three quarters of them feeling adequately prepared.

The following are just some of the steps businesses can take to help them function effectively throughout the cold weather:

1. Plan in advance

You’ve heard the warnings and seen the weather reports, but thinking about your response on the day when you open your door to a huge snowdrift and failed communication networks is too late. Will your staff know what to do? How can you contact them? Are your premises secure?

2. Communicate with your staff

Once you have a plan, communicate it with your staff so they know what to do if they can’t get to the office. Designate contacts e.g. line managers who will be able to keep people up to date with events.

3. Remote working

Ensure your key personnel are able to work remotely by equipping them with the tools they need to continue their jobs even if they can’t get to the office.

4. Communicate with your customers

Keep your customers updated with your business status. Redirect phones and post updates via web and social media. Try to keep open channels of communication so they are aware what the impact for them will be and know as soon as possible when you are up and running again.

5. Know what’s essential to your business?

What essential functions do you need to perform in order to get your business through this period? Could you prioritise your functions or make different arrangements? Your suppliers could also be affected by the weather. Consider alternatives you can resort to, in order to keep your business moving.

A Business Continuity Plan will help you address any situation in which you are denied crucial business resources or lose critical business functions. Analysing risks to your business from all sources, including environmental threats such as extreme weather and flooding and help you put in place contingency plans to deal with any business interruption.

A comparative analysis by Chartered Insurance Institute (CII) revealed some significant divergences of opinion between insurance broking and claims practitioners, with 90% of claims practitioners stating that business continuity plans make a difference on eventual claims; unfortunately only 45% of brokers shared this view.  This means that almost half of insurance brokers may not be representing your interests in the best possible way and could be costing you money.

The report calls for more ‘joined up thinking’ in regards to continuity with the CII stating that “Businesses need to see clearer insurance benefits from implementing valid business continuity plans.” The report also calls for insurance professionals to have greater consistency regarding the overall benefits of a Business Continuity Management System, benefits that can enhance any business and provide greater reassurance to your insurers that resilience is an important part of your organisation.

The CII went on to say that if you had a Business Continuity Plan you could achieve at least one of the following:

• Reduced price on the premium

• Cover to be provided where it otherwise would not have been

• Reduce the level of cover purchased

According to interviewees, continuity plans provide the following key benefits:

• Understanding which services are vital to the organisation in the event of an incident

• Peace of mind and greater certainty

• Quick recovery if an incident occurs

• Stop dramatic incidents becoming crises

The CII report represents a clear indication of the cost saving elements of Business Continuity Planning. We are interested to hear your experiences of this and we’re conducting a poll into your experiences with insurance brokers and whether they’re asking about or recommending Business Continuity Plans.

CII Report