| It
may only be ten years since the projects rewarded in the inaugural
Business Continuity Awards got underway, but it already seems
like a very long time ago. A decade ago, following the signing
of the Good Friday Agreement we felt less threatened by terrorism
than for a generation. There were worries about the effect
of the dot com boom on the economy, but nothing like the economic
concerns with which we are living now. No-one had ever heard
of SARS, and hardly anyone spent much time thinking about
foot and mouth, cyber crime, or malign accounting practices
inside large US corporations. There were plenty of people
concerned about the environment, but not many were inside
the political or business mainstream; and few people in Carlisle,
Hull, or New Orleans were overly concerned about flooding.
In the UK, we were waiting to see what impact the Millennium
Bug might have, and whether or not the government would try
to take Britain into the euro.
The business continuity industry was small, and consisted
mainly of small, specialist companies. Most of UK PLC knew
nothing about business continuity. Ten years on, of course
the impact of some high profile events and pressure from regulators
has done much to raise the industry's profile, but its transformation
over that period has also been largely due to the hard work
and creativity of the organisations and individuals who work
within it.
The first crucial step forward came at the turn of the century.
"The year 2000 is the father of the industry," says
Martin Caddick, head of the business continuity management
practice at Marsh. "That's when people started taking
it seriously."
Steve Mellish, head of business continuity at Sainsbury's,
also cites Y2K as the moment when business continuity started
to be about more than the protection of IT systems and physical
buildings. "While we did lots of work ensuring systems
could deal with the date change, what we did in addition was
to identify various scenarios outside our control that could
harm the business," he says. These included problems
associated with the road infrastructure, and disruption to
fuel supplies, and having worked through that process turned
out to be extremely useful during the fuel crisis that followed
in 2000, and the Foot and Mouth outbreak in 2001.
In other sectors, the need for continuity planning became
a compliance issue, as new regulators and regulations appeared
in the aftermath of high profile corporate governance scandals.
For
a long time the financial sector took the lead in business
continuity, and credit for that must be given at least in
part to the work of the FSA, launched in 2000. Stuart Dunsmore,
head of business continuity management at Commerzbank, highlights
the value of the FSA's resilience benchmarking projects. "They
identified that banks had put a lot of time and money into
disaster recovery, but that they hadn't always joined it all
together for a business continuity approach," he says.
"I think the last RBP, which finished this year, and
is still being analysed, will show that a lot of work has
been put into building fully integrated business continuity
operations."
The industry also played its part in encouraging greater government
engagement with continuity and contingency issues. The Civil
Contingencies Act was passed, and the Civil Contingencies
Secretariat created as a direct result of the 2000 fuel crisis,
Foot and Mouth in 2001, and the major flooding events that
took place in the first two years of the century.
The cumulative effects of these changes on the actions of
government and of private companies then received new impetus
in the aftermath of 9/11, and later of 7/7; from health scares
relating to SARS and Avian Flu; and from the 2007 summer floods.
Another important theme of the decade has been the way that
business continuity planning has become more concerned with
the risks associated with supply chains, and the way that
these are exacerbated by globalisation. "The trend towards
globalisation makes business continuity more important,"
says Caddick. "Fraud in the US affects UK businesses.
Climate change has more of an immediate impact on British
companies now they have outsourced many things to China."
Organisations of all types and sizes have undoubtedly benefitted
from the development of BS 25999, and its various forerunners,
including PAS 56. "A lot of people criticised PAS 56,
but it moved business continuity into being a more achieveable
solution for many people," says Andy Mason, (internal)
head of business continuity for the UK firm at PwC. "The
British standard has taken it to the next level."
Another theme of the last ten years has been the spread of
business continuity ideas into the public and voluntary sectors,
thanks in part to the efforts of Charity Logistics and of
Community Resilience, which absorbed the former organisation
in 2006 and now helps small businesses, charities and local
authorities improve business continuity planning. "There's
a need for business continuity at local government level,
and because business continuity has this word 'business' in
it, there's been this perception that somehow it doesn't apply
to them," explains George Cook, chief executive of Community
Resilience, and founder of Charity Logistics. "It's important
local government continues to function in an emergency, because
people naturally turn to it for help." He points to the
problems experienced by some local authorities in the aftermath
of the 2007 floods, or of the 2005 Carlisle floods as examples
of how vulnerable local structures can be.
Improved technical capabilities have helped all organisations
that use business continuity provider services, and have led,
in some cases, to a fundamental change in the way some of
those services are used. Part of the reason for this is that
so many organisations of all kinds are now so dependent on
IT. Keith Tilley, executive vice-president, SunGard Availability
Services Europe, which won the 10th Anniversary Award at this
year's awards in recognition of its contribution to the industry,
says customers using SunGard's vaulting information protection
service are carrying out 6,000 restores a month, using the
service almost like a utility largely because of an increased
dependence on IT.
