After disaster strikes

Ever considered the implications if, after the event, the board is found to have planned inadequately for disasters?

In 2007, the maiden results for a company newly listed on AltX showed revenue rising 327% for the year ending September 2007, with headline earnings up by 256%. Who wouldn't want to invest their money in this winner?

However, in the half-year results in March 2008, headline earnings per share were down almost 100% to 17c. There were no tsunamis or terrorist attacks, simply a lack of effective operational risk management.

The company once lauded for its outstanding prospects now claimed it wouldn't be able to meet demand for the next four years. It was duly suspended from trading in September 2008.

So, what was the disaster that crippled this 'sure thing'? Simply put, power outages, port congestion and poor harvesting practices were cited as the reasons for the company's ultimate financial failure. In other words, the causes of the company's failure were purely operational risks that could have easily been averted had effective operational risk been implemented.

Effective BCM planning in this instance could have included solutions as simple as:

1. Having standby generators to provide electricity during power outages.
2. Having additional fuel available to top up the diesel tanks of its refrigerated containers bound for international destinations.
3. Effective management tools to ensure staff were harvesting crops efficiently, on time and at full capacity.

While many companies have welcomed King III, the Companies Act and the Consumer Protection Act, BCM is often overlooked as a risk management process, or simply ignored. Nonetheless, it remains an essential component within the company's strategic plan to ensure long-term sustainability.

This means one must take all aspects of a company's operational affairs, as well as the legislative requirements, into consideration when preparing a risk mitigation programme. This could mean adopting an “apply or explain” approach, meeting JSE listing requirements, complying with the new Companies Act, or simply ensuring good corporate governance.

The board remains responsible for the process of risk management, and businesses that take enterprise and operational risk management seriously understand the fundamental role that BCM plays in sound corporate governance practices.

There were no tsunamis or terrorist attacks, simply a lack of effective operational risk management.

Derek Taylor is business development manager for ContinuitySA.

However, while the board remains ultimately responsible for risk management as a whole, senior management has the responsibility for implementing the operational risk management framework approved by the board and its directors. This framework should be implemented throughout the whole organisation, and all levels of staff should understand their roles and responsibilities with respect to operational risk management.

Business continuity management is not a matter of preparing for a flood, a terrorist attack or any specific threat; it is a complex process of preparing the business and its employees for anything.

When a disaster happens, companies with a well-designed business continuity plan will have critical areas up and running in short order, with the rest of the organisation being brought into operation in an orderly, precise manner. This reduces the potential financial losses associated with such disruptions, protects the company's reputation, and allows the business to focus on its primary goal - its revenue-generating activities.

The benefits to an effective business continuity management programme are numerous, but they are not all only realisable after a disaster strikes. Many assist in the efficient running of a company in normal business conditions, improving competitiveness and enhancing the bottom line.

Some of the benefits include:

* Maintaining board, senior management and stakeholder confidence.
* Identification of business improvements.
* Providing competitive advantage.
* Enhancing business-as-usual operational performance.
* Cross-business team building opportunity.
* Improved desire to develop solutions to improve resilience in business-as-usual operations.
* Eliminate causes of potential incidents, where “probables” are within control.
* Prevention of major incidents wherever possible.
* BCM programmes have forced IT best practice to be adopted.
* Improved procedures and understanding of business processes at all levels.
* Better strategic alignment with risk appetite and performance.
* Greatly reduced downtime.

In the final Industry Insight in this series, I will examine the process of embedding the business continuity management lifestyle in an organisation.