A common theme that has been running through our previous business continuity (BC) related blogs, has been the mantra ‘Welfare, Delivery, Reputation’, which provides a great guiding principle for organisations of any size when dealing with or preparing for an unforeseen disruption, incident or crisis.
It should go without saying that the welfare of employees, customers, contractors etc. is your number one priority, when developing an incident management plan (IMP) or crisis management plan (CMP). We say ‘should be’, but we have seen on numerous occasions in BC exercises where welfare can sometimes be forgotten in the ‘heat of the battle’. With delivery, you must naturally strive and aim to be able to continue to deliver critical activities and meet any obligatory, regulatory and contractual commitments.
That leaves us with reputation, which is a tougher nut to crack given the myriad of factors that can impact on an organisation’s reputation or brand*. It is hard enough to manage the different factors during normal business conditions, never mind during a crisis or incident. It involves a fine balance between communication, emotion, internal perceptions, external perceptions and up-to-date information. It’s an art and a science all wrapped together under one banner.
What is clear, however, is that the protection of brand and reputation is a primary reason for organisations to develop a BC strategy and suite of plans. Reputation is, without doubt, any organisation’s most valuable intangible asset and a strong brand is vital to operational and financial success.
* The word ‘brand’ is open to interpretation, but here we’re settling for a person’s perception of a product, service or organisation and is thus synonymous with reputation.
What are the implications for your organisation?
It can be clearly seen that all arrangements made in protecting welfare and delivery are contributing towards the protection of your organisation’s reputation, as a failure to ensure either will lead to your brand being damaged. There are, however, other key considerations to factor into BC planning which will help to protect your organisation’s brand:
Ensure customer communications are included in your planning
Your organisation cannot assume its customers will understand the implications of a disruption occurring at your organisation. You should review your customer communications plan if you normally engage in transactional exchanges, preparing for possible impacts of downtime, checking how you will address potential concerns and identifying anything that could hinder the relationship. As an example, you might want to ensure your plan addresses unfulfilled orders and how you would engage with customers to resolve any such issues.
Understanding your dependencies especially around your suppliers
It is imperative that you assess your suppliers’ BC capabilities and identify their strengths, weaknesses and vulnerabilities. As the adage goes, you are only as strong as your weakest link and you need to be sure you can rely on the various services and products which you currently outsource to be there when you need them. Suppliers need to be able to adhere to the same levels of preparedness as you. If they cannot meet these requirements, you may need to consider steps such as diversification, alternative or back up options or geographical relocations.
Preparing for any scenario
Within BC circles, it is widely accepted that human error, IT hardware or software outages and utility failures are the most likely cause of business disruption. Your organisation, however, needs to be prepared for the unpredictable and this has been borne out so clearly with the current Covid-19 pandemic, both at a local and international level. With regard to the latter, one can argue that countries in Asia with their previous experience of infectious diseases such as severe acute respiratory syndrome (SARS) have proved themselves to be far better prepared and effective in their response compared to their western counterparts.
What should be noted in addition to this general point, however, is that it is often the ‘rising tide’ style disruption that catches out many organisations and can lead to the greatest damage to brand. It is typically where an escalating situation is identified too late for effective mitigation or where a situation has been underestimated. It might be a minor email outage or a software update, a harmless tweet, a social media posting or a misconstrued statement, however, all of these could escalate into potential incidents for your organisation with reputationally damaging outcomes.
Be prompt but not hasty!
This is a tricky one, but your organisation needs to be highly conscious that when responding and communicating to an incident and crisis, it needs to respond promptly but with something that is well thought through, considered and researched (where appropriate). As with URM’s strapline, it’s a case of ‘getting the balance right’. You need to ensure you fully think through the implications of what you are saying and committing to before issuing communications both internally and externally. Having a number of indicative pre-prepared template statements which you can adapt and tailor will help. You also need to think about who will be writing these, who will be reviewing these (if required) and who will be signing these off to ensure the tone is right and you’re not forgetting key elements. You can damage your reputation both by being slow to respond but also by issuing a communication which can be interpreted as being insensitive and not addressing the welfare of those directly or indirectly involved. Exercising your communications will certainly help you be better prepared. Also, when you assign responsibilities for producing and reviewing communications, don’t forget about deputies, to cover for leave and sickness etc!
Testing, testing, testing!
It’s a classic scenario. An organisation spends considerable time and money in assessing its BC risks before determining its strategy requirements and developing the requisite plan or plans and thinking it is then ready and prepared to deal with any BC incidents.
However, until the plans have thoroughly exercised, no organisation can be sure that they will work as well in reality as they do in theory. It is imperative that your organisation looks to extensively evaluate your BC arrangements and how you deal with a range of different crisis or disruption scenarios. Each exercise should be used as an opportunity to make improvements and for lessons to be learned and not be seen as simply a pass/fail for the original draft. The benefits of more exercising will be greater awareness and competence of your staff and more robust plans which will ultimately be an investment in safeguarding your organisation’s reputation.
The overriding message from this blog is don’t ignore your brand or reputation when planning, to do so could have significant and grave consequences. In short, the better your BC preparations are, the more likely it is that the welfare of all those affected by an incident will be prioritised and the more likely you will be able to continue or resume your critical business operations. And that means that not only will you prevent your reputation from being damaged, you may even find it being enhanced.
Why you should partner with URM?
Achieving this optimum balance is where URM excels. We are able to ensure that you gain maximum benefit from implementing ISO 22301 by virtue of our experience of assisting organisations through certification, consultancy expertise (all experienced business continuity managers with real-world experience and understanding of the challenges you face) and our purpose designed BIA and risk management tool (Abriska). Our consultancy services come not only with a 100% certification guarantee but with the assurance that any implemented BCMS will be tailored, appropriate and sustainable. URM’s ISO 22301 consultancy services are also totally flexible and our consultants can provide guidance and knowledge transfer across the full lifecycle or specific areas such as assisting with the business impact analysis, risk assessments, strategies, plans, exercising and embedding in the organisation. Support will be tailored to your specific requirements, which is often influenced by your internal expertise and its availability, timescales and budgets.