How Global Crisis Have Helped Shaped Uk Organisations
1How global crisis has helped shaped Business continuity planning in UKOrganization BY ADELAKUN OLUWAFEMI. A MBA University of Wales April 2011 How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
2Executive SummaryBusiness continuity management in recent times has begun to gain more relevance in the UKafter the tragedy events of September 11 and July 7 bombings in London. Current trends are totransfer the primary ownership of the BCP to corporate or general management and to integratebusiness continuity and IT security planning.This paper identifies the impact of crisis on business continuity and focus on how global crisissuch as September 11 and July 7 bombings has helped shaped business continuity planning inUK organizations.Information for this analysis was obtained from journals, articles and business continuityproceedings. However, obtaining information for this research was challenging as mostorganizations business continuity plan was not publicly available.This paper has been able to identify gaps with business continuity plan and business continuitypractices amongst business organization.Based on findings, this paper concluded firms must periodically re-evaluate thecomprehensiveness of their business continuity strategy to avoid catastrophic consequences froma wide variety of serious internal and external threats, including increasing information securitythreats. How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
3Table of contentContents Table of content ........................................................................................................................................ 1 1.0 Introduction ................................................................................................................................... 4 2.0 Impact of global crisis on Organizations and Economy ............................................................... 5 3.0 How Global Crisis has helped shaped UK organizations ............................................................. 7 3.1 Changes with data back-up centers ............................................................................................... 7 3.2 Changes with human resource management ................................................................................. 9 3.3 Changes with Testing of Business Continuity Plan (BCP) ......................................................... 10 3.4 Communication ........................................................................................................................... 11 3.4 Developing scenarios .................................................................................................................. 12 4.0 Conclusion .................................................................................................................................. 14 References ............................................................................................................................................... 15 How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
41.0 IntroductionAll organizations from all sectors (public, private and not-for-profit) face the possibility ofdisruptive events that have impacts ranging from mere inconvenience and short-lived disruptionof normal operations to the very destruction of the organization. Organizations are face with avariety of threats and vulnerabilities and these continue to evolve. Business disruptions caninclude natural disasters such as flood, tsunami (recent in Japan), fire outbreaks, oil spillage(BP), hurricanes, power outages and system failure. Since 9/11 in the US and the 7/7 bombingsin London, the threats of man-made disasters such as terrorist attacks has taken a sense ofurgency as well. The reality of business is that increasing and dynamic natural, technological andhuman induced threats, business complexity, government regulation, corporate governancerequirements, media and public scrutiny demand a comprehensive and integrated approach toBCP.Business continuity planning addresses the prospect that a disaster might interrupt organizationsbusiness operations. Irrespective of sector an organization operates, the need to mitigate disasterrisk has become especially salient. This places an increasing importance of the need for allorganizations to conduct an effective business impact analysis as this will help management tounderstand the criticality of different business functions, recovery time required and the need forvarious resources (Dominic, Brahim and Ethne, 2001). Prior to 9/11, Business continuityplanning remains largely a supporting project or program that is discretionary except in highlyregulated industries such as healthcare and banking where BCP related requirements andstandards have been established.Reoccurring barriers to effective implementation of BCP has been lack of top managementparticipation and involvement as BCP constitute a non revenue procuring area for companies.Organizations shed expenses often slashing funding for BCP initiatives with a view to improvingtheir bottom line. This outlook is shortsighted as disaster cannot be timed or predicted.Organizations that downsize BCP to improve immediate bottom line are abdicating their long How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
