Business School


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Business School

  1. 1. Business School BUSINESS CONTINUITY IN THE HOSPITALITY INDUSTRY: A SNAPSHOT OF LONDON HOTEL CHAINS 2006 Alexandros Paraskevas Senior Lecturer in Strategic Management Department of Hospitality, Leisure & Tourism Management OXFORD 2006
  2. 2. Business Continuity in London Hotel Chains 2006 2
  3. 3. Business Continuity in London Hotel Chains Contents Executive Summary .......................................................................... 4 Terms of Reference ............................................................................ 6 Methodology ...................................................................................... 7 Research Findings............................................................................. 8 1. Industry’s Understanding of Business Continuity................... 8 2. Corporate-level Involvement ................................................. 10 3. Defining Risks and their Business Impact ............................ 12 4. Crisis Management Team ..................................................... 14 5. Operational Components ..................................................... 15 6. Emergency Communications................................................ 17 7. Management and Staff Training ........................................... 20 8. Performance Measurement................................................... 22 2006 3
  4. 4. Business Continuity in London Hotel Chains Executive Summary In the light of the 7/7 bombings, the tsunami in South-East Asia Pacific, the hurricanes in US and the prospect of influenza pandemic, the importance of crisis preparedness and business continuity become a top priority for all businesses. However, according to the CBI/KPMG London Business Survey published on 11 May 2006, restaurants and hotels are the least crisis-prepared companies in London, with just 29 percent having a business continuity plan, compared to 70 percent of professional services firms, and 92 percent of banks and financial services companies. This study aimed at assessing how national and international hotel chains operating in London approach the issue of business continuity. A total of twelve chains were investigated. The study revealed a huge gap in the business continuity practice between some international and national hotel chains. It also revealed significant differences between the international hotel chains. Three large international multi-brand hotel chains are far ahead from the others in every aspect and their practices are comparable to those of leading companies in the area of business continuity (e.g., large financial institutions). Two other international hotel-chains may lag somewhat behind, however, they are taking a serious approach to business continuity and there are areas where they are more daring than the industry leaders. One ‘UK only’-based hotel chain appears to have some more elaborate business continuity strategy, while the remaining seven chains lag very much behind the industry leaders – with some not even meeting the minimum standards for a decent business continuity programme (BCP). The key findings of this study can be outlined in the following: • The hotel chains with strong corporate-level commitment for business continuity are the ones that lead the sector in this aspect. • The areas of business continuity, security and safety are not seen as competitive and there is goodwill for collaboration among hotel chains. • Although in many cases experts are used, in most cases vulnerability assessments of individual properties (core to the development of a BCP) are not conducted in a structured manner or not carried out at all. • In a large number of cases Crisis Management Teams are formed only in paper without its members knowing that they are part of it and without knowing the content of the company’s Crisis Management Plan. 2006 4
  5. 5. Business Continuity in London Hotel Chains • In several cases Crisis Management Plans are not updated, tested nor communicated to the people involved. • When developing a BCP not all hotel chains have given proper consideration to all the mission-critical functions these plans are supposed to protect and all the operational and communication aspects of their planning. • Hotel companies should try to optimize their crisis communications mix but not look only at cutting edge technologies: pagers have been proven more effective than several other media. • BC staff and management Training varies from very basic to minimal in the majority of the chains. Plans may exist but the people supposed to implement them are unaware of them. • Plan testing appears to be an issue for everyone even for the industry leaders in this area. A ‘walkthrough’ annual test of one scenario is not enough. • All respondents have difficulty in identifying metrics that will help them measure the performance of their BC plans. In conclusion this study shows that clearly there is a lot to be done to improve the business continuity levels in the hospitality sector. There are several ‘best practice’ examples in every aspect of BC against which the majority of hotel chains can benchmark their own practices. The existing spirit of collaboration will certainly facilitate this process. However, the first step for everyone is the realization of the importance of this task and the corporate-level commitment for the improvement of the areas where companies lag behind. 2006 5
