When it comes to planning for incidents which may interrupt company operations, most firms have technology issues covered. But what many ignore is the impact on staff and what the role of individual employees should be when disaster strikes. Dan Martin examines how and why HR departments should ensure people are placed at the heart of business continuity planning.

The case for continuity

The London terrorist bombings, the Buncefield oil depot explosion, the Cornwall floods were all events which impacted hard on local businesses. Admittedly such incidents are extreme cases but at some point most businesses are likely to be affected by a major event out of their control.

That is where business continuity planning comes in.

Preparing for disruptive incidents will lessen their impact and enable firms to provide continuity of their operations and critical functions. Without an effective and tested plan companies are likely to suffer negative consequences at least in the short term. Of course, it is hard to plan specifically for incidents like terrorist bomb attacks but having a procedure in place to deal with major disruption, whether it be IT system shutdowns, building evacuations or injured employees, will ensure businesses of all sizes are able to cope effectively.

Despite this however, it is clear that business continuity isn’t high up enough on the list of priorities of many companies. Although media coverage of incidents such as the bombings in London on July 7 2005 and the huge explosion at the Buncefield oil depot heightened awareness of how companies should plan for events out of their control, many are still ignoring the issue.

In its annual business continuity research published earlier this year, the Chartered Management Institute (CMI) found perceptions about business continuity still outweigh the reality of actually putting plans in place. The report showed that while 77% of managers believed business continuity is viewed as important by their senior management teams, only 49% had actually formulated a plan. Petra Wilton, head of public affairs at the CMI, believes the results of the survey are worrying. “After seven years of conducting the poll, it is still very disappointing that businesses are not putting continuity planning high enough on their agenda,” she says. “Firms are still far more affected by incidents than they are covered for in planning. There are huge gaps in what is covered and where companies have experienced disruptions.”

Several organisations have been established to promote business continuity. One is the Business Continuity Institute (BCI). Technical director Lyndon Bird is clear about the benefits continuity planning offers companies. “Business continuity management produces a proven cost effective way to identify problems that put your business at risk, devise and implement strategies to mitigate the impact of that risk, and involve key stakeholders in that process,” he says. “Commercially it also provides clear evidence to customers, suppliers, regulators and insurers that your business is being properly managed with adequate governance controls.”

Ignore people at your peril

The importance of backing up IT resources in the event of a system crash is a much publicised issue. There are a wealth of companies and advice organisations providing guidance on ensuring essential data is not lost when disruptive incidents occur. However, staff issues are less well catered for. Employees are at the heart of any organisation but thinking about how to organise and deal with staff still when events happen is often overlooked.

The Chartered Management Institute research revealed that people still come a poor second to technology when planning for disaster. Whereas two thirds of firms were prepared for the loss of IT and telecommunications, three out of four business continuity plans did not include procedures for the impact of losses.

When incidents do occur it is important that employees know how to respond or at least there are sufficient numbers of staff ready to take control. On certain occasions, employees may be distressed, confused and require leadership which could cause a far reaching impact on the business. Mandy Rutter, clinical manager at behavioural risk management firm ICAS, argues that businesses which ignore including people issue in their continuity planning are very unwise. “If businesses assume all people will respond in the same way in times of crises, they are underestimating the level of support which will be necessary and will not be reaching the real talent,” she says.

Incidents such as disease outbreaks or the closure of transport networks may not affect IT systems but will affect a company’s workforce so ignoring potential staff losses would be ill-advised. This is a cautionary tale which the BCI’s Lyndon Bird offers. “For incidents like a possible pandemic sheer lack of staff numbers might be a problem,” he says. For incidents like terrorism the sheer horror of the situation might have traumatic HR impacts that might stop your plan working effectively if they are not addressed.”

People planning

HR departments have a key role to play in the planning process and should be the main driver behind placing people at the plan’s heart. The CMI’s research showed personnel managers are indeed gaining a greater role, something which Petra Wilton says is welcome. According to the report, almost three quarters of HR departments were involved in business continuity planning, compared to just 55% last year.

Wilton argues that when sitting down to formulate the people section of a plan, HR managers should focus on identification. “The first element to the planning process is identifying the risk. Managers should identify who is critical and whether the business will be able to open with them there,” she says. “They should focus on critical talent workers in terms of where main knowledge resides without which business performance might be undermined.”

