April 2, 2003—Organizations of all sizes are failing to plan for possible disruption to their business operations caused by war and terrorism, according to research into business continuity planning by the Chartered Management Institute.
The Institute says its fourth annual survey finds half of UK managers fearing that preparedness for possible terrorist attacks is insufficient.
The results of the UK study reveal that over the past few months, organizations are more likely to have addressed the possibility of disruption to their business by a fire-fighters’ strike.
When asked whether their organization actually had a business continuity plan in place, more than half of all managers admitted that either it did not or they were unsure. Of the 46% that did have a plan, only around half again had actually rehearsed its effectiveness during the past year.
There appears to be a strong correlation between the size of the organization and its preparedness for war or terrorist attacks: large organizations (over 500m turnover) are almost three times more likely to have a plan in place than small businesses (up to 1m turnover).
“Organizations of all sizes should have a business continuity plan: not having one is cavalier at best, negligent at worst. Frighteningly, only one in two managers even know if their organization has a plan,” observed John Sharp, CEO of the Business Continuity Institute. “The good news is that recent developments in corporate governance, in particular the Turnbull Report, mean that risk management is now on the boardroom agenda.”
In its survey, the Institute found that less than half of the managers involved fear terrorist damage, while only one in six are concerned about the threat that military conflict would have on their business. Those threats which organizations fear the most are loss of IT capacity (58%), followed by loss of people and loss of site (both 54%) with fire risk and loss of skills (both 51%) considered somewhat less important.
Not surprisingly, the functions most likely to be included in organizations’ business continuity plans are IT, finance, facilities management, human resources and security.
The findings also lend weight to the view that an unrehearsed plan is not worth the paper it is written on, says the Institute. Of organizations that do carry out dry runs, more than four in five rehearsals revealed shortcomings—but of these, one in six then failed to address them. Equally disturbing, in the Institute’s view, is the scope of business continuity rehearsals: only one in five organizations practice organization-wide recovery, while double this number limit it to IT.
Some of these shortcomings may be explained by a lack of internal commitment. A significant number of managers admitted that the driving force in their organizations was in fact external, with one in three citing customer concerns and one in four saying insurers were pushing them to guard against business disruption.
—Elliott Chase
Reprinted with permission; copyright 2003 i-FM