  6. 6. Business Continuity in London Hotel Chains Terms of Reference Business Continuity Management The draft British Standard for Business Continuity Management (BS 25999) defines Business Continuity Management (BCM) as: “A holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.” Business Continuity Plan A document charting all the procedures that ensure the continuation of vital for the organization functions in the case of a major disruption (a terrorist attack, a long energy outage, an epidemic, a natural disaster, etc.). Business Impact Analysis A process that determines the operational and financial effects of a disruption. Call Tree A hierarchical list containing the contact details of the crisis management team with their notification sequence. Mission-Critical Process A process that is critical for maintaining the property’s viability and operational continuity. Recovery Point Objective (RPO) An indicator of how much lost data can be recovered after a disruptive event, measured in terms of time between the last system backup of data and the time the disruption occurred. Recovery Time Objective (RTO) The period of time within which mission-critical functions can be resumed after a disruptive event. Risk The likelihood of a threat source to cause loss or adverse business or reputation impact for the property. Threat A credible source of loss or adverse business or reputation impact for the property. Vulnerability A gap or weakness in the property’s systems, procedures, and infrastructure that can be exploited and create opportunities for a threat. Walkthrough (tabletop) test The CMT verbally goes through the BC tasks, activities and procedures to confirm the adequacy of the BC plan on various scenarios. 2006 6
  7. 7. Business Continuity in London Hotel Chains Methodology The motivation of this study was the assessment of London hotels’ business continuity planning in the light of the 2005 London bombings. The event was selected as a trigger for hotel chains to consider planning for any possible business disruption. As terrorists normally select high profile targets, the researcher decided to investigate hotel chains that operate at least one four or/and five-star property in a distance of 7 miles from central London. A total of 14 hotel chains matching this criterion were approached between April and May 2006. Two of them kindly denied the invitation to participate in the study. The 12 hotel chains that participated, represented a total of 87 four or five-star properties in London. The following table gives a broad description of the participating chains: Description of Participating Chains International multi-brand hotel chains 5 International chains offering two brands 3 International group of luxury hotels 1 UK-only hotel chains 3 The study used a combination of face-to-face and telephone interviews with senior management members, responsible for Business Continuity / Crisis Management programmes. In certain cases more than one interview per hotel chain were necessary. The job titles of the participants are given in the following list: Participants’ Indicative Job Titles Senior Director, Crisis Management & Business Continuity Vice President, Risk Management Vice President, Corporate Safety and Security Director, Corporate Security Director of Safety and Security Chief Security Officer Group Director of People Development General Manager A total of 19 interviews were conducted between June and September 2006. 2006 7
  8. 8. Business Continuity in London Hotel Chains Research Findings 1. Industry’s Understanding of Business Continuity Business Continuity is a relatively new concept for the industry and it is not surprising that the largest part of the respondents understands it as another term for Crisis Management, Information (IT) Security, Facilities/Physical Security Management or Disaster Recovery. During the interviews the words used and examples given were particularly referring to crisis plans, security and safety procedures and regulations, evacuation procedures and press/media relations. Two of the respondents understand Business Continuity as a holistic management process aiming at setting the scene that will enable the hotel to continue to operate during a crisis or disaster. For these respondents Crisis Management Planning is but one element of Business Continuity. Varying Approaches There is a huge gap in the approach taken to the issue between the different types of companies that participated in this study. The large international multi-brand hotel chains in our sample have a significantly higher level of sophistication in their business continuity planning, whereas the smaller chains’ continuity plans and procedures range from basic (crisis management team / crisis management plan) to none. Two smaller hotel chains admitted that they have no crisis management plan in place but are currently in the process of establishing a programme. From this point onwards, the study will refer to all business continuity related activities, regardless of their level of sophistication (e.g., even for a basic crisis management plan), as “Business Continuity Programme” (BCP) Triggers for Business Continuity Programmes The main reason stated as the trigger for hotel chains to develop BCPs is terrorism and more specifically 9/11. Other important triggers reported were: • The natural disasters (hurricanes Charley, Frances, Ivan, and Jeanne in 2004, the South-East Asia tsunami in 2004, Katrina and Wilma in 2005) and –to a lesser extent- • The blackout of August 14, 2003 in the North-eastern United States and Canada. 2006 8
  9. 9. Business Continuity in London Hotel Chains Obviously all agreed that the London bombings of 7 July 2005 emphasised the need for a BCP. It is noteworthy that no respondent (unless probed) mentioned the SARS epidemic, the Avian Flu or even the Foot and Mouth disease. Other reasons reported were: • Competitive pressure (main competitors started developing BCPs) • Customer pressure (key customers required/requested such a planning). “We started in 2000, a year before 9/11. At that time some people in the company saw the value of what we were doing but many didn’t. Then came September 11, 2001, and even the most sceptical were turned into believers” “With 9/11, we were all sidetracked by terrorism and almost forgot that there are still other man-made disasters, natural disasters and epidemics, which can and will affect us. We need to maintain an ‘all-hazards’ approach” 2006 9
