Fundamental to this is a Business Continuity Plan (BCP) (which includes a Disaster Recovery Plan). At its core, it is a guiding (but not exhaustive) document that provides management with a framework to manage through a business interruption in whatever form it takes. The ultimate aim is to provide an effective management ‘tool’ to allow management to minimise the impact of any disruption to the business, its customers and its employees.

Having a long background in APRA-regulated funds management and superannuation, the Partners at Cameron Harrison have significant expertise and experience in business continuity planning and helping business owners. It is fundamental to how we conduct Cameron Harrison.

At a minimum, the plan should be based on the below pillars:

1. Critical issues

2. Impact

3. Recovery strategy

4. Action plan

A business continuity plan can contemplate nebulous and unknown scenarios as well as those that can be reasonably foreseen. The key objective that is often overlooked is that not all scenarios can be planned out. The point is to provide management with the ‘tools’ to plan through an event which impacts business continuity.

Some events are more obvious, such as:

• Natural disasters (fire, flood, cyclone)

• Loss of key personnel (death, permanent incapacity, significant illness)

• Cyber-attack

• Internal or external fraud

Internal processes and procedures should safeguard a business to the greatest extent possible; risk prevention and mitigation are the first line of defence but cannot be the only line. Predictable business disruptions can be somewhat planned for and the response pre-meditated.

Other rarer and unpredictable events cannot be reasonably planned for. These are ‘black swan’ events. Yet a framework to address unknown events can at least provide guidance and management ‘tools’ on a financial, legal, media or emergency response.

A short-term disruption can likely be covered internally unless there is a specific skill or service that is lost. Long-term disruptions require further planning and resources. We look at this from the perspective of Urgent (<30 days), Temporary (30-90 days) and Permanent (90+ days) timeframes; the response extends and adjusts accordingly.

Consider the loss of a key person in a business. The solution to the loss of key personnel will be dealt with differently as the issue moves from ‘get it done’ to ‘keep it running’ to ‘new resource required’.

The Covid-19 pandemic has been the broadest test of business continuity practices in recent times. Businesses capabilities across many functions was tested: access to premises, flow of communication, media response and strategy, logistics and supply chain, and flexible IT systems. A well-thought out business continuity plan should broadly consider these issues.

What actions cannot be executed offsite and what is the contingency plan?
How often and in what method are key stakeholders communicated to?
Who is responsible for engaging with media agencies?
How do IT systems operate securely in a remote environment?

Those business that dealt with these issues best were those that were able to best serve their customers/clients and look after their employees. Importantly, a business continuity plan focuses on the management process over the various time periods and is differentiated from a strategy plan.

A business continuity plan is not an exhaustive manual designed to address endless scenarios, it is a management blueprint on larger topics including people, logistics, premises and IT systems, amongst others. By documenting the primary strategies to address each critical resource, subsequent management teams can benefit and, notably, will mean that the knowledge does not leave with those key personnel (a business continuity risk in itself).

If you would like to discuss our business continuity and other specialist advice solutions for business owners, please contact us on +613 9655 5000 or here.