What can we learn from the Covid-19 shock? Next steps on managing risk
The medium and longer term impact of Covid-19 is still uncertain, but if there is one thing businesses can learn from the crisis, it is the importance of having a robust disaster recovery and business continuity plan (BCP) in place. We have seen that this is not just beneficial when fire or flood disasters occur but that emerging risks, such as cyber or a virus like COVID-19, can be just as disruptive as any physical disaster.
There is an often quoted statistic in business continuity circles that 80% of businesses without a BCP affected by a major incident either never re-open or close within 18 months. It is not clear how accurate this is, or the source of the data, but what can be said is that a business with a plan is likely to stand a better chance of survival than one without.
Some organisations adopt a formal approach to identifying and managing risk, and some take a more informal approach. Either way, leaders should be aware of the main threats to their business and plan accordingly.
Risk Registers
A simple method of helping to identify and mitigate the threats to your business is to create a risk register. This is a document that records and ranks the main threats to your operation in terms of likelihood and potential severity. A score is given to each threat along with an owner responsible for the steps being taken to mitigate.
Over the last two years we’ve found that the majority of private companies we’ve asked about this (around 75%) do not have a formal risk register. If you don’t have a risk register in place we can help you create one and if you do have one we can help you review it to ensure that you have a plan B for each eventuality. This does not have to be a major exercise. It can be a simple task but it does need to be seen as a working document with regular reviews, adapting as your organisation and external threats evolve.
At Alan Boswell Group we also use your risk register to ensure your insurance premium spend is targeted on the key threats to your business and that you are not wasting premium on areas that have no significant impact.
Here is a simplified example of a basic template:
Business continuity plans
Using your risk register as a starting point, you can then formulate a BCP. Although the two are not completely aligned, the risk register is a useful guide. Business continuity planning will provide a practical set of instructions and information which will inform the organisations’ reaction to ‘interruption scenarios’ and allow you to continue to function with as little disruption as possible.
Whatever your business you need to know how you can keep going under any circumstances. A good BCP recognises potential threats to an organisation and analyses what impact they may have on day-to-day operations. It is likely to include:
- A business impact analysis to differentiate critical and non-critical functions
- Recovery times and requirements
- A threat and risk analysis to focus on specific scenarios
- Communication and action plans
- Testing regime
It provides guidance to mitigate these threats, putting in place a framework to allow key functions of the business to continue during a crisis. Disruptions such as fire, flood, cyber-attack, supply-chain failure or losing a key employee can happen at any moment and a robust business continuity plan may help preserve your business.
Summary
It’s worth spending time reviewing the protections you have in place and, if you don’t already have them, creating a risk register and BCP to help you prepare for actions to be taken in a crisis.
This will help you understand:
- What the real threats are to your business
- What you would do in the event of a crisis
- What you’ve learnt from previous disruption, could it have been better?
- How flexible is your business – i.e. Can you diversify quickly to maintain income, can people be re-deployed or relocated and will your systems support this quickly enough?
- What outside help will you have – will your insurance programme provide funds?
Alan Boswell Group can advise clients on the identification and management of risks and the purchase of relevant insurance policies. If this is something that you would like to explore please check out our risk management services here.
