Lessons in Business Continuity thanks to COVID-19

As businesses around the world are left reeling from the ongoing shock of COVID-19, how to continue business and survive is the question all organisations, both big and small, are looking to answer. Mr James Green, Director of Risk Advisory Services at SAI Global and business continuity expert, shares some insight into the topic.

The reality of risks

When it comes to the reality of business continuity plans, Mr Green thinks there are some serious areas to address. 

“I think for a lot of companies, business continuity was hypothetical…[they said] 'Why should we even do this? Why should we mitigate a risk that may not happen'? 

“What companies are seeing right now during COVID-19 is that they have to do this. This is important right now.”

The magnitude of COVID-19 is teaching a hard-learned lesson to many businesses about the business continuity and risk management systems they need to have in place. “It's the biggest globally impacting event since WW2. Not in terms of death or destruction, but the number of countries impacted. We've never seen anything like this that's affecting every country, in our lifetime or in our parents' lifetime.”

Expanding the focus of business continuity plans

He explains that many businesses are suffering right now because they haven't thought about dealing, or don't know how to deal with such a large threat or risk. The average business continuity plan hasn't accounted for it.

Mr Green explains that “a lot of business continuity plans are focused on obvious things, like the building burns down, very simply facility based stuff.” When companies don't broaden the scope of their business continuity plans, they put themselves at risk. 

“These companies are not equipped to handle a pandemic, or a continent on fire, or a cyber-security event. Their plans are too simple. They don't have to be overly complex, but you have to be able to respond to whatever is coming next. And there's always some unknown coming next.”

By building a strong business continuity program, it “allows your company to be more resilient, to get through the next unknown.”

Don't be so preoccupied with one risk that you neglect another

While pandemic-themed business continuity is in the spotlight at the moment, Mr Green encourages organisations to remain vigilant against other threats - cyber security specifically. 

“Right now the biggest risk facing organisations of any size or industry is cyber security risk.

No matter how big or small your organisation is, cyber security poses a serious risk. The risk has taken on new aspects now because employees are working from home. Mr Green points out that even while people are working from home, we still have data and privacy concerns, and all the privacy Standards are still in force, which could be tricky for employees who don't use a VPN. If companies aren't protecting data according to Standards as they should, they risk exposing themselves to cyber security attacks. 

Mr Green also warns against threat actors. “Threat actors are very sophisticated in hopping onto whatever the trending topic is in the world and creating malicious sites. 

“We've seen a huge spike in malware and ransomware… People have turned their attention away from cyber security (due to Coronavirus), but those threat actors have not turned their attention away from threats. So even while you're still managing COVID-19, you still need to be as diligent about cyber security. 

“No matter what industry you're in, that needs to always be top of mind.”

Accessible and actionable

Mr Green encourages a business continuity program instead of an outdated plan. 

“If a company has a plan and nobody knows about it, it's just a document. All of your employees need to have an awareness of what they need to do...Run simulations and then document what you did and change your plans accordingly. Make sure it's actionable.”

Mr Green highlights the dynamic nature of a business continuity program, versus a business continuity plan. “A plan is a document. A program is a living thing, it grows, it adapts to the changes in the business, the world, Coronavirus, etc”. 

He encourages companies to adopt a 'Plan Do Check Act' model, which acts on a cycle, breaking items down into bite-sized pieces. He encourages ongoing trial periods and realistic evaluations, because “business continuity is something that never ends if you want to be resilient”. 

A safer future

Risks and new threats will always exist, and Mr Green hopes that businesses are able to learn from the recent pandemic. COVID-19 is showing businesses the critical importance of expanding the scope of their business continuity and risk management programs. By learning from this recent worldwide threat, businesses will hopefully be adapting their programs, and therefore mitigate or avoid similar situations in the future.