The rapid spread of the COVID-19 pandemic has left not-for-profit organisations, businesses and governments scrambling to adjust to a rapidly changed world. Pandemics and other disaster scenarios often seem random and uncontrollable. Is there any point in trying to prepare for the unknown?

Business continuity planning enables us to think through the potential impacts of adverse events, and ensure we have in place the elements needed to respond effectively. If your organisation has an existing business continuity plan, it has likely been tested during the pandemic. If not, you will have responded as best you can 'on the fly' to new restrictions, health impacts and supply issues. In either case, now is a great time to reflect on the challenges our organisations and sectors have faced, and to create or refresh your organisation's business continuity plan to build resilience for the future.

This first article in our business continuity planning series provides an overview of the process.

Icon for Creative Commons Attribution-ShareAlike 4.0 International License

This article is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

 

Preparing for the unknown

Pandemics and other 'black swan' events create sudden changes in our context which mean that our normal ways of operating are no longer functional. For community-based organisations, these events are also times when our services are even more important in supporting vulnerable people and working towards recovery.

While it's not possible to predict exactly when these events may occur and how they will unfold, what is certain is that from time to time major external events will challenge our ability to continue operating. There are common themes across the impacts of these events on our organisations and communities, which enable us to prepare in advance for the types of responses which may be needed.

Business continuity planning is a key framework for identifying how adverse events may affect our work, and for developing and testing our responses to these events ahead of time. This can make the difference between a safe and effective response which protects the wellbeing of communities, and a slow and poorly thought through approach that places staff, clients and organisational viability at risk.

Amid the pressures of day-to-day operations and competing pressures on management and Boards, it can be difficult to get business continuity planning to the top of the priority list. However, it is an investment in organisational sustainability that returns major benefits when times get tough.

Black swans

Organisations face many types of risks all the time. Risks vary widely in their levels of likelihood and consequence. Some risk events occur relatively frequently and as a result are reasonably well recognised; organisations typically have existing strategies of some type in place to manage these. Examples include technology failures, outdated buildings or equipment, day to day work health and safety issues, poor service quality, cashflow shortages, industrial relations issues or conflicts among staff.

Other types of risk events occur relatively infrequently, but can have very high impact. Nassim Nicholas Taleb coined the term 'black swans' to describe rare and unpredictable outlier events. These events typically sit outside of our normal operating frame of reference, but when they occur they have a major impact on our work, making it no longer possible to proceed with 'business as usual'.

A pandemic such as COVID-19 is a great example of a black swan event. Other examples include:

  • Sudden major change in legislation or regulatory frameworks
  • Sabotage, for example major IT hacks
  • Supply chain breakdown
  • Natural disasters such as earthquakes, floods, storms, fires or droughts
  • Major financial events such as stock market crashes or recessions
  • War, terrorism or civil unrest
  • Major environmental issues such as sudden pollution or radiation events

Events of this type are often not well planned for due to their rarity, although this depends on the salience of these events in our normal operating context. For an epidemiologist, a pandemic may not appear especially unlikely or surprising. Similarly, organisations operating in regions where fire, flood or other natural disasters are more common, are more likely to have well established responses to these events.

Business continuity planning

Taleb suggests that rather than attempting to predict black swan events, we should focus on building robustness to negative events, as well as boosting our ability to make the most of unexpected positive events.

Building robustness requires identifying areas of vulnerability to unexpected events, and developing systems, processes and approaches to our work that minimise these vulnerabilities and enable us to effectively navigate through them when they occur. These are the key concepts behind business continuity planning.

Diagram of business continuity planning process within Prevention, Preparedness, Response, Recovery model

Figure 1: Business continuity planning process

A business continuity plan prepares an organisation to continue operating during and after an incident or crisis.

The Prevention, Preparedness, Response, Recovery (PPRR) model has been used as the basis for emergency management approaches in Australia and provides a useful framework which can be applied across a wide range of sectors and organisational types. This model has four components, shown in Table 1.

Table 1: Four components of PPRR (comprehensive) model for disaster management

Process

Documentation

Prevention
Take actions to reduce or eliminate the likelihood or effects of an incident

Risk Management Plan
Assesses risks and identifies strategies to minimise their likelihood

Preparedness
Take steps before an incident to ensure effective response and recovery

Business Impact Analysis
Identifies critical business activities that are key to continuity, and ways they may be affected by incidents

Response
Contain, control, or minimise the impacts of an incident

Incident Response Plan
Contains all the information needed to respond immediately before, during and after an incident or crisis

Recovery
Take steps to minimise disruption and recovery times after an incident

Recovery Plan
Outlines the steps needed to return to full operations after an incident or crisis

It's important to remember that the details of any particular incident or crisis are likely to be unpredictable. Rather than designing detailed plans around specific incident scenarios, it is often more useful to build underlying resilience in systems and processes that will allow organisations to respond flexibly to many different types of events as they occur.

