1. Obtain commitment and identify risk appetite
“Most plans fail to take hold within a business due to a lack of senior management buy-in,” Mr Harb, Director at InConsult, a professional services firm specialising in risk management and business continuity, explained. “When it comes to a Business Continuity Plan, it’s crucial to get the agency’s key decision makers on board from the start because they’ll be the key players who’ll ultimately provide leadership in a time of crisis.”
Mr Harb advises starting the Business Continuity Plan process with a workshop with the agency’s leadership team.
“Prepare by researching any existing plans, their effectiveness, cost and resources required,” he said. “This will highlight any gaps. The workshop should also be used to understand and formulate risk appetite. How quickly does management believe that the agency’s clients and stakeholders will want key services to resume following a disruption?”
A risk appetite statement provides a directive to management and staff about organisation tolerance during an outage.
“Quicker response times generally come at a cost, so the agency needs to understand the costs and benefits of its desired tolerance to any disruption,” Mr Harb said.
2. Carry out a risk assessment
When it comes to identifying and assessing risks, some are more obvious than others. Think of an iceberg. There are risks that are easily identifiable – the ones that lie above the water line. You can see them coming. But, as we all know, what lies above the waterline is just the tip of the iceberg. Beneath the surface lies an absolute plethora of other risks that need to be considered. If they’re not, just like an iceberg, they have the potential to sink your agency.
So what sort of risks are we talking about? All of them! Big. Small. Pretty much anything and everything you can think of.
“A detailed risk assessment across the agency and its functions will highlight existing areas of weakness and identify plausible disruption scenarios,” Mr Harb said. “Every business is different and will inevitably be faced with different risks, however most business disruptions can be classified into four general areas.”
These areas are:
• Natural disasters, such as fires, floods and storms resulting in damage to the office or building
• Property and equipment related problems, such as damage, theft or vandalism
• Employee incidents, including theft or fraud by staff and the loss of key team members
• Cyber attacks or incidents, resulting in the loss of data or compromising access to IT resources
“Life can be unpredictable and you never know what may be around the corner. A business disruption may come from any one or multiple of these scenarios,” Mr Harb said.
3. Conduct a Business Impact Analysis
Armed with your list of potential risks, you can now conduct a business impact analysis.
“This is possibly the most important step in the overall Business Continuity Plan process,” Mr Harb said. “The analysis should capture operational impacts, financial exposure, technological reliance and resource requirements across key business areas during a disruption.”
According to Mr Harb, the business impact analysis should identify any operations that are time sensitive and the time frames by which these operations need to be fully serviceable.
“You also need to identify any contingency resources and plans. Business units often have manual contingencies built into their day-to-day operations to handle minor service outages. In some cases, these manual contingencies can be stretched to form an alternative business process should the need arise.”
By critically thinking about each risk in this way, you’ll soon develop a clearer picture about which of the risks pose the most serious threats.
4. Develop the plan
“The business impact analysis forms the basis of the overall Business Continuity Plan,” Mr Harb explained. “A robust Business Continuity Plan should include the agency’s plan and response in four stages.”
These four stages are:
1. Emergency response procedures: The main focus at this stage is to ensure the safety of all staff and the security of the agency’s assets. This step is usually a ‘first five5 minutes’ approach and no business directive is required.
2. Crisis management response: This stage involves the first critical decisions about what the crisis is and what the agency’s response should be. The Business Continuity Plan should identify a crisis management team (including key decision makers), the responsibilities of team members and the process and criteria for conducting and impact analysis.
3. Business recovery: This stage outlines the procedures and activities necessary to restore critical functionality and services. These may not be restored to pre-crisis levels and may involve skeletal or contingency resources and procedures. Alternative operational sites and key business resources should be identified.
4. Business resumption: This stage involves returning the business to a pre-crisis operational level. The Business Continuity Plan shouldn’t be too prescriptive here, as the road to resumption will be dependent on the nature of the crisis and a range of other variables. Rather, this section should contain a broad outline of responsibilities and key processes.
“Once the Business Continuity Plan has been signed off, it needs to be distributed to staff and backup copies should be stored in an accessible location,” Mr Harb advised. “Importantly, the plan should be viewed as a live document that’s reviewed, updated and improved over time.”
5. Implementation and training
“Staff need to be trained so they are aware of the Business Continuity Plan, what their roles and repsonsibilities are and who to contact should the need arise,” Mr Harb said. “Training will help to build staff capability and confidence to enable a smooth transition from crisis mode to business recovery and, ultimately, to the business resumption phase.”
6. Testing and exercising
Just as we do fire drills to ensure staff are trained and processes are working if a fire breaks out, the same applies to your Business Continuity Plan.
“Regular testing and exercising of the plan is critical to success,” Mr Harb said. “Your team is more likely to respond well to a crisis if they’ve practised what to do in advance.
“I strongly recommend at least annual testing, which can also help to identify gaps and weaknesses in processes, steps and resources.”
In an uncertain world where risks are ever changing, having a Business Continuity Plan in place is essential for every real estate agency. While it won’t necessarily prevent risks, it will help you minimise the damage caused. Just think – it could be a lot worse. If you don’t have a Business Continuity Plan in place, the damage you suffer could be far more significant and your ability to handle that damage could be severely impacted.
So don’t get caught out. Start thinking about your Business Continuity Plan today.
| |
|
|
| |
“When it comes to a Business Continuity Plan, it’s crucial to get the agency’s key decision makers on board from the start because they’ll be the key players who’ll ultimately provide leadership in a time of crisis.”
|
|
| |
|
|