John F. Kennedy once said, “The Chinese use two brush strokes to write the word 'crisis.' One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger – but recognize the opportunity.” I would argue that one has to plan in order to exploit any opportunity that may arise, esp. in times of crisis.
Business disruptions are a prime example. Disruptions occur in a variety of circumstances. It could be a cyber-attack, power outage, fire, rogue employee or a weather related event. Weather related events readily come to mind and affect most areas of the country. This is something that is almost inevitable in Southern California with our earthquakes, wildfires, floods, landslides and even tornadoes. Many are unaware that early last century Newport Beach experienced a hurricane! So yes, these events are rare but they do happen. How does one prepare for a business disruption event?
Well, one can roll the dice and respond in an ad hoc way or
be prepared. We believe in preparation. Straightforward planning, and practice,
can improve a business’ resilience and result in tangible gains in their
market.
Suppose a disruptive event occurs … how do you respond? At
this point we assume the firm has been sensibly proactive and has in place a Business
Continuity / Disaster Recovery plan that it formally tests each year. (Is this
a fair assumption in your firm’s case?) This post is about the communication
that is required as part of initiating this plan.
When an event occurs you must understand who needs to know.
The first group is your company management so they can implement their response
plans. Beyond management are the employees that produce whatever you deliver to
clients. And let’s not forget the relationship managers that are directly
serving those clients. How will all of these people be made aware of a
disruptive event? Once you open the communication links outside of company
staff, it is absolutely critical that the correct message be delivered to each
affected party. Sometimes the message is the same yet at other times the
message might be tailored to the affected party. The key is to ensure that the
messages are consistent so as not to undermine your firm’s reputation.
One effective mechanism for ensuring that communication is effective
is a Calling Tree exercise. Beginning with internal communication, every senior
executive in the company should know what they need to do should an event
occur. When they are apprised of an event’s occurrence, they immediately begin
contacting their staff to inform them of the initiation of the recovery plan.
Will staff be reporting to work as normal or will they now be working from home
or, if available, at an alternative or disaster recovery (DR) site. If they’ll
be at home, they should confirm their set-up is up and running so the executive
can rely on their contribution to the firm throughout the event. If there will
be a move to the DR site, they should prepare to report there as required.
External communications require specific action. In the
event the firm is regulated executives need to inform their regulator of the
event and how it is being addressed. If your company manages client money and experiences
a disruption that impacts your investment process, the regulator will require
evidence that your response meets your fiduciary responsibility to your
clients. If you are an executive of a pharmaceutical company supplying a
treatment to the US market and a firm in your supply chain experiences
difficulties in producing contracted products, you need to inform the FDA so they
are able to alert the market if the supply of your medications / products moves
into shortage.
Even outside the regulated space, both your clients and
supply chain need to be kept informed of the event status. So a plan must be in
place with a clear chain of command and communication that confirms what
messages are to be sent, to whom and in what time frame. This control can only
be delivered if there is a single point of contact so that each third party
only receives information from that contact. This is essential as incorrect
perceptions of what is happening can be very damaging. Even if you have not
solved the underlying problem, clients are more willing to understand if they
see an appropriate and timely response to a disruption.
Let’s briefly describe a Calling Tree exercise. First, these exercises have to occur randomly and ideally at least once each year. It will be a refresher for those who participated in a previous exercise and any new staff will learn from the experience. An element of the exercise should be required review of the business continuity plan. Another requirement for the test is that these should occur outside of business hours. If an event occurs during business hours most staff will be in place and have at hand the necessary documentation. Conducting the test out of business hours will reveal which staff members know and understand what they need to do.
To evaluate the exercise, some data will need to be
recorded. For example, if the COO initiates a test, he or she will want to know
how quickly managers receive and confirm receipt of the notice. Next, response
times for the entire call tree are monitored (i.e. the times that manager’s
initiate calls to their team members to inform them of the exercise and how
quickly the confirmatory replies come in if messages are left or SMS is used).
Once word reaches those with external contacts (clients and supply chain firms)
the timing of the required conference calls should be noted and the decisions
taken during those calls should be recorded. All of this information will be
necessary to grade the performance of the firm in responding to the supposed
event.
As executives who might have been involved in similar
exercises, I think you see the importance of planning to control and manage a
disruption event. This exercise ensures the firm has the ability to react to an
event with ease and competence. In the case of a real event, the follow-on
communication with both clients and supply chain firms will be a positive
signal that management is on their game. Any specific details communicated to
clients will enable them to make adjustments in their own best interest.
Likewise for firms in the supply chain, they will have reason to view
management as capably in charge.
Very nice blog... This blog post clearly shows the importance of business continuity disaster recovery plan. Thanks for sharing
ReplyDelete