How Global Crisis Have Helped Shaped Uk Organisations

1

How global crisis has helped shaped Business continuity planning in UK

Organization

BY

ADELAKUN OLUWAFEMI. A
MBA
University of Wales
April 2011

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola
A4019368 MBA Risk management, University of Wales.

2

Executive Summary

Business continuity management in recent times has begun to gain more relevance in the UK
after the tragedy events of September 11 and July 7 bombings in London. Current trends are to
transfer the primary ownership of the BCP to corporate or general management and to integrate
business continuity and IT security planning.

This paper identifies the impact of crisis on business continuity and focus on how global crisis
such as September 11 and July 7 bombings has helped shaped business continuity planning in
UK organizations.

Information for this analysis was obtained from journals, articles and business continuity
proceedings. However, obtaining information for this research was challenging as most
organizations business continuity plan was not publicly available.

This paper has been able to identify gaps with business continuity plan and business continuity
practices amongst business organization.

Based on findings, this paper concluded firms must periodically re-evaluate the
comprehensiveness of their business continuity strategy to avoid catastrophic consequences from
a wide variety of serious internal and external threats, including increasing information security
threats.


3

Table of content

Contents
Table of content ........................................................................................................................................ 1
1.0 Introduction ................................................................................................................................... 4
2.0 Impact of global crisis on Organizations and Economy ............................................................... 5
3.0 How Global Crisis has helped shaped UK organizations ............................................................. 7
3.1 Changes with data back-up centers ............................................................................................... 7
3.2 Changes with human resource management ................................................................................. 9
3.3 Changes with Testing of Business Continuity Plan (BCP) ......................................................... 10
3.4 Communication ........................................................................................................................... 11
3.4 Developing scenarios .................................................................................................................. 12
4.0 Conclusion .................................................................................................................................. 14
References ............................................................................................................................................... 15


4

1.0 Introduction
All organizations from all sectors (public, private and not-for-profit) face the possibility of
disruptive events that have impacts ranging from mere inconvenience and short-lived disruption
of normal operations to the very destruction of the organization. Organizations are face with a
variety of threats and vulnerabilities and these continue to evolve. Business disruptions can
include natural disasters such as flood, tsunami (recent in Japan), fire outbreaks, oil spillage
(BP), hurricanes, power outages and system failure. Since 9/11 in the US and the 7/7 bombings
in London, the threats of man-made disasters such as terrorist attacks has taken a sense of
urgency as well. The reality of business is that increasing and dynamic natural, technological and
human induced threats, business complexity, government regulation, corporate governance
requirements, media and public scrutiny demand a comprehensive and integrated approach to
BCP.

Business continuity planning addresses the prospect that a disaster might interrupt organizations
business operations. Irrespective of sector an organization operates, the need to mitigate disaster
risk has become especially salient. This places an increasing importance of the need for all
organizations to conduct an effective business impact analysis as this will help management to
understand the criticality of different business functions, recovery time required and the need for
various resources (Dominic, Brahim and Ethne, 2001). Prior to 9/11, Business continuity
planning remains largely a supporting project or program that is discretionary except in highly
regulated industries such as healthcare and banking where BCP related requirements and
standards have been established.

Reoccurring barriers to effective implementation of BCP has been lack of top management
participation and involvement as BCP constitute a non revenue procuring area for companies.
Organizations shed expenses often slashing funding for BCP initiatives with a view to improving
their bottom line. This outlook is shortsighted as disaster cannot be timed or predicted.
Organizations that downsize BCP to improve immediate bottom line are abdicating their long


5

term fiduciary responsibility. This „it can‟t happen to us” thinking too often leads to disastrous
results (Raymond, 2002).

