Disaster Management and Business Continuity Planning
First off, a few stories–all true.
We started operations in 1993, in the Washington DC metropolitan region and in Kochi, India. Both places were not known for IT businesses and we struggled to set up our business in largely difficult surroundings. By the late 1990s our struggles paid off, and we were set up reasonably, providing services to a few government departments and multilateral agencies centered in the US Capital. We were soon one of the leading suppliers of software services to two large multilateral agencies.
Suddenly the ball dropped. New management took over the agencies, and an external consultancy was appointed to look into the functioning. One of their recommendations: not to rely on “small, boutique IT firms” for mission critical systems. At one stroke we lost 60% of our business and 40% of our experienced, trained staff–we were asked to let go of our employees to the new large IT firms that took our place to retain the institutional knowledge. A blow which was magnified by 9/11, which hit all businesses just a few months later.
Around the same time as us, a friend had started another IT and networking business in Kochi. His expertise and capability saw him build it to be the number one agency in Kerala, and we expected him to grow to the neighboring states. Suddenly we heard sad news. While coming back from a meeting a couple of hundred miles away, he and his business partner were killed in a car crash. His very capable wife and employees tried to sustain the business, and many of us friends tried to rally around, but there were many gaps. Nobody knew all the aspects of the business, and it withered away in less than 18 months. More than 70 employees lost jobs–they may have found other jobs, but nevertheless it was a loss of jobs.
Closer to today, on 15 August 2018, I celebrated the Indian Independence day, sitting at home in a heavy downpour. I did go out to a relief coordination center to see if I could help but they were flush with volunteers.
By the evening we were flooded out, and we decided we had to have our own relief coordination. The metro and transportation in the city were closed, the airport shut down, and the major highways closed due to waterlogging and landslides.
My office and residence were in relatively safer areas, but the area around our office was flooded. Many of our associates’ homes were flooded and we had to relocate them. It took close to 15-20 days for the systems to come back to normalcy.
These are but three real-life cases of disaster striking–the first was a business disaster that affected just my business, the second a personal disaster for two entrepreneurs that affected their business, and the third was a natural calamity that affected a whole state.
There have been many other events affecting businesses–the latest being the COVID-19 pandemic. One thing is for sure–the only prediction about disaster that is true is that they will occur–when, how, who will be affected, and other questions are open.
So, any business needs to plan for managing and overcoming disasters. The beauty of a standardized system like the ISO -9000 series or ISMS systems and others is that they insist on a Disaster Management Plan and a Business Continuity Plan. Of course, such certifications may be overkill for the new entrepreneur, but it is definitely worthwhile to look at some of these aspects of business to ensure resilience in the business.
How did my business deal with the three situations I outlined?
In the first case, we consciously made a decision not to put all our eggs in one basket. Today our business comes from government, NGOs, multilateral agencies, and commercial establishments in almost equal proportions. Similarly, our dependence on US and Indian markets is reduced, with Africa, Europe and Southeast Asia shares increasing. This division also helps us counter market trends and recessions, since no recession affects all markets alike.
To ensure we never have a situation like the second case, we ensure that the management team never travels together, and also that we split times between offices.
And while we were prepared for the third disaster by having our data center adequately protected, and in-house power and network connections, we were still affected by 15-20% of our associates’ homes getting flooded. Our critical systems were available on the cloud, and after this incident we ensured all our systems are replicated on the cloud and are available from outside. We also built in security and access control protocols to ensure this did not mean our company or customer data was open to all.
While the solutions I have outlined are piecemeal, the approach we took is not. And this is where a Disaster Management and Business Continuity Policy comes into play. In fact, the first question one of our clients asked five weeks ago was whether we had a COVID-19 policy.
So what is a Disaster Management and Business Continuity Policy? I do not think this is the forum to elaborate on the topics–anyone can just search on the internet and find a variety of templates. However, let me just give a gist of it.
As we know, disaster can strike any time. And it can come in different sizes, shapes and forms. A personal disaster–death or disease–or a disaster at your supplier/vendor or customer or even a banker can cripple your business. Natural forces–fires, floods, earthquake, tsunami, typhoons, the list goes on–can give your staff a few days of holidays and you a few months of despair trying to arrange things. Pandemics, civil strife, war–the list is endless.
