Benjamin Franklin once said, “By failing to prepare, you are preparing to fail.” This is particularly true in business, where events that threaten a company’s operations and shareholder value can occur at any time.
Traditionally, companies have simply relied on emergency and crisis response plans, but forward-looking companies prepared for potential significant events by developing a business continuity management (BCM) system, which though wise, was often done with the goal of simply recovering from a natural disaster or other catastrophe should it occur. In other words, just a slightly modified crisis management plan.
But companies today face several potential threats to their business continuity, both internal and external. Coordinating the operations of various facilities spread across different geographical regions, adjusting to changing international trade regimes and regulations, anticipating the impacts of natural disasters on business operations, and managing dynamic global supply chains are just a few of the challenges faced by organizations.
Last year, for example, a major fire at an automotive parts supplier significantly disrupted output at General Motors, Fiat Chrysler, and Mercedes-Benz facilities, and forced Ford Motor Co. to temporarily lay off 3,600 workers, while suspended production affected an additional 4,000 employees.
The Kellogg Co.’s recall last year is another example. In response to a warning from the U.S. Food and Drug Administration, Kellogg conducted a massive nationwide recall of its Honey Smacks breakfast cereal last summer due to the potential for salmonella contamination. The company recalled an estimated 1.3 million cases of the cereal from the U.S. market.
Potential threats and disruptions can put a company’s operational performance, business continuity, right to operate and ability to deliver consistent value to shareholders at risk. That’s why successful companies view BCM as much more than just a way to simply recover from a significant incident. They view business continuity as a way to anticipate changing conditions, adapt to those changes and, more importantly, to thrive. In other words, they become more resilient.
The British Standard Institute’s Standard BS 65000 defines organizational resilience as, “The ability of an organization to anticipate, prepare for, respond and adapt to incremental change and sudden disruptions in order to survive and prosper.” This means resilient organizations are those that demonstrate the ability to anticipate a disruption and assess all risks and threats that cause a disruption; develop proactive plans and conduct necessary preparations to protect the company from disruption; effectively implement those plans to successfully respond and recover from the disruption; and then adapt to the “new normal” resulting from the disruption to not just resume operations but learn from the experience to operate more effectively moving forward.
A thorough BCM framework for building organizational resilience proceeds through five stages: Prevent, Prepare, Respond, Recover and Learn. (See Figure 1) As mentioned earlier, though many companies have an emergency response or crisis management plan in place, focusing only on this Response phase is not enough. All phases are necessary to effectively overcome disruptions, especially Prepare, Recover and Learn.
Organizations can Prevent disruptions by identifying all risks across the organization and supply chain. These risks should be assessed and prioritized based on the impact they can have on the organization’s critical functions, brand and reputation.
- Companies should Prepare through proactive strategies, plans, exercises and education for the purposes of mitigating risk and its consequences. They should put comprehensive plans in place and conduct exercises and simulations to anticipate risk and disruptions with the goal of mitigating their effects.
- When a disruption occurs, companies then Respond by applying the strategies and plans they prepared to real life events.
- After the necessary response to a disruption, companies must then Recover by restoring the organization’s critical functions in a specified timeframe and in priority order.
Many organizations fail during this Recover phase, which can last for years. For example, British Petroleum’s (BP) shareholder value plummeted 55 percent following the Deepwater Horizon incident, according to the market research website Market Realist. But this large multinational corporation eventually recovered, and its stock price increased. It is important for companies to ask themselves, “How long could we withstand such a significant decline in share price?”
- Finally, it is important that companies Learn from the successes and failures of the incident or disruption and incorporate those learnings into improving the Resiliency Cycle for the future.
For such a BCM system to be most effective and make companies more resilient to disruptions, it must be instituted via a holistic approach that involves the entire business in the planning, preparation and execution process. Everyone in the company must understand why it is important and be committed to its development and ongoing improvement. Company leaders, in particular, must demonstrate their commitment to the BCM plan to workers companywide and encourage them to share knowledge and experiences that can improve it. Leaders should also make sure different groups or facilities are not operating in silos and should encourage a company culture that proactively looks to reduce risk that can lead to or exacerbate a business disruption. (See Figure 2)
If you are unsure whether your company needs a strong BCM program, consider the example of Pacific Gas and Electric. Failure to effectively plan for business continuity following incidents that led to wildfires, the destruction of entire communities, and sadly, the deaths of 86 people left the California-based company facing more than $30 billion in wildfire liabilities (“PG&E Gets Burned for California Wildfires,” Forbes, February 7, 2019). Soon thereafter, the CEO was fired, and the company was forced to seek bankruptcy protection.
Developing a holistic BCM system will at the very least allow companies to ensure continuity and survival of the business after a significant event occurs by enabling resumption of critical functions, minimizing loss to customers, and reducing exposure to loss. But looking at BCM through the lens of building organizational resiliency will enable companies to do more than simply respond to an incident. It will empower them to maintain control and successfully navigate various business disruptions that would otherwise take a toll on operations and reputation.
Nicholas Bahr is the Global Practice Leader for Operational Risk Management at DuPont Sustainable Solutions. DuPont Sustainable Solutions (DSS) is a leading provider of operations management consulting services that enable organizations to protect their employees and assets, realize operational efficiencies, innovate more rapidly and build workforce capability. By leveraging its DuPont heritage, deep industry and business process expertise, and diverse team of expert consultants, DSS helps clients turn operations management into a competitive advantage.