2.0 Impact of global crisis on Organizations and Economy
Crisis such as the September 11, 7/7 bombings, the tsunami and earthquake in Japan (2011) has
both direct and indirect impact on lives, businesses, property and the economy as a whole.
Usually crisis has larger impact on the macro economy and psychological impacts on most
people.
The tragic event of September 11, 2001 claimed about 3000 lives and left many injured (fox
news, 2010). Many organizations lost their key staff, information databases and intellectual
resources. Important and business data were lost and this affected may business which did not
have back ups or back ups were on site of the attack. The event caused the New York stock
market‟s closure for about 6 days which impacted negatively on share prices and a resultant
effect on the city‟s GDP which was estimated to have declined by $27.3 billion for the last three
months of 2001 and all of 2002 (Dune, 2005). The Dow Jones industrial average stock market
index fell 684 points to 8921 while the US stock lost $1.4 trillion for the week as the markets
faced decline (Barnhart, 2001). The 9/11 impacted on many jobs as the economy experience an
extensive mass layoffs which displaced nearly 13000 employees and in New York City and $2.8
billion in wages were lost in the three months following the 9/11 attacks (Makinnen, 2002).
Makinen (2002) in his paper ,The economic effect of 9/11: A retrospective assessment, reported
that the September 11 attack was followed by a massive loss in the tourism sector of the US
economy as reports shows that in the week following the attack, hotel occupancy fell below 40%
and 3000 employees were laid off. In general, the attack had an exponential effect on the U.S
unemployment rate.

For London, 7/7 bombings was the biggest attack in the UK since 1998 as reported by Professor
Michael Clarke, a terrorism expert (David, 2005). The tragedy events claimed about 56 lives and
left many injured. The bombings caused a day-long disruption of London‟s transport and mobile
telecommunications infrastructure. For most of the day, London was shut down to visitors (
Karin Brothers, 2008). The value of the British pound decreased 0.89 cents to a 19-month low


6

against the US$. The FTSE 100 Index decreased by about 200 points during the two hours after
the first attack (Dune

Although, the London bombs did not destroy any of the city's commercial infrastructure, many
firms were on standby as the extent of the damage became clear particularly the capital's
financial institutions that are so vulnerable to systems going down. This event has provoked a
reassessment of business continuity planning (Mark, 2005).


7

3.0 How Global Crisis has helped shaped UK organizations

Few organizations prior to September 11 have BCP in place, which were mainly focused on data
recovery and neglected some other areas. In the U.S, companies that have adequate back ups and
contingency plans were able to respond positively to the attack of 9/11. This became a wake up
call for most UK organizations as reports reveal that prior to September 11, the state of BCP is
dismissal in most organizations and non existence in many. This is not surprising since BCP has
not been given sufficient consideration. (Harris). Prior to the 7/7 bombings, research by London
chamber of commerce shows that over 50% of UK organizations still do not have effective BCP
in place. In recent times, companies are now beginning to see beyond terrorism as the only
disruptor to business activities and focusing on events such as flood, system failure and power
outages. This became evident in a research conducted by the data recovery specialist SunGard,
only 5% of business in the UK say that terrorism poses a primary threat to them. This
increasingly indicates that majority of UK companies see terrorism has a secondary reason why
business need to be concerned about business continuity, hence they simply want to know that
they can rely on IT system in the event of data recovery (Mark, 2005).
For most organizations the impacts of 9/11 attacks have provided some impedance for the more
widespread recognition and acceptance of BCP as a strategic function. This was reflected in the
swift response by UK banks and most organizations after the 7/7 bombings in London indicating
that contingency planning have increased considerable. (David, 2005). Subsequent to 9/11 and
7/7, there has been a tremendous change in BCP practices across many organizations in the UK.

3.1 Changes with data back-up centers

Although some businesses have learned from their mistakes and refined their recovery plans,
others have a long way to go. Prior to 9/11, most organizations have their back ups on site and
some have it within a central location; this was based on the premise of easy accessibility in the
event of any disruption. However, the increasing effect of crisis globally has given rise to the
need for organizations to have more than a single back –up data center located away from their
primary datacenter. Although this might mean additional cost for organizations, but the cost


8

associated with loss of data, reputation and survival cost could be more in the event of such crisis
if an effective BCP is not in place. Companies now have back-up centers across geographical
locations. A great distance between sites is still a positive aspect of BCP, but the ability to reach
and access sites under various scenarios must also be considered.

