On April 30, the Mexican government announced that it was shutting down schools, city malls, state-run theatres and restaurants for five days in a bid to break the transmission of the H1N1 virus which had swept through Mexico City since emerging there in March. At that point, the World Health Organisation (WHO) tagged the number of cases in Mexico — from what was then dubbed swine flu — at 99, with eight fatalities.
The move did seem to slow the spread of the virus. On May 3, Mexico’s health ministry said that the worst of the outbreak had passed, partially because of the shutdowns, and that the virus might turn out to be no worse than a typical seasonal flu outbreak.
But it came at a price. A Bloomberg report on May 22 quoted Rafael de la Fuente, BNP Paribas’ chief Latin American economist, as saying in New York that the shutdown is estimated to have cost the Mexican economy about 30 billion pesos (RM7.8 billion), or 0.3% of Mexico’s gross domestic product.
And that was just one city over a period of five days, one of which was May 1, a public holiday being International Workers Day. What would the cost be if the shutdown were replicated in other countries for more than a week? The severe acute respiratory syndrome or SARS outbreak in 2003, which started in Asia but spread as far as Turkey and Romania and caused some 800 deaths, gives an idea. SARS led to an estimated US$60 billion in economic losses worldwide. The hardest hit were the retail, restaurant, airline, hotel and tourism industries.
The reality is that disaster — for both people and companies — can come in many forms, and a pandemic is just one of them. Apart from pandemics, businesses face a range of risks that include natural disasters like floods, storms and earthquakes, fraud, product contamination, political or economic turmoil, terrorism and kidnappings. But how prepared are businesses to deal with these risks?
In one of its reports last year on its Global Business Continuity Management benchmark, Deloitte said that business disruptions can no longer be considered as exceptions. “They are commonplace, largely due to the increasingly global nature of business... Even if a company’s operations are not directly impacted, these disruptions affect their suppliers and their customers. Senior managers need to be alert to the possibility — no, the probability — that some untoward event will prevent business from continuing as usual for their companies. They must be prepared to take appropriate action,” said the report.
This is true regardless of the size of the business, or the sector in which it operates.
“All businesses, regardless of size or sector, need to have business continuity management well and truly embedded throughout the organisation. This is especially true for essential services, and sectors that must meet legal requirements,” says Kuala Lumpur-based Siti Baizura Yunus, Asia business continuity management leader at Marsh Risk Consulting. Marsh is a sister company of Mercer, a global human resource consulting firm.
Siti Baizura adds that business continuity management (BCM) “should become an integral part of corporate governance and directly support the business strategy and goals of the organisation”. In fact, the advantages go beyond ensuring business continuity in a crisis or disaster. “BCM allows companies to have a better understanding of their business and helps them to improve their operational decision-making. It provides organisational resilience to optimise product and service availability. It can also provide competitive advantage. If you are prepared, you can be up and running before your competitors, and increase your market share,” says Siti Baizura.
While often used interchangeably, BCM is defined by some as the process of identifying potential risks to a company, and business continuity planning (BCP) as the preparations needed to deal with the impact of losses that arise.
Martin Ng, director of Deloitte’s Centre for Risk Intelligence in Malaysia, agrees with Siti Baizura that no business should be without a business continuity plan.
“Yes, size and sector do have a role to play in the priorities of a business continuity plan but for every business, there should be a prudence measure as crisis can occur anytime,” he says.
When it comes to risk management, however, there is a “large gap” between awareness and commitment among local firms, he says. The “aware” group knows that there is a problem; the “committed” group is taking steps to resolve it.
“Malaysian firms have regretfully paid little attention to business continuity planning until and unless disaster has struck,” says Ng. Because of the relatively stable environment in Malaysia, companies have not felt pushed into preparing for crisis or contingencies, he adds.
But Malaysian companies are hardly alone in this. A report by human resource consulting firm Mercer at the onset of the avian flu outbreaks in 2006 found that only 47% of businesses around the globe have BCP. And a global snapshot survey conducted by Mercer last month showed that just over half of 411 participating organisations had created contingency plans in response to the Influenza A (H1N1) pandemic (see article on Page 14).
CIMB Bank’s business continuity plan ensured that its operations were not disrupted when a landslide caused part of the retaining wall of a car park adjacent to its head office in Jalan Semantan in Kuala Lumpur to collapse on Dec 4 last year. CIMB staff who had to be evacuated because of the incident reported for work at various back-up sites in the Klang Valley the next day.
“Our ability to migrate to our back-up sites quickly and without any degradation to our service standards is testament to the high standards of our business continuity plans and facility maintenance,” CIMB group chief executive Datuk Seri Nazir Razak said in a news report then.
Stages of BCP
There are four basic stages in business continuity planning. The first is to understand your organisation and analyse both the risks and impact.
“If a business does not understand how risks may or will threaten or impact goals, then leaders are ‘steering’ blindly,” says Deloitte’s Ng.
The second stage is to develop the strategies and procedures. In drawing up a business continuity plan, the key issues that need to be considered are ownership (accountability at the senior levels), commitment and consistency, says Ng. For BCP to succeed, senior management must be involved, and there should be a designated person.
Siti Baizura of Marsh says that senior management should lead a BCM programme. “Senior management need to understand what you are trying to do and why, and need to be included in the initial strategy development phase. As long as BCM activities become a boardroom agenda, the programme will succeed,” she says.
The third stage in business continuity planning is the implementation, which includes getting the necessary resources to sustain business activity, training the necessary people, and testing the plan. Resources run the gamut from commercial recovery sites to systems for recovering data, software to help in writing and maintaining plans, and disaster supplies for recovery teams.
Designated people — such as a dedicated and qualified BCP team — need to be put in charge of the plan. At the same time, knowledge about roles, responsibilities and emergency responses needs to be imparted to all levels of staff.
But it doesn’t end there. A business continuity plan would not be effective without continuous drills, and review. Nestlé Malaysia has regular drills, “mocks”, crisis scenario planning, crisis simulation, and refresher training.
“The frequency would depend on the need and whether it affects the particular business or operational units,” says William Quek, group safety and health manager of Nestlé Malaysia.
The business continuity plans of direct-to-home satellite TV service provider Astro are tested quarterly, half yearly and yearly, depending on the criticality of the areas.
“As far as BCP is concerned, we are in the ‘maintenance mode’, that is, sustaining and updating the plan appropriately. Updates are submitted to the enterprise risk management committee on a quarterly basis for review on the progress made,” says Rohaizad Mohamed, senior vice-president of broadcast and operations.
No matter how good a company’s business continuity plan, it is not isolated from the changes taking place in the world. Companies need to keep their BCP relevant.
Ng says the business continuity plan should be updated according to changes that occur in the business or service.
Treating it as a continuous process helps embed business continuity in the organisation, says Siti Baizura. She recommends that the head of internal audit be responsible for regular review and/or appraisal of the effectiveness of the risk management, internal control and governance processes within the company.
“It’s a living plan, not a one-time project; maintenance is as important as implementation,” she says.
This article appeared in the Manager@work, the monthly management pullout of The Edge Malaysia, Issue 760, June 22-28, 2009