5term fiduciary responsibility. This „it can‟t happen to us” thinking too often leads to disastrousresults (Raymond, 2002).2.0 Impact of global crisis on Organizations and EconomyCrisis such as the September 11, 7/7 bombings, the tsunami and earthquake in Japan (2011) hasboth direct and indirect impact on lives, businesses, property and the economy as a whole.Usually crisis has larger impact on the macro economy and psychological impacts on mostpeople.The tragic event of September 11, 2001 claimed about 3000 lives and left many injured (foxnews, 2010). Many organizations lost their key staff, information databases and intellectualresources. Important and business data were lost and this affected may business which did nothave back ups or back ups were on site of the attack. The event caused the New York stockmarket‟s closure for about 6 days which impacted negatively on share prices and a resultanteffect on the city‟s GDP which was estimated to have declined by $27.3 billion for the last threemonths of 2001 and all of 2002 (Dune, 2005). The Dow Jones industrial average stock marketindex fell 684 points to 8921 while the US stock lost $1.4 trillion for the week as the marketsfaced decline (Barnhart, 2001). The 9/11 impacted on many jobs as the economy experience anextensive mass layoffs which displaced nearly 13000 employees and in New York City and $2.8billion in wages were lost in the three months following the 9/11 attacks (Makinnen, 2002).Makinen (2002) in his paper ,The economic effect of 9/11: A retrospective assessment, reportedthat the September 11 attack was followed by a massive loss in the tourism sector of the USeconomy as reports shows that in the week following the attack, hotel occupancy fell below 40%and 3000 employees were laid off. In general, the attack had an exponential effect on the U.Sunemployment rate.For London, 7/7 bombings was the biggest attack in the UK since 1998 as reported by ProfessorMichael Clarke, a terrorism expert (David, 2005). The tragedy events claimed about 56 lives andleft many injured. The bombings caused a day-long disruption of London‟s transport and mobiletelecommunications infrastructure. For most of the day, London was shut down to visitors (Karin Brothers, 2008). The value of the British pound decreased 0.89 cents to a 19-month low How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
6against the US$. The FTSE 100 Index decreased by about 200 points during the two hours afterthe first attack (DuneAlthough, the London bombs did not destroy any of the citys commercial infrastructure, manyfirms were on standby as the extent of the damage became clear particularly the capitalsfinancial institutions that are so vulnerable to systems going down. This event has provoked areassessment of business continuity planning (Mark, 2005). How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
73.0 How Global Crisis has helped shaped UK organizationsFew organizations prior to September 11 have BCP in place, which were mainly focused on datarecovery and neglected some other areas. In the U.S, companies that have adequate back ups andcontingency plans were able to respond positively to the attack of 9/11. This became a wake upcall for most UK organizations as reports reveal that prior to September 11, the state of BCP isdismissal in most organizations and non existence in many. This is not surprising since BCP hasnot been given sufficient consideration. (Harris). Prior to the 7/7 bombings, research by Londonchamber of commerce shows that over 50% of UK organizations still do not have effective BCPin place. In recent times, companies are now beginning to see beyond terrorism as the onlydisruptor to business activities and focusing on events such as flood, system failure and poweroutages. This became evident in a research conducted by the data recovery specialist SunGard,only 5% of business in the UK say that terrorism poses a primary threat to them. Thisincreasingly indicates that majority of UK companies see terrorism has a secondary reason whybusiness need to be concerned about business continuity, hence they simply want to know thatthey can rely on IT system in the event of data recovery (Mark, 2005).For most organizations the impacts of 9/11 attacks have provided some impedance for the morewidespread recognition and acceptance of BCP as a strategic function. This was reflected in theswift response by UK banks and most organizations after the 7/7 bombings in London indicatingthat contingency planning have increased considerable. (David, 2005). Subsequent to 9/11 and7/7, there has been a tremendous change in BCP practices across many organizations in the UK.3.1 Changes with data back-up centersAlthough some businesses have learned from their mistakes and refined their recovery plans,others have a long way to go. Prior to 9/11, most organizations have their back ups on site andsome have it within a central location; this was based on the premise of easy accessibility in theevent of any disruption. However, the increasing effect of crisis globally has given rise to theneed for organizations to have more than a single back –up data center located away from theirprimary datacenter. Although this might mean additional cost for organizations, but the cost How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
