In 2020, global organisations faced unprecedented challenges in the wake of the COVID-19 pandemic. As a result, many organisations’ Business Continuity Management (BCM) processes have been put to the test.
Whilst it may have been impossible for organisations to have foreseen such an unprecedented global event, effective BCM planning should have at least allowed organisations to minimise some of the resulting operational impacts.
The role of Business Impact Assessment (BIA)
Business Impact Analysis (BIA) is a process designed to assist organisations in evaluating and quantifying the potential impacts of significant disruption to critical business functions. It should identify business functions that are critical to the operation of the business and establish the impact of those functions’ inability to operate.
Disruption is inevitable and can be the result of minor technical disruptions to significant global events. It is these significant events that can present ongoing operational challenges. Major disruption to business operations may be caused by events such as natural or man-made disasters, accidents or – in the case of 2020 – a global pandemic. Regardless of the nature and scale of the disruption, it is critical that organisations perform adequate risk assessment and planning.
BIA is an essential part of any effective BCM process and is one of several components that ensure future risks are predicted, mitigated where possible and are subject to adequate recovery and contingency measures. Other key components include risk assessment and recovery panning.
BIA reports should be refreshed on a regular basis and should be endorsed by the organisation’s senior management.
The difference between BIA and Risk Assessment
Risk Assessments and BIA are important components of any BCM process. They play different but complimentary roles. A risk assessment should identify any potential risks or areas of vulnerability and should outline any preventative measures that should be taken to mitigate such risks. BIA on the other hand should assess the potential impacts of such risks should they occur.
The results of the BIA are vital in assessing the financial impact of disruptive events, both in the short and long term. The financial impact of an event may be experienced long after the disruptive event and can be attributed to factors such as an increase in running costs or a loss of revenue resulting from low consumer confidence. This data is essential when devising recovery plans or when assessing the future strategy and direction of an organisation post-event.
The ability of BIA to prepare organisations for pandemic risks
By its very nature, the BIA process allows organisations to identify a range of potentially disruptive events and calculate specific impacts – including financial losses – for each scenario. The events can even be categorized according to the likelihood of each event occurring. This feature of BIA allows organisations to assess the impact of a wide variety of disruptive events – from cyberattacks to tornados – and plan according to global trends.
As recent experience has shown us, when conducting a BIA, organisations should consider events that have a significant impact on the health and availability of its employees. The potential impact of local disease outbreaks should be considered as well as larger-scale health crises such as global pandemics.
Futureproofing BCM to address ongoing COVID-19 impacts
In light of the COVID-19 pandemic, now is a good time for organisations to re-assess their BCM processes.
Organisations should ensure that adequate policies are in place to cover increased levels of absence amongst employees as well as ensuring that effective succession planning is in place for those with critical roles. There should be effective modes of communication to ensure that employees are kept up to date with organisational procedures and plans at all times. Supply chain disruption should be considered, and alternative suppliers identified. There should be processes put in place to counter the challenges posed by home working – particularly with regard to IT infrastructure and communication – and, for those organisations that are able to maintain an office presence, the implementation of adequate health and safety policies is of paramount importance.
For many organisations, the existing BCM processes have already been tested by the COVID-19 pandemic and many of these measures have already been implemented. However, it is likely that the COVID-19 pandemic will have a significant impact on organisations for the foreseeable future. This provides an opportunity for organisations to assess the mid- to long-term effects of COVID-19 – and of pandemics in general – as part of their BIA evaluation in order to minimise any lasting effects on critical business operations.
BIA is a key component of an organisation’s BCM process. The data produced via a thorough BIA evaluation is essential in informing future business strategy and in minimising the impacts of disruptive events. In addition, the flexibility of BIA allows it to be used to model the predicted impact of multiple potential scenarios. This feature makes BIA a particularly useful tool in assessing the costs associated with a wide range of disruptive events from minor disruptions to global health crises. Inevitably, the completion of a thorough BIA has its own resource and cost implications. However, failure to adequately plan for disruptive events may result in significant costs to an organisation in the longer term. This alone is reason enough to ensure that organisations invest in effective BIA.