March 2020 marked a significant turning point in the Western World. With the declaration of SARS COV 2 as a global Pandemic, companies were forced to immediately change their operating models to accommodate everything from remote work to in-office cleaning. Over the four preceding months since that declaration, many companies have learned that the plans put into place for continuing their business in the event of disruption were not adequate to meet the continuing operating needs of their firm. Many office workers thought it was a simple matter of packing up their laptops and switching on their VPN at home, but that was not the case. Many firms were able to quickly move most of their operations to accommodate employees working from home. Companies often found that their current Business Continuity Plans (BCPs) did not adequately address all aspects of how the Pandemic affected their business. While it’s true that no one crafts a ‘perfect’ BCP that covers every possible disruption, many companies have been able to take the lessons of these past four months and apply them to their BCPs to help their business better adapt in the future.
First and foremost, companies have learned that while every disaster is a disruption, not every disruption is a disaster. While the Pandemic did force companies to shift operations, companies with more flexible working conditions were able to adapt quickly and continue operating. There was no need for a ‘disaster recovery’ of operations because almost all assets were accounted for. The application of this lesson can be applied appropriately to your BCP by an expansion of Business Impact Analysis (BIA). Often when BIAs are created, they address the worst-case scenario that a company can face…usually the loss of operating assets such as a factory or a data center. Overlooked are lesser disruptions that, while they can still have a drastic effect on business, do not have the same impact on operations that the loss of facilities entails. The good news here is that the Pandemic has provided an excellent opportunity to expand BIA activities to include work disruptions that may not be disaster level events. The Pandemic also provides a useful real-life experience that can translate into valuable information for your BIA and, by extension, your BCP.
This is where an expansion of your firm’s Risk Assessments (RA) can have a considerable impact on the BIA. As stated earlier, BIA’s have often considered the worst-case scenario a company can face while ignoring lesser disruptions. If we quickly examine most companies’ state during the Pandemic, we see that their buildings are not physically affected overall. They still have power, plumbing, and access. The issue at hand is that, based on your location, staff are not allowed to access the building on mass. This means almost no disruption to your back-end IT functions and no need to deploy your disaster recovery resources. Assuming your company has adequate capability to allow employees to work remotely, you will find that the RA will show that the Pandemic is a low-risk event that will only cause a minor disruption as employees shift to working from home. An expansion of the RA into the type of disruptions currently being produced by the Pandemic can go a long way towards future-proofing your current BIA and, by extension, your BCP.
An expansion of BIA alone is not enough. While the information gathered from the BIA is essential, it is arguably more critical to its application to your company’s BCP. In this aspect, companies often learn the harshest lesson of all when it came to BCP…an outdated BCP can be just as useless as having no BCP at all. BCPs are not written and then left on the shelf. The most effective BCPs are treated as living documents and are updated regularly from information derived from BIAs. If your firm has not looked at its BCP in a few years, you should pick it up and see how much is still relevant to your company. Are all the employees listed in the communication plan even with the firm? Does the BCP refer to the current physical location of the firm? These are just some of the most fundamental questions that illustrate the need to keep your BCP up to date with current information and relevant procedures designed to allow for an array of flexible responses to an unpredictable business environment.
The Pandemic has forced firms of all shapes, sizes, and industries to reexamine how they approach BCP and if their current plans are adequate. The Pandemic has also brought to the forefront just how narrowly focused BIA and risk analysis can be. We are currently in a unique working environment wherein, except for essential services, no actual disaster has occurred in that no assets are lost. They are still entirely useable if not always accessible. Thankfully, the Pandemic has also provided real-world data and experience that can be used to apply and expand BCP for any company that wishes too. After all, you never know when the next disruption might hit.