In an article written by john-Paul, (2007) evidences shows that when most of Manhattan closed
down, organizations that had sited their main and back-up data center in the same area found that
they could not resume business. Merrill Lynch is one of the companies that has decentralized its
core IT systems after the attack. The financial services firm lost two data centers on September
11. It has now moved its primary datacenter to Staten Island, where it run on a separate electrical
grid to mitigate against the loss of power in one area and the New York site has a back-up.

Morgan Stanley is another financial firm that has separated its trading and back-up facilities,
which were within close proximity and dependent on the same transport and power infrastructure
prior to 9/11 (John-Paul, 2007).

Also, the tunnel fire incident of 2002 in Manchester, northwest England caused a major
disruption to telephone lines in Royal & Sun Alliance's main offices, an international insurance
group. 130,000 landlines across the region went down for a whole day and communications
problems continued throughout the following week. This was a serious incident as the bandwidth
available to Royal & sun Alliances was compromised and routing calls became a more complex
matter, hence company without the capability to work around any outages simply lost
businesses. Luckily for Royal& Sun Alliance, SunGard had recently upgraded a recovery center
some distance from Manchester, and outside the impact zone of the fire. In short, bandwidth was
restored within two hours of the incident being reported, and within four hours all telecom
services were fully operational, and servers and desktop PCs were in place for staff to use.

This seems typical of the post-9/11 attitude towards disaster recovery and business continuity
and not because of terrorism, but because of all the other hazards a business may face; it has
become business as usual (Mark, 2005).


9

3.2 Changes with human resource management

A survey carried out by the UK Tripartite Financial Authorities after the 7/7 bombings revealed
that human aspect are frequently overlooked within business continuity arrangements (David,
2007). Further lesson from 9/11 is that organizations need to think of the company as a whole,
including people and processes, as well as IT. “Prior to 9/11, many firms did not really take
account of staff in their plans. Having remote data centers is very good, but if there are no staff,
or absent key staff as a result of an incident, this can bring an organization to its knees,” said Ron
Miller, managing consultant at SunGard in an article written by john-Paul (2007). After the
collapse of the world trade center, staffs were evacuated and backup facilities were without
either primary or back up personnel to execute the BCP and keep the business operating
(Raymond, 2002). This places the need for employee consideration in terms of communication,
transportation and welfare in BCP planning and not just focusing on IT and data recovery
centers. For most London based companies, not until the events of July 2005 that organization
really began to explore this area. The terror attacks of 7th July 2005 caused wide-spread
disruption to organizations, not because of the minimal physical impact of the attacks on
London‟s infrastructure, but because of the subsequent lockdown of the public transport network
and the psychological impact: people did not want to travel due to fear of further attacks.
Workplace recovery facilities were open, available, and unaffected, but getting staff into place as
per organizational business continuity plans proved a difficult task (David, 2007).

In view of this, Bob Piggott, head of group crisis management at HSBC, said the finance sector
has learnt crucial lessons from 9/11 and HSBC has established a direct communications links
with Transport for London and the Metropolitan Police with a view to providing adequate
transport facilities for its employees. However, providing transport facilities can itself create
risks which need to be considered. For instance, if employees are herded together onto one bus,
the bus could become a single point of failure should it be trapped in traffic jam. Also the greater
is the risk of loosing critical employees in the event of an accident occurring. If a number of staff
were to become involved in a serious road traffic accident, this could have a major long term
impact on productivity as well as the short-term ability to meet workplace recovery


10

requirements. A fleet of taxis or minibuses taking more than one route to any particular recovery
centre is a safer option and the risk associated with having employees clustered together is
minimized (David, 2007).

The need for skills and knowledge of employees to be back up is increasingly important
following the fact that many organizations lost principal intellectual assets during the 9/11 and
7/7 crisis (Raymond, 2002). This increasingly leads to the need for organizations to cross train
their critical executive positions.