  10. 10. Business Continuity in London Hotel Chains 2. Corporate-level Involvement The interviews revealed that there are different levels of corporate level (C-level) involvement and commitment in hotel chains’ BCPs. In seven hotel chains of our sample, the BCP initiative is completely top-down with specific guidelines to be implemented in each property offering direction for planning within a framework, which enables a consistent approach to planning across the chain but also allows local flexibility, taking into account the size, the location and local challenges. This approach characterizes both international and national hotel chains in the sample. For three of them, the company policy on BCP mandates all company properties plan for business interruptions and report compliance on an annual basis, all the way up through the corporate structure. The role of BCP in the company also varies depending on the expansion mode of the hotel chain. Management contract chains usually consider the implementation of these guidelines as mandatory and they are part of their contracts. Franchise-oriented hotel chains, in their majority, followed the same practice. However, in two instances, hotel chains (international and UK-based) offered these C-level guidelines only as an advise to the local owners/operators, who may opt to adopt them or reject them. As a result, in probably one extreme case, a London property has no security at all. In one case, an international hotel chain did not have any C- level BC directives for the individual properties and the initiative to develop a BCP was taken by the management team of the London property. Budget allocation is another factor indicative of C-level involvement and commitment. In all chains in this study, budgets for BCP are dealt at property level and there is not a fixed way for their allocation (such as, for example, a percentage of budgeted revenue). Individual properties are responsible to make things happen and justify the costs in their budgets. C-level management deal only with BCP budgets for their headquarters only. 2006 10
  11. 11. Business Continuity in London Hotel Chains There is significant variance in the degree of C-level commitment to BC in our sample. In four international hotel chains, apart from C-level management, unit-level management (GM, Director of Security, etc.) is responsible for knowledge and implementation of BCP with regular reporting as part of their job description and consequently their annual appraisals. In three cases, although there are very clear and detailed BCPs for the properties, the implementation of these programmes is left to one or two persons for multiple London properties. The study revealed that, apart from these persons, nobody else in London (not even the GMs of the properties) is familiar with the BC procedures, showing that C-level commitment to BC is low. With regards to other C-level BCP support: Three international hotel chains support their properties’ BCPs through a comprehensive Web site on the company’s intranet that normally provides planning guidelines, resource library, and other tools and training resources. Two international and two national hotel chains support their properties with detailed crisis management plans offering guidance for response to a wide portfolio of crises and disasters. Two international and two national hotel chains offer a generic crisis management template for their properties to adapt according to their specific needs. “The core of our programme is a corporate policy that mandates business continuity planning for every location. The GM is given a BC checklist and at the end of each year every hotel has to certify compliance to this checklist. So the GM signs the certificate of compliance and they send it to the executive VP of their region, then this goes to the president of this business unit, then comes to me and I pass it to the Board of Directors. Every level is responsible for compliance of their respective areas of responsibility” 2006 11
  12. 12. Business Continuity in London Hotel Chains 3. Defining Risks and their Business Impact The first step to a BCP is the identification of potential threats to a property and the setting of risk values to those threats. Four international chains in the sample are conducting risk assessment in their properties. The process appears to be similar in all four of them. This is an exercise that is done periodically (normally annually) either by property general managers and CSOs (after appropriate training) or by third party contracted experts. Possible property-specific vulnerabilities and threats are identified and appropriate security measures are included in the BCP in order to minimize them. However, risk assessment is a continuous C-level activity too. Security levels at property level as well as extra security measures may be imposed by corporate crisis teams, which monitor the global situation and the security threats for London. All four international chains subscribe to business intelligence services, two of them to more than one. Security and safety is not viewed as a competitive area by any of the hotel chains in our sample. Communication and collaboration on this issue with competitors is perfectly acceptable and part of the companies’ culture. At C-level, executives from five chains in this study are members of the International Hotel and Restaurant Association’s (IH&RA) Global Council on Safety, Security and Crisis Management with the objective to share information and best practice in order to orient, train and prepare the industry for potential crises. At property level, security managers of seven chains in our sample collaborate with each other, exchanging information and participating in meetings of the Institute of Hotel Security Managers (IHSM), a confederation of four and five-star hotels through which security staff share information and maximise their arrangements to prevent all aspects of crime. A key link between all the participating hotel chains is the London Metropolitan Police. Following the risk assessment, it is normally useful to conduct a Business Impact Analysis (BIA) in order to determine which of the risks can be tolerated by the property and which require the management to take measures to reduce or eliminate them. 2006 12
