Business continuity: ready for anything

The London terror attack of 7 July 2005 sparked many companies into action to
improve their business continuity plans and business interruption cover.
However, they often fail to grasp the true costs of responding to an incident
threatening the survival of their business and build these into their insurance
programmes and continuity plans.

The National Risk Register has identified pandemic flu as the highest risk,
clearly a large threat to the most valuable resource of an accountancy firm ­
its people. A large proportion of firms also face a high threat level from
floods through being situated in a hotspot by the inadequate Thames Barrier, as
well as terrorist attacks and more traditional fire risks.

Any of these incidents would cause significant disruption to employees,
business processes and, vitally, service to clients.

Imagine, if you will…

A leading firm in the City suffers a complete collapse of its headquarters,
when it is destroyed due to fire, explosion, terrorism or the like. The IT
infrastructure and crucial documents are damaged or destroyed.
Now imagine no provision has been made for the analysis of impacts and
implications of loss or damage to either its headquarters or IT data centre or
vice versa.

Despite strong disaster planning, our hypothetical London firm has failed to
consider its responsibilities over the subsequent period to ensure the business
starts running smoothly again as fast as possible.

One of the key factors for eroding profits will be the increased costs of
premium office space if a terrorist attack, for example, leads to several
companies looking to relocate.

Although these costs will be covered under a business interruption insurance
policy, it is found that the firm’s existing standard 12-month indemnity period
and additional increased cost of working policy limit are significantly below
the mitigated cost of risks.

As rent eats into income, the firm also faces the loss of client fees for
delays in delivering advisory reports on time to aid M&A transaction
activities and decision-making.

In the event of a recovery period of more than 12 months, the collapse of the
building causes the firm’s partners (both equity and salaried) to abandon the
firm, up-rooting their existing team and clients to other competitors in order
to negotiate a deal to achieve their yearly-targeted bonus and gross fee
This in turn has a markedly adverse impact on client retention and new business.

The Best Practice Approach

Although not considered an all-inclusive list, the following business
continuity management best practice approaches are recommended to be embedded
within firms to protect their gross revenue income.

  • Ensure there is a formal policy in place in relation to business
    interruption, which supports the effective design and implementation of business
    continuity plans. This policy has to be formally ratified and should be
    effectively communicated across the firm, supported by local procedures;
  • Ensure the firm demonstrates clear accountabilities for Business Continuity
    Plans, both at a central management level and locally;
  • Set objectives to undertake measures to ensure that the severity or impact
    of the identified risks is reduced within an agreed timeframe. Ensure the cost
    of risk for building collapses is quantified in a consistent manner and allow
    the firm to understand the major exposures to its revenue generating capacities;
  • Pinpoint the appropriate amount of insurance cover to minimise profit
    erosion for business interruption stemming from the identified risks;
  • Consider increasing indemnity period from 12 to at least 18 or 36 months
    based on the business interruption analysis;
  • Ensure Business Continuity Plan testing is undertaken or verified by a
    qualified and independent third party.
  • The results from the testing of Business Continuity Plans are formally
    reported and communicated. Any real life implementation of a Business Continuity
    Plan is formally analysed and reported.
  • Ensure the firm has an audit programme in place capable of providing
    assurance that adequate controls exist over business continuity processes.
  • Ensure the firm communicates its performance on business continuity
    management and establishes structured programmes for improving performance.

Securing an effective business interruption insurance policy goes hand in
hand with having a clear and practical business continuity plan. Striking this
balance will provide the necessary support so a firm can continue to effectively
carry out its core business.

Even if a firm has put in place business continuity plans, they are often
focused mainly on preventing an accident from occurring instead of strengthening
the plans with other proactive measures that will further assist fully recovery
in the most efficient, timely, cost effective and practical way.

For example, when a disaster occurs, firms often have not factored in to
their business continuity planning the cost to provide IT back-up support and
relocate their staff to alternate locations.

More positively, every risk should present an element of opportunity. As
such, accounting firms should look at continuity planning as a trigger to
achieve potential premium savings through improving their current mitigation
controls and building upon their relationship with their underwriters.

James Leow is senior consultant at
Global Risk Consulting

Related reading