COVID-19 – Stress testing your BCP

Business continuity risk (limited to business disruption, for the purposes of this discussion) has been on the radar on risk registers for many organisations, especially those with mature enterprise risk management environments. However, very few have considered the context of a national (or global, for that matter) epidemic on their business. Until a few months ago, this would have been nothing more than a figment of the imagination of movie producers or novelists. To be fair, it’s not that business hadn’t hypothesised a national or global pandemic – it’s that the likelihood of this having materialised would have been assessed at close to zero.

With biochemical warfare, a real possibility in a tense geopolitical environment, the plausibility of a similar crisis in the future is no longer as improbable as it may have been just months ago. It’s taken a natural virus to highlight just how exposed we are in this respect.

Continuity/disruption risks have traditionally focussed on conditions that typically relate to failures in infrastructure. These generally assume a catastrophe, at a localised level, often restricted to a single site. Importantly, as South Africa has been blessed by not being predisposed to the wrath of Mother Nature (think meteorological extremes, seismic activities, volcanos etc.), business continuity/disruption considerations and measures are, generally, not aligned to the resilient measures required in the event of a large scale catastrophe. In fact, most Business Continuity Programmes (BCPs) presume the availability of human capital and that human resources will merely move from the distressed location to the alternative recovery location.

With COVID-19 requiring people to lock down, business has had to stress test its BCPs. In essence, very few businesses have prepared for continuity measures requiring people not to actually be present at the organisation’s nerve centre. COVID-19 has demonstrated the vulnerability of the status quo and paves the way for risk managers and disrupters to think about mitigation measures where BCPs aren’t just recovery sites. BCPs in 2020 would require thinking about alternative working models. If there was ever a catalyst for business to reassess its BCPs and embrace the opportunities brought by the new way of work by the fourth industrial revolution, this would be it. It’s not inconceivable that next level BCPs will embed continuity protocol with limited human intervention.

Matters for consideration:

• Proactive Change management: With a protocol requiring a different operating style, managing change is critical. You don’t want to have to deal with this for the first time in a live environment.
• Artificial Intelligence (AI) and Robotic Process Automation (RPA): Whilst there are, sometimes, labour and/or political resistance to AI and RPA under “business as usual” circumstances, there is no reason why this shouldn’t be built into BCP’s to take care elementary elements of the business during disaster response circumstances.
• Stakeholder management: Whether it’s your clients who want to know if you are still open for business, your suppliers who want assurance that they are not exposed to credit risk, or your employees who are anxious about their future, communication is critical. Your BCP needs to take into account that the communication protocol is adequate to meet the demands of your multiple stakeholders.
• Agility: If you need to execute on a BCP, depending on the seriousness of the trigger, you are not in a “business as usual” mode. You may be required to make quick decisions to mitigate unforeseen risks or capitalise on unexpected opportunities. This can’t be achieved if the BCP protocol does not create an enabling environment to support agile decisions and actions. This must be done within the context of balancing the risks attached with embracing the principles and practices of good governance.

Author 

Ghitesh Deva