  13. 13. Business Continuity in London Hotel Chains The study showed that no hotel chain has a structured approach towards this task. The participating chains determine their “risk appetite” and capacity for taking on additional risks in much the same way individual investors determine their own tolerance for various financial risks, and they use that knowledge to diversify their BC efforts. In the case of franchised hotels much of this risk tolerance is left to the individual owners. Although the participating chains have not explicitly defined what are their mission-critical activities that need to be the focus of a BC plan, most interviewees agreed that these are the following: • Maintaining guest and employee communication during and after a disruptive incident/event, • Ensuring power supply • Ensuring water supply • Maintaining safe guest room conditions • Maintaining reasonable levels of HVAC in the property (heating, ventilation and air-conditioning) • Safeguarding computer operations (check-in/out, door locks, guest billing) or having alternate manual systems, • Having the ability to operate food service, and • Securing alternate guest accommodation. According to the respondents, the above constitute the typical recovery areas for any BCP effort in their properties, in the event of a business disruption. There are no specific recovery standards or metrics, with the exception of IT systems, which have specific Recovery Point and Time Objectives (RPOs and RTOs) but as in most cases these are centralized they are dealt with at C-level. “Our BCP depends very much on a co- ordinated team effort across the organization with numerous departments playing critical roles. In assigning criticality to just one part of the organization, it is all too easy to overlook the small stuff that could slowly erode our brand value and reputation.” 2006 13
  14. 14. Business Continuity in London Hotel Chains 4. Crisis Management Team The organization of business continuity teams and their roles and responsibilities vary with the level of sophistication of BCPs. Four of our respondents noted that at C-level they have a communications crisis team that mobilizes alongside the operations crisis team in response to any incident. In three other cases, there is just one crisis management team (CMT) responsible for co-ordinating the emergency response, business resumption and communications at the same time. At property-level, the General Manager chairs the team normally with the Director of Security or/and the Chief Engineer second in command. The rest of the management team (HR Manager, Ops Manager, S&M Manager, Financial Controller) are part of the CMT. Regardless of the differences between BCPs among the participants, when the respondents were asked which are (or could be) the main functions of a property-level CMT they gave the following responses: • Damage assessment after the occurrence of disruption. • Notification of local and C-level CMTs. • Co-ordination of life, property and environment protection immediately after the disruption (employee and guest evacuation, first aid, incident containment). • Co-ordination with emergency services. • Transition of critical resources (human and business) to alternate recovery facilities (sister hotels or other hotels). • Provision of consistent, timely and accurate information about the incident to staff, management, business partners, guests and public. • Expedient and timely allocation of resources and equipment needed for business recovery and resumption. • Co-ordination of technical and operational business recovery efforts. • Normalization of operations in the property to a ‘business-as- usual” level. “On the 7th of July we tried to communicate as much as possible and to tell everyone in the hotel what the plans were. We briefed the staff. We wrote letters, which were put under guestroom doors. We also left voicemail messages. We made brief announcements over the PA system. Guest relations organised Q&A meetings in the ballroom. Finally, we sent e-mail blasts to those who had reservations in the following two days and to all tour operators and travel agents we work with” 2006 14
  15. 15. Business Continuity in London Hotel Chains 5. Operational Components The basic operational components of a BCP appear to be present in all properties of the chains in this study: surveillance devices, smoke detectors, fire alarms, guest notification (PA) systems (in some properties in more than one language). However, few hotel chains take precautionary measures beyond what the ones that are legally required. In case of power failure most of the properties in our sample operate emergency generators whereas the rest have battery- backup emergency systems. Only a few properties have standby (auxiliary) backup power systems, i.e., power systems for presumably nonessential systems, such as guest room lighting and air-conditioning or heating. In most cases the properties can have an emergency power supply for 4 to 7 hours, covering corridors and emergency elevators. In most cases computer systems are on some form of uninterruptible power supply (UPS). Electronic guest room locks are usually battery operated and will not be directly affected by a power outage. Water supply