When disaster strikes...at work

Business continuity became a hot topic after the London City bombings. Despite this rude awakening, while many talked about business continuity, not everyone acted.

A market survey undertaken by Deloitte & Touche in the UK in 2001 established 28% of those surveyed did not have a business continuity plan (BCP). Of those who had one, 37% had never tested it. Business continuity teams were mainly drawn from available internal resources, with little external consultation. The survey highlighted considerable gaps in the business interruption covers of those surveyed, a worrying find as most major disasters that would trigger the BCP would also cause large business interruption losses.

The survey was undertaken before 11 September. Since then the risk management world evolved, with further emerging risks such as bio-chemical contamination and global diseases escalating the degree of destruction and danger. The unthinkable now has to be considered possible, if not probable. There were many lessons to be learned from 11 September, but have they all been applied to BCPs?

Typically, continuity planning tended to concentrate on physical risk issues and replacement of damaged property. Now the safety and welfare of employees has become a major issue. Following 11 September, management were unable to locate employees quickly, even though many were uninjured. Employees were scared, stressed and insecure about their employers' disaster management plans. In many cases company databases were incomplete, inaccurate, or could not be accessed. Data must be kept up to date and made easily available. Business continuity must cater not just for extensive physical damage, but also trauma and loss of life.

An area often not considered is transportation. The effect of a crisis on transportation can be exceptional, paralysing critical business. Even if a company has a hot recovery site, this will be useless if it cannot be reached.

Transportation can also be affected by the fear of an event. The outbreak of SARS in China and its subsequent spread is an example. People may refuse to travel to an affected area, or insurance covers may be invalidated if they do. Locations may be isolated, with airlines cancelling flights. Global companies with operations in many countries must consider these issues.

While traditional risks tend to be confined to a single location, emerging risks can affect multiple locations across a country. The triggering of a large dirty bomb could contaminate many hundreds of miles downwind. An event now can take out a company's primary and back-up sites. Communication issues now go well beyond the loss of an internal telephone system. A large-scale incident would result in extensive media coverage. This can quickly lead to those systems becoming overloaded to the point of collapse.

The greater geographical spread of an event also means a company's suppliers and service providers can be seriously affected. It is not enough for a business to have its own BCP in place. It must vet carefully the continuity procedures of trading partners, and supply and service contracts now need to include business continuity requirements.

We are still learning about some emerging risks. The effectiveness of decontamination on bio-chemical contamination is uncertain. This raises questions on safety risks. Human reaction is also coming into the equation. A building that is contaminated by anthrax may undergo extensive decontamination and be passed as contaminant-free. But it may be extremely difficult to persuade personnel to re-enter and work in that building.

It is a sad fact of life that we live in an increasingly dangerous world. Businesses have to face the reality of these new emerging risks. Having done so, they must continue to review the position and update procedures as circumstances dictate, testing those that are in place.

Angus Tucker is business insurance consulting director, Deloitte and Touch