8associated with loss of data, reputation and survival cost could be more in the event of such crisisif an effective BCP is not in place. Companies now have back-up centers across geographicallocations. A great distance between sites is still a positive aspect of BCP, but the ability to reachand access sites under various scenarios must also be considered.In an article written by john-Paul, (2007) evidences shows that when most of Manhattan closeddown, organizations that had sited their main and back-up data center in the same area found thatthey could not resume business. Merrill Lynch is one of the companies that has decentralized itscore IT systems after the attack. The financial services firm lost two data centers on September11. It has now moved its primary datacenter to Staten Island, where it run on a separate electricalgrid to mitigate against the loss of power in one area and the New York site has a back-up.Morgan Stanley is another financial firm that has separated its trading and back-up facilities,which were within close proximity and dependent on the same transport and power infrastructureprior to 9/11 (John-Paul, 2007).Also, the tunnel fire incident of 2002 in Manchester, northwest England caused a majordisruption to telephone lines in Royal & Sun Alliances main offices, an international insurancegroup. 130,000 landlines across the region went down for a whole day and communicationsproblems continued throughout the following week. This was a serious incident as the bandwidthavailable to Royal & sun Alliances was compromised and routing calls became a more complexmatter, hence company without the capability to work around any outages simply lostbusinesses. Luckily for Royal& Sun Alliance, SunGard had recently upgraded a recovery centersome distance from Manchester, and outside the impact zone of the fire. In short, bandwidth wasrestored within two hours of the incident being reported, and within four hours all telecomservices were fully operational, and servers and desktop PCs were in place for staff to use.This seems typical of the post-9/11 attitude towards disaster recovery and business continuityand not because of terrorism, but because of all the other hazards a business may face; it hasbecome business as usual (Mark, 2005). How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
93.2 Changes with human resource managementA survey carried out by the UK Tripartite Financial Authorities after the 7/7 bombings revealedthat human aspect are frequently overlooked within business continuity arrangements (David,2007). Further lesson from 9/11 is that organizations need to think of the company as a whole,including people and processes, as well as IT. “Prior to 9/11, many firms did not really takeaccount of staff in their plans. Having remote data centers is very good, but if there are no staff,or absent key staff as a result of an incident, this can bring an organization to its knees,” said RonMiller, managing consultant at SunGard in an article written by john-Paul (2007). After thecollapse of the world trade center, staffs were evacuated and backup facilities were withouteither primary or back up personnel to execute the BCP and keep the business operating(Raymond, 2002). This places the need for employee consideration in terms of communication,transportation and welfare in BCP planning and not just focusing on IT and data recoverycenters. For most London based companies, not until the events of July 2005 that organizationreally began to explore this area. The terror attacks of 7th July 2005 caused wide-spreaddisruption to organizations, not because of the minimal physical impact of the attacks onLondon‟s infrastructure, but because of the subsequent lockdown of the public transport networkand the psychological impact: people did not want to travel due to fear of further attacks.Workplace recovery facilities were open, available, and unaffected, but getting staff into place asper organizational business continuity plans proved a difficult task (David, 2007).In view of this, Bob Piggott, head of group crisis management at HSBC, said the finance sectorhas learnt crucial lessons from 9/11 and HSBC has established a direct communications linkswith Transport for London and the Metropolitan Police with a view to providing adequatetransport facilities for its employees. However, providing transport facilities can itself createrisks which need to be considered. For instance, if employees are herded together onto one bus,the bus could become a single point of failure should it be trapped in traffic jam. Also the greateris the risk of loosing critical employees in the event of an accident occurring. If a number of staffwere to become involved in a serious road traffic accident, this could have a major long termimpact on productivity as well as the short-term ability to meet workplace recovery How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
