RISK ANALYSIS AND BUSINESS CONTINUITY
There is nothing with greater legal and financial ramifications than the proper protection of the workforce and corporate assets, together with the provision of contracted services to customers.
Events over the past two or three years have concentrated the minds of business leaders on their security procedures and their ability to protect both assets and staff in the event of a terrorist attack. Unforeseen disasters deserve similar consideration.
The Government, together with other foreign governments, including the USA, remind us that Al Qaeda and its supporters are likely to strike anywhere, anytime. Pessimists believe that it is a case of “when, not if” with regard to the UK.
MI5 has dispensed with its customary cloak of secrecy and given a ten point advice plan which allows companies to assess their own vulnerability to attack.
The first point in that advisory document suggests that an organisation should conduct a risk analysis. This is an objective view of your organisational vulnerability, focussing on both specific and potential threats.
A risk analysis will review corporate activity both internally and externally – a process likened to peeling away the layers of an onion. This will result in the identification of areas of threat.
A coherent and rational corporate security plan will allow properly selected, vetted and trained staff to implement security-minded management policies, supported by appropriate technology. This latter point is important because some representatives will attempt to sell items which maximise their own commission, rather than that which objectively fulfils the need of the customer.
As with all preventative measures a would-be criminal will find themselves confronted by a number of impenetrable layers of protection designed to send them elsewhere.
However, if the worst case happens, or there is a disaster which is outside the preventative control of the organisation, the company needs to recover and continue its activity as soon as possible.
Failure to do so could result in:
- Loss of work to competitors
- Failures within your supply chain
- Loss of reputation
- Human Resource issues
- Health and Safety liabilities
- Higher insurance premium
POTENTIAL BUSINESS FAILURE.
When considering business continuity a corporation should ask itself a number of ‘what if?’ questions.
These encompass issues such as catastrophic IT and communications failure, loss of key documents, inability to occupy premises, injuries to personnel, effect on business relationships and the like.
A worst-case scenario should be envisaged to gauge the effect of its constituent parts.
Your plan will need to consider the use of alternative premises, together with the phased re-establishment of business activity in priority order.
In addition areas of responsibility need to be clearly defined, with the strategic activists being divorced from the ‘doers’.
Once your plan and the areas of responsibility have been decided, appropriate training and practice sessions should be devised. The plan is a living document, with a senior person, probably at director level, being responsible for its sponsorship and update.
DON’T BE THE ONE ASKING “HOW ARE WE GOING TO GET OVER THIS?”.
|
