August 09 National Newsletter   Business Disruption: Is Your Firm Prepared?   Written by Mark Jaski Director BLUESPINE Australia

Meet Mark Jaski

 

 

 

Business Disruption: Is Your Firm Prepared?

 

We live in a competitive world where we need to service our clients as and when required because if we don’t, someone else will.

 

Disruption of service is not readily tolerated and for some it can mean the end of key client relationships or worse. In recent years Business Continuity Management (BCM) has become increasingly topical, largely due to increased awareness resulting from natural disasters, terrorism and major infrastructure failures. Yet despite all this “awareness” there is still a high level of complacency and many firms have done very little to address the risk of business disruption and to this day remain largely unprepared.

Business disruption: when is it your turn?

 

“There cannot be a crisis today; my schedule is already full” - Henry Kissinger

There is never a good time for a crisis or business disruption, but they happen all the time. Statistics tell us that large organisations will suffer a major business disruption or crisis once every five years. Research also tells us that those who are prepared will usually manage these events well with many going on to be stronger organisations whereas those that are unprepared will suffer the greatest impacts and a higher instance of business failure.

The reality is that all firms will endure business disruptions. For most it won't be a cataclysmic event, but will be the result of everyday incidents such as major technology failure, utility failure, gas leaks, accidents, malicious attacks and so on. The question for any firm is not “if” but “when” will you have a disruption event, what impact will it have and how will you manage it?

What is Business Continuity Management?

“An ounce of prevention is worth a pound of cure.” - Benjamin Franklin.

BCM is not just about backups and writing a plan, it is a risk management discipline. Per the Australian Standard HB221:2004: “Business Continuity Management provides the availability of processes and resources in order to ensure the continued achievement of critical objectives.” In practical terms this means implementing a range of measures, including policies, plans, tools, controls and other resources to enable a firm to effectively build resilience and manage and minimise the impacts of business disruption.

An important theme in BCM is prioritisation. Imagine you lost all your technology at once. It would be nearly impossible to restore all your technology simultaneously so you must prioritise the restoration processes. In developing BCM capabilities across a firm this concept is extended by determining what are all the critical dependencies for the successful operation of the firm and then effectively prioritising them by assigning failure tolerances, that is how long can you operate without the dependency. In effect the shorter the tolerance the higher the priority. This aspect is usually addressed through a Business Impact Analysis which in turn drives the construction of the plans, tools, controls and other resources.

BCM typically encompasses several interrelated streams including:

• Emergency Management
• Crisis Management
• Business Continuity Management
• Technology resilience and recovery (Disaster Recovery Planning)
• Incident management.

BCM is not a one size fits all proposition. While a common process may be followed, the outcomes must be appropriate for the individual firm in order to meet continuity objectives and of course to optimise costs. For some organisations the solution is to throw endless dollars into resilience measures, but for most this is neither an option nor necessary.

Why should law firms manage this risk?

“It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently.” - Warren Buffett

For any law firm a good reputation is essential, but good reputation is not just about legal skills. It is also about how well you manage the business. Today BCM is an essential component of risk management and good corporate governance. However, there is a broader set of drivers for BCM:

• Service delivery – Firms must be able to service clients as and when required. While some may be understanding if you suffer a disruption, many will not be and client relationships can be severely tested.
• External demands – Clients, suppliers, regulators, financiers, insurers and many others now look for assurance that business operations are stable and that the risk of business disruption has been adequately addressed.
• Revenue preservation – Business disruption nearly always results in lost fees and missed business development opportunities. The longer the duration the greater the loss.
• Legal action – Your failure may flow to others leaving you open to legal action for non compliance or breached duty of care.
• Brand equity – How well business disruption and crisis is managed directly impacts your reputation and market share.
• Direct costs – There are always direct costs associated with disruption which are inversely proportional to the level and quality of BCM capabilities.
• Employee – Staff want comfort that disruptions will be effectively managed and that their safety and welfare has been considered.
• Supply chain – The upstream failure of key suppliers and partners have the potential for major operational disruptions downstream.

The benefits and costs of BCM

“The Chinese use two brush strokes to write the word 'crisis.' One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger - but recognize the opportunity.” - Richard M. Nixon

It is true that BCM is predominantly geared to mitigating the negative impacts of business disruption. However, smart firms will also use BCM to identify opportunities for improvement. Both disciplines begin with operational review and it is small increment in work to pick up the other side.

A well designed BCM program can deliver:

• Increased resilience to disruption
• Processes to effectively manage disruption and minimise the impacts, including costs, of disruption
• Business improvements through process, technology, structural and other enhancements
• Management of uninsurable risks
• Reputation enhancement
• Supply chain certainty

In designing resilience and continuity strategies it is important to consider the associated costs. Effective strategies will undoubtedly minimise the costs of disruption, but it doesn’t make sense if the strategy cost outweighs the benefits. For example, it usually doesn’t make financial sense to provide immediate failover for technologies that can be offline for long periods without significant operational impact.
 

The cost of the program itself is also a consideration. In establishing a BCM program firms must consider factors such as:

• Budget
• Timeframes
• In-house BCM expertise
• Available firm resources
• Technology capabilities
• Continuity objectives
• Expected benefits
• Objectivity

Ultimately it is all about getting the right mix. It is tempting to go down the DIY road based on the perception it is the cheapest or to outsource the process completely for convenience sake, but both can be false economy as neither of these options is cost effective or delivers optimal results. The answer for most firms is somewhere in the middle so it is important to invest time up front in designing a BCM program geared towards your specific needs.

Where do you start?

“Though no one can go back and make a brand new start, anyone can start from now and make a brand new ending.” - Carl Bard

All firms, knowingly or unwittingly, will have taken some steps in BCM. However, most firms are also guilty of crimes of passion - their perception of their own capability is subjective and often inflated leading them to believe they are much better prepared than what they really are. This is usually a product of misinformation and of not really understanding BCM in their own context.

The logical starting point is to objectively assess your firm’s current capability using good practice guidelines, standards or other independent references as a baseline. An effective review should reveal any deficiencies and start the process of designing a BCM program and determining appropriate continuity strategies.

For the ensuing program critical success factors will include:

• Visible senior management support
• Stakeholder engagement
• Robust project management and governance
• Effective collaboration
• Sound methodology and tools
• Clear and measurable objectives

A game of chance

“I will prepare and some day my chance will come.” - Abraham Lincoln

Often we hear that old chestnut “It won't happen to us.” Yet, people still think it is important to backup data, have security, implement controls, use contracts and so on. If we truly believed in the probabilities of chance nobody would play lotto, but many people do on the basis that one day their numbers will come up. It is no different for BCM or indeed life itself.  Everyone’s number comes up sometime and it is a question of what you have done to prepare for it.