10requirements. A fleet of taxis or minibuses taking more than one route to any particular recoverycentre is a safer option and the risk associated with having employees clustered together isminimized (David, 2007).The need for skills and knowledge of employees to be back up is increasingly importantfollowing the fact that many organizations lost principal intellectual assets during the 9/11 and7/7 crisis (Raymond, 2002). This increasingly leads to the need for organizations to cross traintheir critical executive positions.Further to safeguarding intellectual competences, organizations develop programmes to supporttheir key employees to work from home. However, Working from home may leave employeesdistracted and unable to concentrate on the work properly which often arises from domesticresponsibilities or disturbances from kids, resulting in stress and frustration. (Nayab 2011). Itshould also be noted that that employees working from home could be well exposed to domestichazards which could as well hinder them from working. Having corporate software programmeson personal computers could be seen as an unethical practice. Employees working from homerequire training and support from employers. This seems typical of the post-9/11 and 7/7 attitudetowards business continuity.3.3 Changes with Testing of Business Continuity Plan (BCP)Prior to 9/11, many organizations rarely test their business continuity plan and those that testneglect their employees. Organizations spend time, efforts and resources to construct BCPs butdo not test them. Most likely these firms will not be able to successfully enact their BCPs when acrisis begins. Merely documenting a plan does not guarantee success. To ensure usability, a BCPmust be diligently, comprehensively, and consistently tested. Live testing also trains staff. Whena crisis ensues, staff members who have been through the test are prepared to act with confidence(Raymond, 2002). In a survey carried out by the department of Trade & Industry on disasterrecovery in 2006, it was found that of the 60% of UK firms that had a disaster recovery plan, lessthan 50% had conducted live tests involving staff in the past year, and companies base theirplans on misconceptions and false assumptions. How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
11John-Paul, in his article; disaster planning and business after 9/11 reveal that Morgan Stanleyconducts major tests every year. Over the Easter weekend, the firm takes advantage of thepowering down of all its main data centers in Canary Wharf to run a full simulation of a totalloss of data at all offices with 200 people. The firm also conducts business process testing twicea year, in which it sends a team to the recovery site to execute trades. "It is very important interms of familiarizing staff with everything from getting to the site to knowing how to use it,"said Richard Deighton, continuity manager EMEA business at Morgan Stanley.Jon France, business continuity manager at business information provider LexisNexis conduct aseries of live disaster recovery simulations throughout the year. He acknowledged that fullscenario testing can be expensive and time-consuming and that is why some companies arereluctant to test regularly. He added that the frequency of a companys simulation should reflectthe rate of change within the business (John-Paul, 2007).Voca (the United Kingdom directs debit clearing house) now runs its business from a back-upsite for up to five weeks a year. It‟s off site back ups appear to be a favorite method forprotecting data for 58% of solution providers data (David, 2007).3.4 CommunicationCommunication is an important element of business continuity planning which has not beengiven due attention. Reports reveal that after the 9/11 attacks, communication networks failed tocope with demand as there were physical damage to mobile transmitters and landline exchanges.however, the 7/7 London experience seem to show that these lessons have still to be learned bymany companies as most organizations still rely on mobile networks as a means ofcommunication during crisis. This increasingly calls for businesses to develop an alternativecommunications system for emergencies.Subsequent to the 7/7 bombings and the June 2007 car bomb, Royal British legion has developedcommunication software called ACENS in reaching its employees during crisis. Its managementsaid “When England suffered persistent heavy snow fall in January 2010, we used AC ENS tonotify our staff of building closure and to avoid using transport in Central London. We also used How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