does not appear to worry the hotel managers that were interviewed, as they were pretty certain that there would be no interruptions. Almost all interviewees confirmed that their companies have good contacts with utility companies, telecommunications service providers as well as with Public Authorities (Metropolitan Police, Fire Brigade, Ambulance Service, etc.). Although, as previously indicated, ten of the hotel chains in our sample have some kind of BCP and therefore they have planned the operation of a CMT, not much thought has been given by most of them on the location which the CMT will make its command centre. The business continuity practice is for companies to have two sites that may be used as command centre (primary and secondary in case that the primary is not accessible). The general advice is for this site to be located at least 800 metres away from every street in the perimeter of the property so that it cannot be affected by a possible car bomb (VBIED - Vehicle Borne Improvised Explosive Device). Four international hotel chains have specific guidelines on how this command centre should be equipped but there are different approaches as to where they should be located. Three respondents suggest that the primary command centre should be located in either the General Manager’s or the Security office (hot site), whereas the secondary in another location, possibly a guestroom (cold site). The fourth respondent suggests two guestrooms for primary and secondary site (hot and warm sites) 2006 15
  16. 16. Business Continuity in London Hotel Chains and a third one possibly in another location (cold site) outside the main building of the property. It has to be noted, however, that the former respondents mandate emergency command centres in their properties, whereas the latter only recommends their existence to franchisees. One international chain maintains fully equipped command centre in the security office of every property. The rest of the respondents consider, if they have any, their security offices as emergency command centres, otherwise it is their property GM’s office. In any case, no special provision, with the exception of perhaps walkie-talkies is made in terms of emergency equipment. Most of the hotel chains use third party contractors to outsource parts of their functions with IT, accounting and security being on the top of the list. The majority of Service Level Agreements with these contractors are normally negotiated at C-level. Two international hotel chains require third party suppliers to have a BCP. Of these two, one requires a statement from the supplier that a BCP is in place. The other one takes more assertive action and examines the supplier’s BCP using a specially designed questionnaire. This questionnaire is used to assess all critical suppliers of the company, not only the outsourcers. Three respondents said that they feel confident that IT and accounting outsourcers would have a BCP and do not feel that they should put any further pressure to the rest of their suppliers. The hotel chains with more sophisticated BCPs use third party contractors for parts of their BC. Normally these are business intelligence providers, risk assessment providers, emergency communication (for example e-mail) providers, security companies (to provide, for example, additional protection to a property in an emergency situation), building evaluators, back-up power suppliers, counselling services for guests and staff, etc. “This questionnaire can be used with any vendor. We see if they use any business continuity language and, if they don’t, we suggest that they start using; and if they come back saying, “we do not have a BC plan and we do not intend to have one” then we plan around them. Our plans are of no value when they cannot ensure their BC”. 2006 16
  17. 17. Business Continuity in London Hotel Chains 6. Emergency Communications Effective internal (within the hotel chain) communication before, during and after a business disruption can dramatically affect the outcome of the BCP. Apart from landline telephony, which is the most common communication medium, most of the hotel chains in our sample use a mix of communications media with some of them having invested time and money to optimize this aspect of BCP. All respondents noted that they are aware that landline telephony alone is not sufficient because in an emergency situation it can impacted by issues such as power outage, hardware and line faults as well as inability to cope with excessive demand and consequent introduction of “call gapping” (a system that prevents certain calls to enter the network, allowing only a certain amount per time period). Again all respondents would use mobile telephony as an alternative communications medium in times of emergency. Most of the respondents are aware of the Access Overload Control (ACCOLC) that in case of a wide scale incident gives priority mobile network access to emergency and public safety services, leaving out all other users. Hotels in an area of 3 miles surrounding to Aldgate East experienced the effects of ACCOLC in the 7th of July. Three hotel chains are currently experimenting Internet Protocol (IP) communications. Although in a power outage situation IP telephones will be inoperable, if the power supply is secured, they can provide a reliable communications solution. Satellite telephony is relatively new to the hospitality sector and two hotel chains have reported that they are using a limited number of portable satellite handsets. They provide a high degree of independence and although expensive they are very effective in times of crisis. E-mail is also a reliable and effective means of communication during a crisis, which is common to all hotel chains in this study. However, this too, is susceptible to disruptions and therefore backup providers offer emergency support. Four hotel chains in our sample use emergency e-mail system provided by third part contractors. When the chain’s system goes down there is a seamless rollover within 20-30 minutes to an entirely new networking system. One hotel chain relies significantly on mobile e-mail through the use of Blackberry devices. These devices use the General Packet Radio Service (GPRS) protocol and due to their packet-based 2006 17
