Business continuity management is good governance
Good corporate governance is now mandated by law through the Companies Act. Compliance with the King Code of Governance (King III) has also become a requirement for listing on the Johannesburg Stock Exchange. Corporate leaders now recognise it as a prerequisite for good management and long-term sustainability of their companies. Less widely recognised is the link between good governance and business continuity management.
"Corporate governance aims to put in place the mechanisms necessary to ensure a company is sustainable, in every sense. Business continuity management has an important role to play in achieving this goal, because it identifies threats and provides a framework for responding to them," says David Bollaert, senior advisor, Business Continuity Management at ContinuitySA.
The bitter truth is that controls don't always work to protect organisations against all threats. When a catastrophe occurs, business continuity management provides the safety net that aids recovery. Bollaert cites research by Rory Knight and Deborah Pretty showing that companies with a recovery plan were able to respond better to a crisis, and were ultimately able to increase their value relative to unprepared companies by 22% by the 225th trading day. Other research indicates that 25% of those companies that are hit by a disaster simply never recover at all.[1]
It's also worth noting that the sustainability trends and risks faced by companies over the coming decades are growing in complexity and impact. Among them we should list climate change and associated extreme weather; scarcity of energy, water and materials; increased populations; wealth disparity; increased consumer demands; food security; and massive urbanisation. Other risks include increased global outsourcing, supply chain complexity, reliance on third parties and ICT to operate, and a client base that is more aware and demanding of demonstrated resilience capabilities.
Perhaps unsurprisingly, the average Global 1 000 company gives itself a 40% chance of suffering a catastrophe that would destroy more than 30% of its market value over any five-year period.[2] "And yet, most firms are not adequately prepared for disaster. However, those that are prepared are far more likely to survive - and may even be able to take advantage of opportunities that might arise during a crisis," comments Bollaert. "For that reason, the question of business resilience has entered law, through the Companies Act, codes like King III, and regulations like PASA. However, many of these place too great an emphasis on IT and not enough on the bigger business continuity picture."
Given the key role that business continuity management can play in creating resilient companies, its own governance is vital. Released in May 2012, ISO22301 is the global standard for business continuity management, and provides a clear framework for the policy and programme management, ongoing monitoring and reporting, and also the routine governance tasks that are needed.
Bollaert adds that business continuity management can also help companies realise the benefits of sustainability. As companies reshape the way they do business in order to take into account the need to be sustainable, new opportunities for revenue growth from environmentally-friendly products and new markets open up. At the same time, the pressure to drive resource and operational efficiencies can help to reduce costs, and improved transparency in identifying and mitigating risk will enhance a company's ability to survive and prosper.
"Sustainability and business continuity management are closely interrelated," he says. "If they are seen as potential profit centres, and levers of competitive advantage, then they are likely to obtain greater support from the board - and to be able to present a better account of its strength to investors and other stakeholders in its integrated report."
[1] JP Morgan Chase & Co, "Disaster preparedness planning: Maintaining business continuity during crisis, disruption and recovery", Perspective (2009), available at https://www.chase.com/online/commercial-bank/document/Perspective_DisasterPreparedness.pdf, p 2.
[2] Intercep, "The business case for preparedness", available at http://www.nyu.edu/intercep/research/pubs/annotated-business-case_20-aug-2007.pdf, p 3.