"Ten years ago, if you asked people to name their critical
applications email would not have appeared," notes Tilley.
"Now it's in the top three at any organisation."
Email archiving is also vital for companies seeking to recover
documents quickly when requested to do so by auditors or regulators.
More end user organisations also now treat tests and rehearsals
of recovery operations with the seriousness they deserve.
"Ten years ago, for many organisations, having a plan
was good enough," recalls Steven Garrod, director of
Garrison Continuity. "Now the appetite for testing and
rehearsing is greater than ever." Keith Tilley says he
is now regularly approached by customers keen to take part
in multi-invocation tests.
Those companies that have taken business continuity seriously
have been rewarded for doing so. Sainsbury's Steve Mellish
says he can reflect with satisfaction on the work that his
company's business continuity management team has done in
the last decade. "We've used our business continuity
management team about 30 times for different things that we
didn't plan for," he says. "When we had the flooding
last year we had four stores that were left not connected
to power, in among 350,000 households that didn't have water.
Our ability to manage those situations shows how things have
matured.
"A key part of that is all about embedding it into the
culture of the organisation. Some companies are still struggling
to get business continuity beyond the IT team. When you demonstrate
real benefit: that's the watershed for getting it into the
culture."
He is concerned that the number of companies where business
continuity issues are given due consideration at board level
is still quite low. "I've been reporting directly to
a board director since 2000, and that makes such a difference
in terms of getting commitment at the top," he says.
"Unless it's driven by regulation, it's convincing the
board that drives things forward."
Among the other important lessons learned by business continuity
providers and their clients in recent years has been the importance
of what might be termed the softer issues connected to major
business continuity incidents. "Prior to 9/11 the industry
was very focused on getting the business up and running, but
not considering what impact a major incident would have on
the mental stability of their staff, if colleagues were caught
up in the incident," says Iain Taylor, European business
continuity manager for Capital Group. "That has been
a big focus of attention over the last few years."
In future there is also likely to be a drive for more organisations
to address other external aspects of continuity planning,
including cooperation between businesses and the emergency
services following serious incidents. This issue is being
addressed by London First, which aims to improve every aspect
of business in the city. "It's key that business should
have an understanding of the blue light world, and that blue
light agencies should have some understanding of what business
needs," says Denica Lundberg, project manager at London
First. "We'll be pushing for more businesses to be involved
in government exercise testing."
Looking further ahead, Marsh's Martin Caddick believes the
industry is entering a new phase, with multinational manufacturing
and logistics companies beginning to assume the mantle of
leadership from the financial sector. "The industry will
be led by companies putting parts of their businesses into
countries like China and India," he says. "A lot
of the disruption risk is now outside your direct control:
if you have a manufacturing plant in China it may be a joint
operation or owned by a third party. It's now about pushing
business continuity much more into the risk management world.
Banks have to deal with very complex risk management, but
their treatment of risk is usually very fragmented: insurance
does a bit, you have a business continuity department, and
operational risk, and they're
all separate. In manufacturing it's all being pushed together."
But above all, what will help the industry flourish will be
if its positive benefits are well-understood, says SunGard's
Keith Tilley. "People have realised that, whereas they
thought that business continuity was a cost, you can now make
a return," he says. "It's not just like another
form of insurance. Insurance does not get your share price
back up, help your customers or protect your staff."
The further this positive message spreads, the better, says
Bruce Mann, director of the Civil Contingencies Secretariat.
"I would think the most important things to aim for in
the next ten years would be first of all for organisations
which aren't doing [business continuity ] to do it - there
are still some holes," he says. "And the crucial
thing is organisations going down their supply chains to make
sure they're resilient. That would be two very good outcomes
for the next ten years." He would also like to see more
of a focus on spreading the message into the SME sector.
Throughout the next decade the Business Continuity Awards
will continue to act as a showcase for the achievements of
this industry. "The launch of the awards was a turning
point for the industry," says Ian Glover, managing director
at Siemens Insight Consulting. "I think they have had
a major impact. If you look at the numbers of people that
attend now, when you think that it has only been ten years,
I think that's a big achievement." He believes the awards
have encouraged healthy competition between business continuity
providers, and promoted professionalisation. PwC's Andy Mason
also sees the gradual changing composition of the awards'
audience, with many more women and younger people now attending
than was the case ten years ago, as an illustration of the
fact that business continuity is now recognised as a distinct
business discipline.
"The awards have helped raise the profile of the industry,"
says Ian Glover. "And people love to go along to meet
up with ex-colleagues, and enjoy a good networking opportunity.
Long may it continue." There has been a great deal to
celebrate during the last ten years, but there will be much
more to come in the years ahead.
|
