It’s a risky business, not having a continuity plan

By Patrick Cunningham, senior resilience consultant, University of Central Lancashire.

Many businesses adopt what used to be considered a robust approach to risk management, which tends to revolve around a company risk register.

Such a register normally includes a description of a risk occurring, a description of the impact a realised risk could have on the company, and what existing controls and mitigation factors are in place to prevent the risks from occurring.

The register is normally owned by a senior person in the company who has responsibility for liaising with colleagues from all areas of the business and for ensuring the register is a dynamic document which is always up to date.

However, despite the many high profile cases of unforeseen circumstances affecting the ability of businesses to recover from disruptions (the latest being the problems at Carillion and the knock-on effect to many businesses of the loss of such a key supplier), it is surprising how many businesses still do not have a business continuity plan in place which is linked to their risk register, and which outlines the recovery measures needed should the risk become reality.

All businesses need to know how to deal with unexpected losses of power, premises, staff, utilities, key customers, key suppliers, and reputation, as well as other disruption scenarios. This is just one of the reasons why the University of Central Lancashire in Preston takes a holistic view of organisational resilience, because any weak link in a company’s preventative and response arrangements is quite simply a risk not worth taking.