Recovering from Disaster: a lesson in why Business Continuity is necessary

Jamie pondered the new Activity Recovery Plan. “That consultant from IT Governance really knows his stuff,” he said to Rosanna, the HR Director, as he made notes on the draft, carefully avoiding the damp patch on his desk.

The flood had changed a lot of thinking at their firm about the need for planning to meet the requirements of something other than sales targets.

Now, his specific activity had its own recovery plan, which he and his team would be able to access. Their ongoing training programme had also developed to include regular business continuity sessions, which Jamie was about to discuss with Rosanna. There was a good chance that, from here on, they would all know what to do in situations when the proverbial hit the fan; as had not been the case that day when the business park had flooded to the surprising depth of one metre.

Jamie knew how high the waters had come as the walls of the goods out section had been coated in foul-smelling slime to a height of exactly one metre, as recorded in his report, having measured it with a ruler himself. He liked accurate metrics. Quality metrics helped the company to stay ahead of the competition, whose manufacturing standards left much to be desired, he believed. The thought of all the damaged units in the dumpster only served to strengthen his resolve. They needed to make better plans for disruption!

“It was so bad when the water rescue teams got here that they told us to stay inside because it was too dangerous to remove us. We had to wait up on the second floor. The despatch bay was beyond use of course, as we would have needed a rubber boat to move around it. Not that we could have done much to keep the goods moving without the IT system anyway.”

The IT applications had failed. The ISP connection was one of the first victims of the rising floodwater, and since the required IT applications – namely QC admin application, Stock control system and Bar code system – were all accessed via a browser from the servers on the main site in London, then normal operations would have had to have been suspended. Not that this seemed to matter much while the river water roared through the car park, vehicles bobbing about like corks.

Jamie had thought at the time how vulnerable they would have been in a situation where the IT had gone down due to a hacker attack or just a good old-fashioned power cut brought about by over-zealous excavation work.

Although the floodwaters had receded within 24 hours, the damage to the quality assurance operation had been critical, preventing any products from leaving the site. There had been talk of implementing a manual QC release system, at least for a few days to clear the backlog, but no-one knew if this would actually meet the requirements. Then there would have been the question of where to put production items coming off the line. They all required ultra-clean conditions. Certainly, it had never been envisaged that the IT set up would be out of action for several days like this. More importantly, the whole business revolved around clean rooms for production and goods areas that were kept scrupulously free of any form of contaminant, such as human hair for example, that might find their way into the product itself (not on Jamie’s watch) or the packaging used to ship the deliveries. It was ridiculous that the company had no viable alternative to the site that now smelt and looked like a sewer. Jamie preferred not to think about this: after all, the water must have mixed with raw sewerage?

Disruption can mean Disaster – and some enterprises do not recover from their losses

Power failures had been anticipated, as had the consequences of a fire, although the assumption had been that the operation would transfer to the West Brompton facility in the event that the premises were damaged beyond use. No-one had reckoned on the new owners selling that operation within a month of the merger. The fact is, they hadn’t even told Jamie that QC releasing could no longer be carried out there. So much for their old Business Continuity Plan that the Board had not reviewed at the time – mainly, he supposed, because they were too busy negotiating the sale. Admittedly, it had secured their future – or so they all thought at the time. Who could have predicted that the most sustained period of torrential rain in the area’s history would hit them just two weeks later – and prevent shipments at the busiest time of the year? It really had been a disaster!

It hadn’t helped that two members of his team were off with flu when the business continuity exercise was due to take place. The CEO had asked Rosanna to reschedule, as Jamie’s team was not the only one with a significant number of staff down with the bug. The irony of postponing a business continuity test due to unforeseen circumstances had not been lost on the workforce at the time. Unfortunately, the new date and time had been set for the Wednesday in the week after the flood had painfully underlined why business continuity management is not a laughing matter. Needless to say, this exercise too was cancelled, mainly because the staff left on Jamie’s site were now busy trying to save what was left of the packaging materials and office equipment. As they carefully picked through the debris, a team of managers from Head Office accompanied insurance assessors around the now largely empty building as they valued the flood damaged items. The car park was free of cars, but filling up with builder’s vans as workmen arrived to start removing the plasterboard – more dust!

‘Business continuity plans’ are not a Business Continuity Management System (BCMS)!

“At least we had some notion of what a business continuity plan was when this happened,” said Rosanna, by way of breaking the ice in a difficult conversation, her eyes wandering as she spoke in the direction of the newspaper cutting from the local press that Jamie had stuck to the board:

“Medical supplier faces massive damage claim”. It was a sentiment that had done little to impress their customers it seemed, as several of them (5 was it?) had started legal actions to recover the costs of their own lost revenue resulting from the disruption to their supply. Being one of only three manufacturers of the lab test kit in the world – a product that their company had proudly announced last year – had, it seemed, turned out to be something of a mixed blessing. The private sector laboratories that were tasked with screening something over a million blood samples were not amused to find that their only alternative to the ones that Jamie’s team QC tested were made in China, and that all their planned production had been purchased months ahead by a hungry US market, where the test was proving popular. Even the 1.3 billion Chinese citizens couldn’t seem to fill the demand that had suddenly sprung up. As Rosanna went through the HR plan for business continuity training, Jamie reflected on the fact that they had sold West Bromwich to raise the funds for new production on this site.

“What exactly can HR do to help you get things running again,” Rosanna said, sensing that Jamie was still not fully over the angry mood he had been in following the worst of the crisis. He cared so much about quality.

“Tell our esteemed CEO and his fellow directors about Clauses 4, 5, 6, 7, 8, 9 and 10”.

“I’m sorry, Jamie? I don’t follow?”

“Start with ‘Context of the organisation, then Leadership, Planning, Support, Operations, Evaluation, and finally, talk to them about Improvement.”

Rosanna wondered whether the strain had been rather too much this time.

“Couldn’t you do that for yourself?”

“I did. I sent them a proposal, in my other capacity as ‘Business Continuity Manager’ for the adoption of international standard known as ISO 22301.”

“Oh really,” said Rosanna. “That sounds interesting. What does it involve?”

To be continued…

 

If you would like to find out more about Business Continuity Planning and how to set up and run a Business Continuity Management System (BCMS), talk to our consultants by calling: 0845 070 1750.

Bookmark this page as well:

http://www.itgovernance.co.uk/iso-22301-consultancy.aspx

Share your thoughts