Brief: Business Continuity Management
Client: Global operating company specialized power and automation
A medium sized engineering company in Switzerland lives in the notion that it has done everything necessary to be ready for major incidents. Its operational health and safety regime is strict, fire protection is all up to regulations and detailed crisis management and evacuation plans are in place. It´s IT architecture is geared for ample contingency and quick disaster recovery.
During the year 2007, when the world is confronted with pandemic threats, the executive committee decides to double check the corporations state of readiness.
A series of workshops are organized and conducted with the aim of simulating several emergency scenarios and evaluating the impact on the business.
The result of the financial simulation is shocking. Several scenarios, which do not appear totally unlikely, would lead to insolvency within a matter of weeks, or at least to major disruptions. Just some examples:
- Closure of borders, due to pandemic outbreak in one European country: Cross-border commuters would not be able to reach their workplace, making it almost impossible to keep the production running
- Closure of schools and kindergartens, discontinuation of public transport: A large fraction of the workforce would not be able to come to work.
- Employees reporting sick for fear of infection: Production would come to a halt, cutting the revenue stream. At the same time all wages and salaries would have to be paid in full.
- Workers would be forced to come to work and infections take place at the workplace: lenghty litigation would follow the incident and possibly damages would have to be paid.
- Closure of facilities in order to avoid any risk of infection: Depending on the duration of the closure, wages and salaries would still be due.
- Closure of facilities on the side of suppliers and sub-suppliers, delayed deliveries: Stalled production, cut-off of revenue streams, while cash-out remains at nearly 100%.
After some major weaknesses were identified for a pandemic scenario, other scenarios were simulated, ranging from a sudden shift in currency exchange rates, strike, terrorist threats, blackmail, through to the outage of individual facilities or suppliers due to fire, inundation, etc.
Most of the risk exposure identified was relating to forced interruptions in production, more that expected related to human resources, supply chain, communications, and of course to IT infrastructure. Also, it was discovered that there was no professional public communication emergency plan in place, which would make sure that the corporate image would not suffer more than necessary in the case of an event.
As a result, a modularized crisis plan was developed, and an emergency communication setup was put in place. Most of the counteraction modules were not taken beyond the planning, testing and documentation stage, i.e., they are to be activated and put into effect only in specific situations.
Some measures, relating to general resilience issues were put into practice right away, as for instance the review of all supplier contracts and enhancement to the supplier qualification and monitoring process.
Also, preparations were made to enable extended home office work in the case of an incident. At the end of the workshop series, the participants stated the opinion, that they had contributed considerably to the future proofing of the corporation with very little time spent on the issue.
The process was accompanied by a stringent facilitation on the side of the consultant, with immediate documentation of all results achieved and by the use of a dedicated simulation tool.