  18. 18. Business Continuity in London Hotel Chains nature they do not require continuous link with the network. Therefore, even when the network is traffic-jammed they may be more effective in sending messages than other devices. Experience from the London bombings has proven that these are effective devices, provided that there is network support. The UK’s (and world’s) largest Internet Exchange point, LINX, did not report any significant operational impact on the 7th of July. Therefore, company intranets are another reliable and effective means of internal communication. Eight hotel chains in our sample stated that they have intranets. An overlooked but quite effective and economical medium is the pager. American-based hotel chains use it extensively and as paging networks are separate from mobile ones, they are very efficient with their use of bandwidth. Pager messages can normally be up to 240 characters (including spaces and punctuation points) and although they do not offer the SMS features of mobile phones their transmission in times of crisis is far more reliable and faster. Three hotel chains are using pagers in London and they claim that on 7 July, when landline and mobile telephony became extremely stressed, the paging network remained available throughout the crisis. Perhaps the most important aspect of internal communication during a crisis is the CMT notification. Best practice requires the use of a “call tree” for the members of CMT. According to this approach each team member should notify selected individuals, who in turn notify other individuals, until everyone has been contacted. In the 8 crisis management plans that were reviewed in this study only six has a “call tree”. In one case, although the crisis management plan cover had a 2006 date, the “call tree” had not been updated for the last four years, while in another the crisis management plan was printed in 1999. Two international hotel chains use automated notification systems that can reach multiple employees simultaneously by phone, SMS and pager. The system uses the Internet to call all the people that need to be called trying office numbers, home numbers, mobile phone numbers and pagers with a sequence that varies depending on the time zone, so if a person is in a place where it is night-time it will start with their home number and then move to their mobile or pager. External communication with partners, customers, families of employees and guests as well as the press is equally important for the reputation of the company. All hotel chains in the sample have a crisis communication policy. 2006 18
  19. 19. Business Continuity in London Hotel Chains In two cases crisis communications is outsourced to public relations companies. In the rest of the hotel chains crisis communications is normally a C-level responsibility. As the web is deemed an efficient means of broadcasting communications, many hotel chains are considering in their BCP the addition of a news update in their corporate websites with information on the crisis and the ways that the company is dealing with it. In the aftermath of Katrina, one international hotel chain has taken this one step further and added a n “Emergency Update” page in their website with separate sections with updated information on the crisis for their guests (including ho their reservations will be affected), their employees, the press and the community. In addition to the above, one international hotel chain uses the services of a crisis-counselling supplier who provides a family assistance hotline. In the event of a disaster in a hotel or a number of hotels the hotel chain provide a telephone number where families of employees or guests can call and find information about their family members that may be missing. The hotel chain recognised that normal telephone operators cannot cope with the grief and the pressure from these calls. The supplier provides operators who are trained to assist all callers by listening, explaining, and providing information about their relatives. They identify themselves as being “the hotel chain” so that the callers do not have the feeling that they were passed to someone else. These operators have guest and employee lists of the properties in crisis and they are handling the enquiries based on the information that they receive from the hotel chain, e.g., the person is in the X hospital, is safe, is evacuated, etc. “As a global hotel chain, we have people from all over the world, and in the event of a major disaster, everyone wants to know about people's safety. July 7th was filled with lots of uncertainty, and many companies struggled to communicate. I didn't realize the power of the intranet until then” “You've got to have a system that will allow you to communicate using multiple devices. If you have flexibility, you have a much better chance of finding the right people and making sure that your hotel’s crisis staff and procedures are in place” 2006 19
