By Bob Farkas, Virtual Corporation:
Fifty-one percent of organizations surveyed by Mercer Consulting were caught without business continuity plans when the current COVID pandemic erupted. Moreover, other surveys revealed the potentiality and impact of a pandemic were virtually ignored. Low priority and insufficient investment in business continuity continue to jeopardize the business resiliency of many companies.
However, the lack of preparedness and response has caught the attention of Boards and executive management and could facilitate the commitment for business continuity. To overcome many of the financial and operational risks of standing up a business continuity program, a managed service model is emerging along the lines of IT services such as Software as a Service (SaaS). The Business Continuity as a Service, “BCaaS” is an outsourced service offering. BCaaS provides a suit of best practices business continuity management services at affordable, predictable fixed cost managed by business continuity professionals that allows companies to address their business resiliency needs while allowing them to focus on their core competencies.
COVID-19 Pandemic’s Big Reveal
Earlier this year, Mercer Consulting published a report based on its Business Responses to the COVID-19 Outbreak survey that revealed 51 percent of organizations around the world do not have a business continuity plan to respond to disasters or other business disruptions such as the current pandemic. The report provided insights from over 300 businesses across 37 countries and revealed that 27.2 percent of companies do not have a business continuity plan in place, while 23.8 percent are in the process of developing a plan. Furthermore, the study also noted that at the time of the survey 31.1 percent of organizations that do have a plan had not yet implemented it while 17.9 percent of companies had already begun implementing their business continuity plans.
Why the lack of preparedness?
Business Continuity, or more broadly “Business Resiliency”, continues to suffer from a common set of well documented recurring issues such as lack of executive buy-in/commitment, low priority, and/or time, resource, and money constraints. Several of these issues were highlighted in a DRJ webinar conducted in the late April of this year. The guest firm presented the results of its state of business continuity management (BCM) survey which revealed:
- 19% who managed their own plans have no departmental buy in (no buy-in/low priority)
- 27% having a BC program are managed by a team of one (lack of resources, investment, and/or low priority)
- 42% of firms plan to increase BCM spending (lack of investment, low priority)
- 54% do no use software to manage their BCM program (lack of investment)
Much of this can be encapsulated as “lack of foresight”, or as some would call it, “lack of imagination”, by not seriously considering how devastating disruptive events could be and in preparing a proper response to such events. The current pandemic is illustrative of this issue. In a recent Business Continuity Institute (BCI) 2020 Horizon Scan Report, the risk of a pandemic (as represented by “Non-occupational diseases”) in the next 12 months was rated 21 out of 22 potentially concerning events. What was particularly interesting was that the potential for a pandemic was scored higher than the impact from a pandemic itself, which had the lowest impact rating of the 22 risk events. In another study by Gartner, (2020 Strategic Road Map for Business Continuity Management) a pandemic wasn’t even on the “radar” of the top 5 Supplier’s risk events. Clearly, most everyone underestimated the potentiality and impact of a world-wide pandemic such as COVID.
A crisis has the tendency to glaringly reveal an organization’s functional weaknesses and shortcomings as well as its strengths. As implied by the Mercer findings, the vast majority of companies were ill prepared to respond to this pandemic which brings into question an organization’s commitment to its business continuity program. The “good news”, as it were, is that COVID and the lack of preparation for it has received the undivided attention of corporate Boards and executive management to consider business resiliency more seriously.
New Business Continuity Solutions Emerging
Time will tell how much more committed businesses will be to business resiliency and how the current pandemic will impact such decisions. In the meantime, what options are there for companies seeking to jump start a resiliency program or improve or accelerate a nascent or struggling program, especially in light of current events? The options vary from building/investing in your own program to hiring expensive consultancies or some combinations thereof. Executive commitment notwithstanding, building your own program takes time, money and resources to hire new or experienced staff, train, and build the necessary infrastructure, including software, to develop, implement and manage a sustainable program. While consultants solve the problem of a potentially long implementation time and lack of methodology, tools and experience, they can be costly.
However, more affordable, flexible and effective options are emerging. Following the various IT “as a service” offerings for software (SaaS), platforms (PaaS) and infrastructure (IaaS), “Business Continuity As A Service” (BCaaS) offers a potential solution for those companies seeking to start a program or grow an existing one and are facing such challenges as:
- No/Small Business Continuity department
- Limited Budget
- Time constraints
- Updating outdated Business Continuity Plans/Program
- Gaining management buy-in
- Need to fulfill internal audit/regulatory requirements
Some key advantages of a BCaaS managed offering include:
- Fixed year service cost to reduce operating cost variability.
- Allows an organization to increase its focus on core competencies.
- Shortened implementation curve by leveraging the depth and breadth of the BCaaS’s services team experience and capabilities that include proven methodologies, tool kits and software with which to automate the program.
- Improved Business Continuity Management using a proven program deployment road map, metrics and project management and industry best practices.
- Program flexibility to allow for expanded scope or capabilities at predictable cost as needed.
What to look for in a BCaaS Offering
An effective BCaaS offering should include a baseline suite of services with the ability to adjust scope as needed. Such capabilities should include:
- Metrics with which to assess the current state of your business continuity capabilities to demonstrate improvements over time.
- Business Impact Analysis (BIA) to facilitate the introduction of a business impact analysis for your company.
- Business Continuity Planning to Create and maintain business recovery plan(s).
- Business Continuity Exercises to test your stakeholders’ current state ability to implement their business continuity plans.
- Business Continuity Planning Software that allows clients to automate complex BCM activities and more efficiently manage the program.
- Program Management to provide the necessary direction and oversight for the implementation of the program.
- A fixed predictably pricing over a fixed term to contain costs.
- Flexibility to change scope and expand capabilities with predictable pricing.
For companies having to respond to new or increased demands for a business continuity management program, the BCaaS managed service may provide the appropriate solution to quickly implement a cost effective BCM program while minimizing many of its obstacles and unpredictability. Moreover, these advantages present a stronger case to executives for their buy-in. To learn more about Virtual Corporation’s BCaaS managed services offering, visit our web site and schedule a meeting with one of our professional staff. Don’t be caught unprepared for the next disruptive event to your business.
About the Author: Bob Farkas, PMP, AMBCI, SCRA, Manager, Project Management Office/Project Manager, has been with Virtual Corporation since 2001 during which time he has led many Business Impact Analysis (BIA), Business Continuity Planning, and Risk Assessments projects across health care, manufacturing, government, technology and other services industries. He holds PMP, AMBCI and SCRA certifications and has a Master’s in Chemical Engineering from the New Jersey Institute of Technology and Bachelor’s in Metallurgical Engineering from McMaster University (Hamilton, Ontario.)