Further to safeguarding intellectual competences, organizations develop programmes to support
their key employees to work from home. However, Working from home may leave employees
distracted and unable to concentrate on the work properly which often arises from domestic
responsibilities or disturbances from kids, resulting in stress and frustration. (Nayab 2011). It
should also be noted that that employees working from home could be well exposed to domestic
hazards which could as well hinder them from working. Having corporate software programmes
on personal computers could be seen as an unethical practice. Employees working from home
require training and support from employers. This seems typical of the post-9/11 and 7/7 attitude
towards business continuity.

3.3 Changes with Testing of Business Continuity Plan (BCP)

Prior to 9/11, many organizations rarely test their business continuity plan and those that test
neglect their employees. Organizations spend time, efforts and resources to construct BCPs but
do not test them. Most likely these firms will not be able to successfully enact their BCPs when a
crisis begins. Merely documenting a plan does not guarantee success. To ensure usability, a BCP
must be diligently, comprehensively, and consistently tested. Live testing also trains staff. When
a crisis ensues, staff members who have been through the test are prepared to act with confidence
(Raymond, 2002). In a survey carried out by the department of Trade & Industry on disaster
recovery in 2006, it was found that of the 60% of UK firms that had a disaster recovery plan, less
than 50% had conducted live tests involving staff in the past year, and companies base their
plans on misconceptions and false assumptions.


11

John-Paul, in his article; disaster planning and business after 9/11 reveal that Morgan Stanley
conducts major tests every year. Over the Easter weekend, the firm takes advantage of the
powering down of all its main data centers in Canary Wharf to run a full simulation of a total
loss of data at all offices with 200 people. The firm also conducts business process testing twice
a year, in which it sends a team to the recovery site to execute trades. "It is very important in
terms of familiarizing staff with everything from getting to the site to knowing how to use it,"
said Richard Deighton, continuity manager EMEA business at Morgan Stanley.

Jon France, business continuity manager at business information provider LexisNexis conduct a
series of live disaster recovery simulations throughout the year. He acknowledged that full
scenario testing can be expensive and time-consuming and that is why some companies are
reluctant to test regularly. He added that the frequency of a company's simulation should reflect
the rate of change within the business (John-Paul, 2007).

Voca (the United Kingdom directs debit clearing house) now runs its business from a back-up
site for up to five weeks a year. It‟s off site back ups appear to be a favorite method for
protecting data for 58% of solution providers data (David, 2007).

3.4 Communication
Communication is an important element of business continuity planning which has not been
given due attention. Reports reveal that after the 9/11 attacks, communication networks failed to
cope with demand as there were physical damage to mobile transmitters and landline exchanges
.however, the 7/7 London experience seem to show that these lessons have still to be learned by
many companies as most organizations still rely on mobile networks as a means of
communication during crisis. This increasingly calls for businesses to develop an alternative
communications system for emergencies.

Subsequent to the 7/7 bombings and the June 2007 car bomb, Royal British legion has developed
communication software called ACENS in reaching its employees during crisis. Its management
said “When England suffered persistent heavy snow fall in January 2010, we used AC ENS to
notify our staff of building closure and to avoid using transport in Central London. We also used


12

the system to notify all staff once the building had re-opened. We were very impressed with the
speed in which staff were notified and we were able to communicate by voice call, SMS and
email in one click of a button to our whole employee database. Feedback was that the system
saved time, money and stress when compared with the previous year in similar circumstances
during the bad weather of February 2009. As we had no way of communicating with staff
previously in a timely manner, lots of employees were left unsure of whether to venture into
work and in some cases, they travelled to work and had to turn around and go
back”(www.safeguardcomms.co.uk).

Post 9/11, HSBC‟s Bob Piggott, head of group crisis management in an article written by John-
Paul (2007) said that the bank has provided all staffs in the UK a telephone number they can
ring to receive updated status message in the event of an incident. Providing this service can help
reassure staff, who might receive confusing reports from the media during a disaster.

3.4 Developing scenarios
Although, companies are more aware of the need to develop effective BCP, majority of the
companies are still lacking behind in terms of developing scenarios and planning for different
type of incidents. It is often seen as a cost and hence, they plan for potential industrial specific
ones forgetting that hazards can come in different ways (Continuity compliance, 2010).

