Risk news

Despite facing ruin through possible disasters UK businesses are still refusing to make adequate contingency plans, according to new research.

A study published today by the Chartered Management Institute (CMI) claimed that firms were displaying a "dangerously cavalier attitude", despite warnings about the need to prepare for incidents such as flooding, powercuts, terrorism and computer viruses.

The survey was released as part of International Business Continuity Awareness Week, which began on Sunday (4 March). This latest study is the fifth to be carried out by the CMI since 1999.

According to the research, published in association with the Business Continuity Institute, just 47% of UK organisations have a business continuity plan. For those that do have a planned response, many cannot be sure that it would work as in practice only 57% have tested their plans annually, or more frequently.

Also, one in 10 of those with a plan admitted that they had not made any changes despite discovering shortcomings as a result of testing.

Christine Hayhurst, director of professional affairs at the CMI, said: "Many organisations are playing Russian Roulette with their greatest assets - their staff and their reputation.

"At best, failure to provide contingency plans for loss of people or individuals with specific skills can lead to unnecessary pressures in the workplace. At worst, it could close businesses and ruin reputations."

Survey results
The research found that only four kinds of disruption - loss of IT (84%), telecommunications (65%), site (64%) and fire (60%), were covered by most business continuity plans.

Other areas, such as business reputation and 'people' were particularly under-protected, according to the research. Despite loss of skills (48%), loss of people, (48%) and negative publicity (46%) being regarded as threats to businesses, such issues were left uncovered by many business continuity plans. Only 28% planned for loss of skills, 37% addressed loss of people and 24% covered negative publicity.

In terms of actual disruption experienced by organisations over the past 12 months, loss of IT was the most frequently reported (25%), followed by loss of telecommunications (23%) and loss of people (20%). Storm or flooding disruption was reported by one in 10 organisations and disruption resulting from fire by one in 20.

The study revealed that when it came to actual rehearsal of business continuity plans, organisations tended to use more limited techniques rather than a "full plan scenario". Desktop audits were most commonplace (49%), followed by 'walk-throughs' (38%) and 'prepared rehearsals' (27%). Just one in 5 of those testing their plans carried out a full plan scenario "involving all partners".

Other findings
One third of business continuity plans had been externally evaluated or 'benchmarked' compared with just over half which had not. As many as 18% said they "didn't know"!

While a quarter (26%) of those with a business continuity plan were aware of the new British Standards Guide to Business Continuity Management (PAS 56), only 7% were currently using it. Also, only 14% of organisations required their 'outsource suppliers' to have a business continuity plan.

Disappointingly, the study revealed that employees, shareholders and customers remained "uninformed" concerning organisations' plans for disaster. Communication of disaster plans has actually decreased since 1999, according to the research.

However, one result, which the CMI said "clearly demonstrates why organisations should implement a plan", showed that the number of respondents whose insurance companies were demanding sight of contingency planning had increased from 12% to 22% since the study first began.

Terminal damage
Commenting on the results of the survey, John Sharp, chief executive of the Business Continuity Institute said: "This is the fifth year that the study has been carried out and we are very concerned that many UK organisations continue to bury their heads in the sand.

"Business continuity management helps to prevent and prepare for disruption to normal business operations, and can save an organisation and its employees if disaster strikes. Without it, organisations can suffer enormous, sometimes terminal, damage.

"If nothing else, we are urgently calling upon UK businesses to do two things - develop a business continuity plan for their organisation and test it at least once a year. Not to do so is playing with fire."

Johnny Thomson