12the system to notify all staff once the building had re-opened. We were very impressed with thespeed in which staff were notified and we were able to communicate by voice call, SMS andemail in one click of a button to our whole employee database. Feedback was that the systemsaved time, money and stress when compared with the previous year in similar circumstancesduring the bad weather of February 2009. As we had no way of communicating with staffpreviously in a timely manner, lots of employees were left unsure of whether to venture intowork and in some cases, they travelled to work and had to turn around and goback”(www.safeguardcomms.co.uk).Post 9/11, HSBC‟s Bob Piggott, head of group crisis management in an article written by John-Paul (2007) said that the bank has provided all staffs in the UK a telephone number they canring to receive updated status message in the event of an incident. Providing this service can helpreassure staff, who might receive confusing reports from the media during a disaster.3.4 Developing scenariosAlthough, companies are more aware of the need to develop effective BCP, majority of thecompanies are still lacking behind in terms of developing scenarios and planning for differenttype of incidents. It is often seen as a cost and hence, they plan for potential industrial specificones forgetting that hazards can come in different ways (Continuity compliance, 2010).A highlight from the BP‟s response to the Gulf of Mexico oil spillage shows lack of readinessand preparedness in BP‟s emergency response plan. Evidences from articles and relatedmaterials reveal that BP has failed to recognize and plan for different scenarios. In an articlewritten by rick jervis (2010), the energy giant never anticipated an oil spillage as the onespewing from the gulf of Mexico as its plan only offers technical details on how to use chemicaldispersants and provides information on what to say to the media, it did not mention how to reactif a deep water well spill oil uncontrollably. This indicates that BP has not considered this in itsemergency plan. Further evidences in his article reveals that most of the techniques attempted byBP to contain the swelling well from a 100-ton containment device that didnt work to a mile-long tube aimed at piping out the spewing oil were not mentioned in the plan. This increasingly How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
13indicates that BP engineers were only improvising as there were no readily available documentedplans for such incident.Rick Steiner, an oil spill response consultant who has reviewed the plan, in the same articlereveal that parts of the plan read like boilerplate used by BP from region to region andunderscore the energy companys inability to adequately prepare for a major spill in deep water.Although, the plan also promises that BP can respond to a "worst case discharge" of around 1million gallons a day, BP engineer struggled for months to control a well spewing one-fifth ofthat. (Rick, 2010).Bp‟s response failure should be a wake up call for organizations as the need to develop scenariosbecomes increasingly an important aspect of effective BCP. However, if BP has considered anoil spillage it would have been able to respond positively and timely to the crisis. Disasters arenot limited only in industry specific incidents. Hence the need for organizations to giveconsideration to potential specific and relevant risk event that can disrupt both businesscontinuity plans for organizations as well as potential relevant impact such an event could haveon all stakeholders and environment surrounding the organization (Rick, 2010). Companiestherefore need to develop scenarios and alternative plans supporting each scenario whilefocusing on critical issues and response methodologies necessary to mitigate unforeseen eventsbefore they actually occur (continuity compliance, 2010). How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