The complexity of a business continuity plan will vary depending on the size of the organisation, the type of services it provides and its location. For a small organisation, a shorter plan which identifies critical business impacts and ways to mitigate them, along with key information needed during an incident, may be more useful than a lengthy document.

Be prepared

Business continuity planning requires an investment of time now, to minimise harm later. Much of this time investment relates to thinking through the potential impacts on different areas of organisational operations during a crisis, and designing alternative approaches that can be implemented when needed.

List the kinds of interruptions your business might encounter, including those related to the categories of 'black swan' events noted above.

It is also worth considering ways in which your work is dependent on suppliers, clients, and partners. If you cannot get resources, are unable to have direct contact with your clients, or your suppliers or partners are no longer operating normally, what affect would this have on your work?

Then consider the ways that these interruptions would impact your ability to operate as an organisation, and to provide services to the community. If 'business as usual' were no longer possible, what other options would you need to consider? The health and safety of staff and community members will be a primary consideration, but you will also need to consider how organisational viability can be maintained through and beyond crisis.

Key questions to guide your analysis

1. How can we best support and supervise our staff during crisis?

2. How can we maintain communications during crisis?

3. How can we build robustness around critical organisational roles?

4. How can we change work locations if needed during crisis?

5. How can we ensure access to critical information during crisis?

6. How can we manage disruption to our supply chains during crisis?

7. How can we best support our clients and communities during crisis?

Rehearse, maintain and review

Provide a summary of your business continuity plan to staff and discuss it with them, so that people are aware how their work might be affected. In this way, changes will be less of a shock if and when they have to be enacted. People are likely to be less anxious when they are familiar with the plan and its implications for them individually and as a team. Communication of this type is particularly important for larger organisations where a crisis response may involve a great deal of complexity.

If possible, test your business continuity plan in advance. This could include rehearsing potential scenarios, conducting drills, testing alternative tools and systems, and confirming if roles and responsibilities are clear. Aspects of plans that are difficult to test in advance will need close attention at the time they are implemented, to troubleshoot issues and ensure they are meeting the needs of your organisation and stakeholders.

Some potential elements of a crisis response may be inappropriate to apply during normal times (such as discontinuing face-to-face contact). However, many ways to strengthen organisational systems, processes and approaches are as valuable in building flexibility and resilience into business as usual as they are in responding to a crisis. You can also trial and refine a range of alternative approaches during normal times, even if they are not used as your main operating model. This will enable a streamlined and effective response during crisis.

Business continuity plans should be reviewed and updated regularly. Given the pace of change for community-based organisations, a plan last updated a decade ago is likely to have little relevance to a crisis today.

Many ways to strengthen organisational systems, processes and approaches are as valuable in building flexibility and resilience into business as usual as they are in responding to a crisis.

Recovery and future opportunities

When you need to put your business continuity plan into effect, managing the immediate impacts will be only the first stage. Once your organisation is safely working under new conditions, take stock and plan for the restoration of full or changed operations.

A crisis situation will usually present new opportunities as well as risks. You may have the opportunity to pilot new service delivery approaches, engage with new stakeholders and find new and more flexible ways to organise your work. New problems and needs often come into view during periods of difficulty. How could your organisation be part of the solution to these?

Building resilience for the long term

'Black swan' events will always be challenging, but they don't need to be fatal. All organisations need to build their resilience in order to achieve their intended impact over time.

Thoughtful business continuity planning will help us build the robustness to continue operating through times of crisis and disruption, and to emerge stronger for the future.

The second article in our business continuity planning series will explore specific considerations for community service providers.

 

Assistance with business continuity planning

Lirata Ltd assists organisations to assess risk, prepare for adverse events and build flexibility and resilience as a foundation for long-term success.

For further information or assistance, please contact the Lirata team:

Phone: +61 (0)3 9457 2547
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
 

Download

Time to update (or create) your business continuity plan (PDF 399 KB)

External resources

The Australian Council of Social Services (ACOSS) Resilient Community Organisations toolkit is a great place to start with business continuity planning for community-based organisations. It offer a benchmarking system to assess your current state of preparedness for disasters and emergencies, and a six step framework for building disaster resilience.

Other useful resources include:

You can read more about black swans in:

Taleb, Nassim Nicholas. 2007. The Black Swan: The Impact of the Highly Improbable. New York: Random House.