As the pandemic drags on, plan how to protect your core services, Hub advises

Companies developing a business impact analysis (BIA) plan need to understand the amount of time the organization can function without producing a particular product or service, a senior executive with Hub International said recently.

“We need to ask and answer some key questions about how long we could go without a particular function or process,” said Ray Monteith, senior vice president of organizational resilience with Hub in Canada. “What would be the maximum tolerable outage for that function? How long could we tolerate being without it? How long could the business function without a particular activity? What are the minimum operational resources required to sustain a function?”

Time is the critical factor in developing a BIA, Monteith said, noting that a business continuity plan (BCP) should be developed before a critical event strikes. “Plenty of research findings tell us that most organizations fail to plan.”

Monteith offered his comments during a recent wide-ranging Hub webinar titled Managing Your Business Through the Coronavirus Crisis.

“When we find ourselves amid an extraordinary event like we find unfolding around us now, we need to react quickly to protect critical business functions and processes. And key to that is completing a business impact analysis,” Monteith said. Time is the critical factor in developing the BIA, which is a process designed to identify, categorize and prioritize critical functions and processes, vital records, and required resources, personnel and equipment.

Understanding those functions helps a business to identify and prioritize each function according to how critical it is to sustained operations. Those activities an organization can’t do without are considered ‘mission critical’ — they need to be supported and adequately resourced to ensure continuity of operations. Examples would be communications, IT, and intranet. “Very often, those mission-critical activities require the most immediate and instantaneous response and constant support through an event.”

After that, there are significant and important functions, although “we may be able to go without for some period of time if necessary,” Monteith said. “We can shift resources away from those functions into business-critical and mission-critical functions, if necessary, especially as we are experiencing reduced staffing levels.”

Related: Early lessons learned from the pandemic: Global demand surge

The continuity plan exists to avoid any interruptions that could lead either to significant losses or a failure to achieve the organization’s principal objectives. “It ensures critical activities are performed no matter what else is happening,” Monteith said. “The goals of continuity management planning are to protect people, protect property, manage the business through the crisis, sustain reputation, resume normal operations quickly, recover losses, maintain relations with suppliers, and maintain relations with customers.”

The response should safeguard key business interests, reputation and brand.

A BIA should look at the implications of a disruption to leadership, staff, communications, technology, facilities, suppliers and customers. It should identify key business functions and the financial and non-financial implications to those functions for any length of time.

At a minimum, the BIA should specify the effect of the loss on the company and the minimum operating resources that would be required to offset the loss: Staff, equipment, supplies, vendors, internal and external dependencies, possible workaround options and solutions, alternative resources, alternative worksites, and alternative staffing options.

“A resilient organization is able to efficiently manage through a crisis, recover essential operations, leverage lessons learned and continuously improve capabilities,” Monteith said.