Managers should also remember that when incidents do take place, some people will find it more difficult than others to cope. Situations like fires or building collapses where access problems occur mean certain members of staff will struggle. Mandy Rutter says that it is therefore up to HR departments to communicate to managers their likely access to trauma who must in turn ascertain the most vulnerable workers. She advises: “There will be people with obvious vulnerabilities such as those who are pregnant or disabled but also those who are less obvious like people who have been through an traumatic incident in their own lives.”

Another useful task is recognising employees within the organisation who possess skills they may not necessarily use at work but do demonstrate when out of the office and will be useful in a crisis. ICAS identifies these people as “first responders” – employees who, for example, may be involved in volunteer work where they have developed strong interpersonal abilities.

It is clear that the planning process should involve all members of staff including administrative employees like receptionists who will often be on the front line when incidents occur. Staff should be made aware that in the event of disaster, they may be required to take on different, more time-critical jobs which involve multiple skills. Communication of this is vital so that everyone knows what they should be doing and when they should be doing it, something with which Lyndon Bird agrees. “Having the best and most sophisticated technical plan in the world won’t work if you don’t have adequate level of properly skilled and trained staff who know how to implement the plan on the day,” he says.

Rutter adds that practical issues must be addressed. Employees must be informed of, for example, an expectation that people will work from home or go to another site when incidents occur, she argues. It is also advisable that all staff provide out-of-hours contact details.

Mel Gosling, managing director of Merrycon, a business continuity management training firm, says there are a wealth of practical issues which are thrown up in the midst of a crisis which HR departments will find hard to deal with without planning. He relates how during a recent client seminar in Leeds he offered a scenario whereby a terrorist cell was held up in the city centre surrounded by a police cordon. The client business in question was faced with having to evacuate 100 of staff from outside the cordon which included all the transport links. Gosling questioned the client on what they would do. He reveals their initial response was: “We don’t know what to do.” A pre-planned place of where to meet and transportation arrangements should a crisis occur, Gosling argues, is one way to cover such eventualities.

Alongside practical issues, more ethical questions need to be answered, an area which Mandy Rutter regularly offers guidance. “It is important that issues such as how company first aiders will deal with people who are injured are addressed,” she says. “Are they going to stay with that person after the time they would normally go home? Will they go to hospital with the injured if their next of kin is not available? How is the company going to allocate 5 first aiders if 10 people are injured? Are first aiders going to be able to calm panicky people down?”

When situations do occur and immediate communication to staff is necessary, Rutter advises that managers do so in a “holistic” manner. “Bosses should not just communicate the facts but also a sense of feeling and future,” she says. “HR departments should say an incident is going on, yes it is distressing but this is what is going to happen in the immediate term. If you look at a lot of company crisis communications to staff, they are incredibly factual and without sense of a personableness.”

Selling it to the FD

As in most business situations, cost is a barrier for many companies dealing with continuity planning. However, as Mel Gosling argues, wrong decisions made in the first few hours of an event are the ones most likely to impact heavily on company finances. A business continuity plan can help to prevent this.

Several research reports have shown that businesses with continuity plans in place benefit as a result. The way in which a firm handles a crisis can impact significantly on the way the firm is perceived internally and externally. Respond well will bring positive results, respond badly and a negative impact is likely to follow. “For a number of firms involved in crises, their shareholder value increased by significant proportion,” Rutter says. “If you compare them to those whose shareholder value decreased the difference was down to how they managed an incident from a people point of view in terms of compassion and a sense of humanness in the way they dealt with relatives and the general public.”

Other benefits HR departments can communicate to those holding the company finances are offered by Lyndon Bird. “In reality not having business continuity management is not a serious option – even if you call it something else,” he says. “It is good business practice, it protects stakeholders and it might well give you commercial benefits against your competitors.”

Embracing continuity planning

It is clear that in the modern world business continuity planning should be embraced by all companies. The costs may be high but the price of not doing so could be much higher should an incident occur.

New regulations mean that business continuity is becoming a requirement for an increasing number of firms. Reporting rules require certain company directors to report on risks, while other businesses also have obligations under the Civil Contingencies Act.

During a speech to the Confederation of British Industry in 2004, MI5 director general Dame Eliza Manningham-Buller said if she could give one single piece of helpful advice to businesses it would be to adopt “a simple, but effective, business continuity plan that is regularly reviewed and tested”. It would seem that is indeed sound advice.