  20. 20. Business Continuity in London Hotel Chains 7. Management and Staff Training BC procedures during and after a crisis may be significantly different from the very day tasks for both staff and managers in a hotel property. Therefore training in these procedures is of paramount importance. All hotel chains are required by the law to train their staff in safety and evacuation procedures and conduct regular fire drills. They should also have designated first-aiders in all departments and shifts. All participants stated that their companies meet these requirements. Eight participants went further to state that their employees receive also training for bomb threats and handling potentially hazardous materials. However it appears that, apart from the above, in the majority of the hotel chains in our sample staff receives little or no training on business continuity procedures as described in the companies’ crisis management plans. Two international chains were the exception to the above rule by adopting a calendar approach of security and safety training activities that should be completed every month, quarterly or every six months. They also offer a number of training tools and resources in their intranets. Department heads are responsible to carry out these training activities but the property’s GM or HRM is accountable for the programme and reports directly to the regional VP on the training progress. With regards to the senior hotel staff, things are not significantly different in our sample. There were instances that members of the CMT did not know that they are part of this team and in four cases they were not even aware of the existence of a crisis management plan. In all hotel chains of the study the crisis management plan is considered as a confidential document and is kept by the property’s GM and CSO (if there is one). However, only two of the respondents were able to confirm that the details of this plan were known to more than these two persons (GM and CSO) in all their properties When asked about budgets allocated for BC training, no respondent was in the position to answer. This does not necessarily mean that there is no such budget and their inability to give a figure may be 2006 20
  21. 21. Business Continuity in London Hotel Chains attributed to the fact that in most companies training budgets are the responsibility of HR (the only HR respondent was from a chain that is currently in the process of developing a BCP). In order to validate the strategy, assumptions, procedures and guidelines of the BCP and to identify any gaps or weaknesses in the plan, hotel properties have to test their plans against likely disruption scenarios. Only three international hotel chains stated that they are testing their BC plans both at corporate and at property level, at least annually. The most common method of testing reported was the “walkthrough” but “simulations” take also place. “Walkthroughs” allow the members of CMTs to review and critique each others’ test activities and performance. One of these respondents asserted that, in certain occasions, they run unannounced simulations, videotape them and use them as training material in other properties within the region. The importance of BCP testing is highlighted by the response of the participants in the question “what do you think is currently your weakest link in your continuity strategy? People, technology, suppliers?” All of the participants, regardless of their testing practice, confirmed that the ‘people factor’ is the weakest link, followed by technology. The respondents whose companies are testing their BCPs reported that in many cases CMTs do not stick to the plan, whereas more often than not there are conflicts over decisions and, in some cases, CMT members are unsure of their roles. “If you don’t go through the BCP at least once every year, you will forget so much, that your plans won’t be of much use when the world goes ‘pear shaped’…you can’t call a time out to dig though through well-planned manuals” “The trouble with people is not that they don't know but that they know so much that ain't so. All strategies work well in paper and we think that we are prepared and know what to do and this is so wrong!” 2006 21
  22. 22. Business Continuity in London Hotel Chains 8. Performance Measurement One of the biggest challenges for BCPs is the measurement of their performance. No hotel chain in our sample has developed any specific metrics that measure the effectiveness of their BCPs. One respondent argued that, apart from the RTOs in the technology side of their BCPs, they use qualitative critiques, evaluations with checklists, “health check” tools with tick boxes but not specific metrics. Another participant suggested that a useful metric would be the rating of “feeling of security” that was introduced in their company’s Guest Satisfaction Survey after 9/11. A third respondent stated that, in their hotel chain, funding for BCP is allocated on a case-by-case basis due to the fact that they are not able to demonstrate ROI, which would enable them to create actual budgets. “It is hard for us to develop that quantitative return on investment when we are trying to prove a negative. The only thing we can say is: ‘we have spent X amount of money and as a result we did not have a crisis’. This is really a tough sell for us!” 2006 22
  23. 23. Business Continuity in London Hotel Chains Contact Details Alexandros Paraskevas Oxford Brookes University Business School Department of Hospitality, Leisure and Tourism Management Headington Campus (F113) Oxford, OX3 0BP United Kingdom Tel: +44 (0)1865 483835 Fax: +44 (0)1865 483878 The information contained in this report is of a general The Department of Hospitality, Leisure and nature and is not intended to address the circumstances Tourism Management is described as 'one of the of any particular individual or entity. Although we leading hospitality research groups in the UK' in endeavour to provide an accurate picture of the general the recent Research Assessment Exercise. industry situation, this information cannot be taken as representing policies or views of particular companies or Our strategy is to maintain a clear industry- persons. based focus and our research combines academic rigour with managerial relevance. Oxford Brookes University is not responsible for any personal opinion expressed in this report Publication date: October 2006 2006 23