• Archives
  • Categories
  • CLAYTON HICKEY: Have a plan for the worst

    2019 - 02.21

    The way people responded to the recent storm was indicative of the Newcastle spirit. Picture: MAX MASON-HUBERSWHEN disaster strikes …
    Nanjing Night Net

    The reaction to the recent storms that ravaged Newcastle and surrounding areas was an outstanding representation of the Novocastrian spirit that epitomises our great city. Now that the water is receding, many residents are counting the cost and considering what can be done differently next time the weather takes a turn for the worse.

    And it is no different for business owners.

    A critical component of how a business responds to a disaster is underpinned by how effective it has been in planning for disaster. Too often we see this planning limited to “I can retrieve a back-up of my information”, and the common trap of associating business continuity risks with IT is fallen into …

    Two weeks ago, the loss of electricity over an extended period of time, damaged phone lines, and physical and dangerous impediments to accessing the business, were unable to be alleviated by the restoration of a back-up.

    So what lessons can we take away from this event, and what questions can we ask of ourselves?

    Is the tail wagging the dog? Quite often the business continuity plan (BCP) is driven by a single individual, or department, often IT. As disruption commonly affects the entire business. All segments of the business should be involved in developing the BCP. It should never be left for one part of the business to assume what the rest of the business needs.

    Revisit key business impacts: Does your plan truly isolate and focus on the “mission critical” elements of your business? These elements should be mapped in a Business Impact Assessment. Quite often the accounting system is listed as one of the first to be restored – how will this help you communicate with your workforce, customers and suppliers?

    Beware the macro focus: the planshould give guidance on the “big events”, but not be isolated to these. The more frequent disruptions, including IT, telephone outages and loss of power, are often less catered for and, over time, become a significant expense.

    Investment risk: the risk of not committing BCP resources to the most critical areas can result in time and money being poured into the restoration of equipment and services that you do not need.

    External effects: often the plan is limited to disruption created within the business, without considering external effects. For example, what if a major supplier has an extended power outage? How often do you enquire on the BCP capability of third parties who are critical to your operations?

    Will it all work? The most effective way to ensure your planwill deliver in the time of need is to test it through simulation. To find out the BCP processes implemented, and the people and technology surrounding them, do not respond when the time comes for it to be all “switched on”, is a disastrous and expensive outcome.

    I have yet to meet a person who isn’t an expert in hindsight.

    However, some small adjustments in some critical areas might have a big impact next time around.

    Clayton Hickey is a Partner with the PKF audit and assurance team in Newcastle. He is an expert in audit, risk, technical advisory services and due diligence activities.

    Comments are closed.