A highlight from the BP‟s response to the Gulf of Mexico oil spillage shows lack of readiness
and preparedness in BP‟s emergency response plan. Evidences from articles and related
materials reveal that BP has failed to recognize and plan for different scenarios. In an article
written by rick jervis (2010), the energy giant never anticipated an oil spillage as the one
spewing from the gulf of Mexico as its plan only offers technical details on how to use chemical
dispersants and provides information on what to say to the media, it did not mention how to react
if a deep water well spill oil uncontrollably. This indicates that BP has not considered this in its
emergency plan. Further evidences in his article reveals that most of the techniques attempted by
BP to contain the swelling well from a 100-ton containment device that didn't work to a mile-
long tube aimed at piping out the spewing oil were not mentioned in the plan. This increasingly


13

indicates that BP engineers were only improvising as there were no readily available documented
plans for such incident.

Rick Steiner, an oil spill response consultant who has reviewed the plan, in the same article
reveal that parts of the plan read like boilerplate used by BP from region to region and
underscore the energy company's inability to adequately prepare for a major spill in deep water.
Although, the plan also promises that BP can respond to a "worst case discharge" of around 1
million gallons a day, BP engineer struggled for months to control a well spewing one-fifth of
that. (Rick, 2010).

Bp‟s response failure should be a wake up call for organizations as the need to develop scenarios
becomes increasingly an important aspect of effective BCP. However, if BP has considered an
oil spillage it would have been able to respond positively and timely to the crisis. Disasters are
not limited only in industry specific incidents. Hence the need for organizations to give
consideration to potential specific and relevant risk event that can disrupt both business
continuity plans for organizations as well as potential relevant impact such an event could have
on all stakeholders and environment surrounding the organization (Rick, 2010). Companies
therefore need to develop scenarios and alternative plans supporting each scenario while
focusing on critical issues and response methodologies necessary to mitigate unforeseen events
before they actually occur (continuity compliance, 2010).


14

4.0 Conclusion
Surveys indicate that the majority of firms recognize natural disasters as a significant threat and
may have disaster contingency and recovery plan in place. However, such plans only address one
class of threats, while ignoring other serious threats, both internal and external. This paper has
been able to examine how global crisis has helped shaped BCP planning in the UK. Although
many firms after the 9/11 and the 7/7 claim to have developed contingency plans, it was apparent
that many are still neglecting important areas while focusing on industry specific risks.

A large number of firms are minimizing the importance of testing and maintaining the BCP, yet
testing is critical to developing an effective BCP and to assess the effectiveness of the BCP
before an actual disaster occurs. There is clear evidence that a company without a BCP has a low
probability of survival. However, even after the 9/11 terrorist attacks in the United States, only
53 percent of the firms surveyed in 2002 by Ernst & Young had a BCP (Virginia and Mich,
2004).

Further observation of this paper is that many of the existing BCPs are seriously deficient and
outdated, as they do not address many of today‟s major risks of business systems interruption.
The overwhelming conclusion is that firms must periodically reevaluate the comprehensiveness
of their business continuity strategy to avoid catastrophic consequences from a wide variety of
serious internal and external threats, including increasing information security threats. Current
trends are to transfer the primary ownership of the BCP to corporate or general management and
to integrate business continuity and IT security planning. Some companies have given this
responsibility to a new corporate position, a Chief Continuity Officer (Virginia and Mich, 2004).
While no amount of security measures can provide absolute protection from all potential
intrusions and disasters, a comprehensive BCP will dramatically increase a company‟s defenses
and reduce the impact of any business.


15

References

Barnhart, B., 2001. Markets reopen, plunge. Chicago Tribune [Online] 17th September. Available at:
http://www.chicagotribune.com/business/chi-010917markets,1,2882341.story. [Accessed 28 March 2011].