144.0 ConclusionSurveys indicate that the majority of firms recognize natural disasters as a significant threat andmay have disaster contingency and recovery plan in place. However, such plans only address oneclass of threats, while ignoring other serious threats, both internal and external. This paper hasbeen able to examine how global crisis has helped shaped BCP planning in the UK. Althoughmany firms after the 9/11 and the 7/7 claim to have developed contingency plans, it was apparentthat many are still neglecting important areas while focusing on industry specific risks.A large number of firms are minimizing the importance of testing and maintaining the BCP, yettesting is critical to developing an effective BCP and to assess the effectiveness of the BCPbefore an actual disaster occurs. There is clear evidence that a company without a BCP has a lowprobability of survival. However, even after the 9/11 terrorist attacks in the United States, only53 percent of the firms surveyed in 2002 by Ernst & Young had a BCP (Virginia and Mich,2004).Further observation of this paper is that many of the existing BCPs are seriously deficient andoutdated, as they do not address many of today‟s major risks of business systems interruption.The overwhelming conclusion is that firms must periodically reevaluate the comprehensivenessof their business continuity strategy to avoid catastrophic consequences from a wide variety ofserious internal and external threats, including increasing information security threats. Currenttrends are to transfer the primary ownership of the BCP to corporate or general management andto integrate business continuity and IT security planning. Some companies have given thisresponsibility to a new corporate position, a Chief Continuity Officer (Virginia and Mich, 2004).While no amount of security measures can provide absolute protection from all potentialintrusions and disasters, a comprehensive BCP will dramatically increase a company‟s defensesand reduce the impact of any business. How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
15ReferencesBarnhart, B., 2001. Markets reopen, plunge. Chicago Tribune [Online] 17th September. Available at:http://www.chicagotribune.com/business/chi-010917markets,1,2882341.story. [Accessed 28 March 2011].Contingency compliance, 2010. Contingency plan and crisis management efforts by BP under fire from DHS.[Online] 19 May. Available at: http://www.continuitycompliance.org/information/regulatory-compliance/contingency-plan-and-crisis-management-efforts-by-bp-under-fire-from-dhs/. [Accessed 23 February2011].David, H., 2007. Work place strategies for a changing world. [Online]. Available at:http://www.continuitycentral.com/feature0613.html [Accessed 29 March 2011].David, H., 2005. Business continuity lessons from July 7th. [Online] 15 July. Available at:http://www.continuitycentral.com/feature0225.htm [Accessed 29 March 2011].David. K., 2005. London’s day of terror. [Online] 8 July. Available at: http://www.dailymail.co.uk/news/article-354944/Londons-day-terror.html#ixzz1HosVLSo3. [Accessed 29 March 2011].Dominic, E., Ethne, S. and Brahim, H., 2010. Business continuity management: A crisis management approach. 2 nded. Oxon: Routledge.Dune. L., 2005. U.S. Stocks Rise, Erasing Losses on London Bombings; Gap Rises. [Online] 7 July. Available at:http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aflPCIrU37Ns&refer=us. [Accessed 30 March 2011].Fox news, 2010. 9Years Later, Nearly 900 9/11 Responders Have Died, Survivors Fight for Compensation. FOXNews. [Online].11 September. Available at: http://www.foxnews.com/politics/2010/09/09/report-responders-died-ground-zero-illnesses/. [Accessed 29 March 2011].John-Paul, 2007. Disaster planning and business continuity after 9/11. [Online] 11th September. Available at:http://www.computerweekly.com/Articles/2007/09/07/226632/Disaster-planning-and-business-continuity-after-911.htm. [Accessed 18 March 2011].London chamber of commerce and Industry, 2005. The economic effects of terrorism on London- experiences offirms in London business community. [Online]Available at:http://www.londonchamber.co.uk/docimages/754.pdf.[Accessed 29 March 2011]Makinen, G., 2002. The Economic Effects of 9/11: A Retrospective Assessment [Pdf]. Congressional ResearchService. Library of Congress. [Online]27 September .Available at: http://www.fas.org/irp/crs/RL31617.pdf.[Accessed 28 March 2011].Mark, V., 2005. In wake of London terrorism, business continuity plan follows a pragmatic course.[Online] 30August. Available at: http://www.techrepublic.com/article/in-wake-of-london-terrorism-business-continuity-planning-follows-pragmatic-course/5843482. [Accessed 18 March 2011].Nayab, N., 2011. Key Areas of Encouragement for the Work from Home Employee. [Online]. 21 March. Availableat: http://www.brighthub.com/office/home/articles/68833.aspx#ixzz1I0jvUlfI [Accessed 29 March 2011]. How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.
16Raymond, J.G., 2002. Why do business continuity plan fail. [Online].Available at:http://www.rmmag.com/Magazine/printtemplate.cfm?AID=1483. [Accessed 26 March 2011]Rick, j., 2010. BP response shows lack of readiness. [Online] 17th May. Available at:http://www.usatoday.com/news/nation/2010-05-17-oil-plan_N.htm. [Accessed 29 March 2011].Royal British legion.[Online] Available at:http://www.safeguardcomms.co.uk/downloads/Royal_British_Legion_AC_ENS.pdf. [Accessed 30 March 2011]Virginia and Mich. J.C., 2004. Business continuity planning: A comprehensive approach, [Online], Available at:http://www.auerbach-publications.com/dynamic_data/3138_1893_bcp.pdf. [Accessed 25 March 2100]. How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.