So the first thing in a Disaster Management Plan (DMP) is to try and identify all potential disasters which may affect your business, and quantify their threat. Once you have identified the threats, and their probability, you specify a plan on how you would counter it.
This has to be a dynamic plan and needs to be updated from time to time. For example, it was when a spouse of an associate had to undergo treatment for cancer that we understood how inadequate our medical coverage was. In India, and more so in Kochi, medical treatment is relatively cheap and with our team comprising mostly of youngsters we never had an issue before. But we immediately increased coverage, linked with the same dynamic plan.
Similarly our plan was updated post the flood to help 100% of our associates to work from home if need be, and this helped us to continue our work from home during the current pandemic. While our own work may not be considered critical, we support a lot of critical and emergency services including banks, insurance, government agencies providing aid, the data platforms of key government and multilateral agencies, etc. So our Disaster Management Plan helps these agencies also to function during the disaster.
A Business Continuity Plan (BCP) is a corollary of the Disaster Management Plan. But a BCP is not just for a disaster, but any incident that may affect business. In a typical Project Management Plan, you highlight project risks–like resources not being available on time, key personnel leaving or being incapacitated, delays in feedback or approvals, etc.–and then you plan to mitigate them to ensure the project does succeed. Similarly, in a BCP, you set out all the risks for your business and the plan to mitigate the same.
So what does our BCP and DMP look like? How did it help us to be prepared for the COVID-19 incident?
Our DMP recognizes that different disasters may affect our employees and place of work, our suppliers/service providers (telecom, ISP, utilities, cloud providers, etc.), the region, etc. We defined our response to any kind of danger which our employees may face coming into the office–riots, war, floods, other disasters including the pandemic (which was not even in our minds when the document was prepared). The safety of our employees was paramount, but also the ability of the associates to do their work from any safe location was planned.
It helped that many of our employees have been to client sites, and had laptops from which they could work. All our enterprise tools and libraries, as well as client work repositories, are also made available from the cloud. To ensure that the tools and data stored on these online providers met with the required security and reliability features, stringent safeguards were set in place.
Of course, our business had a big advantage. Being in the Information Technology field, we were not really location dependent. Our productivity was not tied to the office. We did have our set of challenges, but we also had a set of tools to overcome them.
What about other businesses? While we can say for sure that very few businesses would be able to function through a pandemic or natural disaster situation, what is key is: how quickly can the business restart once the situation normalizes?
Can you continue your discussions with your suppliers and customers and work with them so that your supply chain and user base is ready to go to market and work with you when you are ready? Can you look at what improvements or learnings you can bring into your product or service? Many a time I feel that I could have brought in an improvement in my product if only I had some more time. I could make my process more efficient if I had a little more time to learn the new technologies.
Sometimes downtime is essential for a reboot and renewal for every organization. It can be a time for learning and preparing for growth. That said, a forced downtime, and one which is unplanned and not budgeted for, can rock the boat a bit too much.
That brings us to another major aspect of the BCP–budgeting and cash flow management. The biggest blow to a business that an unintended lockdown brings is to its bottom line–income dries up, but expenses continue. Salaries have to be paid, loan payments made, utility bills… most of these fixed costs continue. There may be some reduction or relief–loans may be rescheduled, some governments have waived off some expense (utility, taxes, others)–but the outflow continues even as the inflow almost dries up.
Therefore one of the key requirements in a Business Continuity Plan is a financial BCP. One key suggestion that is emphasized by financial planners regarding individual finance is to always have available a cash reserve equivalent to 6 months worth of monthly expense outflow. This is critical for a business also. Keep in mind that you may possibly get loans or loan extensions/moratoriums. However, these always come at a cost. If you work to keep this reserve, you will not be working through all the cash you have. This helps during a crisis also–not only can you fund the downtime, but your expenses are also within control.
Of course, there is a lot more to a Disaster Management Plan and a Business Continuity Plan than just outlined here. Downtime can be an educational experience, but quality education is always expensive. Having a DMP and a BCP helps you to fund the bill and prepare for the rollercoaster that is entrepreneurship.
Does your business have a Disaster Management Plan? A Business Continuity Plan? If so, has it helped you handle the COVID-19 pandemic? If not, are you creating them now? What have you learned, both good and bad, from this experience so far? Please let us know by responding to this article in our Q&A.