Contingency compliance, 2010. Contingency plan and crisis management efforts by BP under fire from DHS.
[Online] 19 May. Available at: http://www.continuitycompliance.org/information/regulatory-
compliance/contingency-plan-and-crisis-management-efforts-by-bp-under-fire-from-dhs/. [Accessed 23 February
2011].

David, H., 2007. Work place strategies for a changing world. [Online]. Available at:
http://www.continuitycentral.com/feature0613.html [Accessed 29 March 2011].

David, H., 2005. Business continuity lessons from July 7th. [Online] 15 July. Available at:
http://www.continuitycentral.com/feature0225.htm [Accessed 29 March 2011].

David. K., 2005. London’s day of terror. [Online] 8 July. Available at: http://www.dailymail.co.uk/news/article-
354944/Londons-day-terror.html#ixzz1HosVLSo3. [Accessed 29 March 2011].

Dominic, E., Ethne, S. and Brahim, H., 2010. Business continuity management: A crisis management approach. 2 nd
ed. Oxon: Routledge.

Dune. L., 2005. U.S. Stocks Rise, Erasing Losses on London Bombings; Gap Rises. [Online] 7 July. Available at:
http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aflPCIrU37Ns&refer=us. [Accessed 30 March 2011].

Fox news, 2010. 9Years Later, Nearly 900 9/11 Responders Have Died, Survivors Fight for Compensation. FOX
News. [Online].11 September. Available at: http://www.foxnews.com/politics/2010/09/09/report-responders-died-
ground-zero-illnesses/. [Accessed 29 March 2011].

John-Paul, 2007. Disaster planning and business continuity after 9/11. [Online] 11th September. Available at:
http://www.computerweekly.com/Articles/2007/09/07/226632/Disaster-planning-and-business-continuity-after-
911.htm. [Accessed 18 March 2011].

London chamber of commerce and Industry, 2005. The economic effects of terrorism on London- experiences of
firms in London business community. [Online]Available at:
http://www.londonchamber.co.uk/docimages/754.pdf.[Accessed 29 March 2011]

Makinen, G., 2002. The Economic Effects of 9/11: A Retrospective Assessment [Pdf]. Congressional Research
Service. Library of Congress. [Online]27 September .Available at: http://www.fas.org/irp/crs/RL31617.pdf.
[Accessed 28 March 2011].

Mark, V., 2005. In wake of London terrorism, business continuity plan follows a pragmatic course.[Online] 30
August. Available at: http://www.techrepublic.com/article/in-wake-of-london-terrorism-business-continuity-
planning-follows-pragmatic-course/5843482. [Accessed 18 March 2011].

Nayab, N., 2011. Key Areas of Encouragement for the Work from Home Employee. [Online]. 21 March. Available
at: http://www.brighthub.com/office/home/articles/68833.aspx#ixzz1I0jvUlfI [Accessed 29 March 2011].


16

Raymond, J.G., 2002. Why do business continuity plan fail. [Online].Available at:
http://www.rmmag.com/Magazine/printtemplate.cfm?AID=1483. [Accessed 26 March 2011]

Rick, j., 2010. BP response shows lack of readiness. [Online] 17th May. Available at:
http://www.usatoday.com/news/nation/2010-05-17-oil-plan_N.htm. [Accessed 29 March 2011].

Royal British legion.[Online] Available at:
http://www.safeguardcomms.co.uk/downloads/Royal_British_Legion_AC_ENS.pdf. [Accessed 30 March 2011]

Virginia and Mich. J.C., 2004. Business continuity planning: A comprehensive approach, [Online], Available at:
http://www.auerbach-publications.com/dynamic_data/3138_1893_bcp.pdf. [Accessed 25 March 2100].


How Global Crisis Have Helped Shaped Uk Organisations

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (10)

Similar to How Global Crisis Have Helped Shaped Uk Organisations

Similar to How Global Crisis Have Helped Shaped Uk Organisations (20)

More from Oluwafemi Adelakun

More from Oluwafemi Adelakun (6)

Recently uploaded

Recently uploaded (20)

How Global Crisis Have Helped Shaped Uk Organisations