A well-developed Business Continuity Plan (BCP) can minimize escalating business disruptions, while safeguarding key business interests, relationships, and assets. Unfortunately, many companies do not acknowledge the value of a BCP and fail to prioritize sustainability. This many be especially true of highly regulated industries, such the oil and gas industry, that prioritize mandated compliance measures.
Below are common challenges in business continuity planning and possible countermeasures to offset these BCP hurdles.
Lack of Management Support
It is challenging to perform a cost-benefit analysis that measures the benefits of business continuity. There is a high degree of uncertainty associated with implementing BCP measures. Benefits resulting from BCP and mitigation efforts are dynamic in nature, and are not limited to a single structure, department, or operation.
The financial benefits from a BCP implementation must be viewed from the long-term perspective. A BCP can dramatically lessen the financial impact of future crises and promote operational sustainability and corporate viability. However, managers and corporate executives typically do not act based on “what if” scenarios unless regulations require implementation making it challenging to convince them to develop a BCP. Managerial actions are generally based on concrete financials that benefit departments, stockholders, and the bottom line.
Countermeasure: 2014 Global Risks Report by The World Economic Forum, makes a compelling case that may provoke and inspires leaders to implement continuity efforts.
Budget Restraints
Because companies are in the business of making a profit, business continuity planning budgets are often compromised for other priorities.
Countermeasure: It may be helpful to estimate the cost of implementation for each critical process in relation to the cost of a critical process breakdown. This exercise may highlight the need for a designated business continuity budget.
It may also be necessary to prioritize BCP implementation by each critical process with a step-by-step timeline for completion. Companies can identify and rank the most critical business processes, and implement BCP and mitigation measures based on those priorities. While most processes are intertwined, taking small steps to ensure process continuity is a step toward overall business continuity. Managers may be more likely to implement a BCP if it can be initiated over time.
Maintaining a Culture of Preparedness
Unless a company has experienced an eye-opening business continuity issue, the presence of a realistic, tangible threat may be the only protagonist to champion a culture of preparedness.
Countermeasure: Managers who emphasize, embrace, and enact safety and continuity measures, as part of standard operating procedures will create a work environment that reflects the guiding principles of preparedness. As preparedness measures and best practices are ingrained in operational processes, personnel will be more apt to embrace the culture.
Lack of Business Continuity Awareness + Training
When identifying company, operational, and process vulnerabilities, managers and employees frequently recognize the limits of their business continuity expertise. Oil and gas management and employees may have expertise in hazardous response planning measures and tactics, however their business continuity experience may be limited. The process of identifying business continuity mitigation opportunities, developing recovery processes, and training personnel in continuity roles and responsibilities often requires experience. Companies often disregard business continuity training and awareness as a result of ineptitude.
Countermeasure: If implementing continuity efforts are beyond the scope of managers, companies should consider hiring consultants who specialize in business continuity planning. External resources can address site-specific business continuity needs, detailed standard operating procedures for BCP activation, and personnel training. Training should convey procedural flexibility based on continuing assessment of disaster demands and provide options for each scenario. Companies can also assign a designated manager to become proficiently trained in business continuity in order to pass down preparedness guidelines and best practices.
Identifying Critical Processes
Many mid to large-sized companies often operate with separate, independent business units (or departments). Each critical business process within each unit must be identified and quantified in order to determine its role in the business continuity planning process. Most business unit processes are often intertwined with other critical functions, contributing to the overall profitability of a company. When critical business processes are not functional, a company’s ability to operate and reputation may be in jeopardy.
Countermeasures: Overall resilience capabilities should be prioritized to mitigate any interruption. Understanding response procedures, the interconnected structure of processes between units, and the intricacies of a “Plan B” can make the difference between corporate survival or failure. Crisis and disaster situations usually result in the loss or temporary disruption of one or more of the following necessary key business resources:
- Facilities
- Infrastructure
- IT Applications/Systems
- People
- Supply Chain
Unidentified Threats + Vulnerabilities
Threats and vulnerabilities must be identified in order for potential impacts to be analyzed and countermeasures to be implemented. The continually evolving nature of potential threats and vulnerabilities poses a challenge in business continuity planning. Threats and vulnerabilities can stem from both external and internal actions. New technologies, best practices, and risk mitigation efforts can often minimize threats. However, as operations evolve and new concepts are introduced, additional threats and vulnerabilities can emerge.
Countermeasures: An annual risk and hazard analysis can identify potential undiscovered threats and vulnerabilities relating to business continuity. This analysis indicates the likeliness that specific threats that could occur, considering existing site-specific factors, capabilities, mitigation measures, and history. Companies should analyze potential continuity threats from typical weather patterns, geographical influences, security efforts, inherent operational hazards, as well as facility design and potential maintenance issues.