Crisis… What Crisis?

In the world of Risk Management, “you are as successful as the event that does not take place”. Or at least the one that has a very little amount of impact on your organization.

Avoiding the negative impact, let alone the financial burden brought on by a crisis, is not an easy task. It takes a certain skill that is difficult to come by – the skill of predicting the future!

And since not every one of us can do that, we have to fall back on the next best thing – business continuity planning.

Whether you are a global retailer with a healthy cash flow, or an independent retailer struggling to make ends meet, there is something in BCP (business continuity planning) process that is right for you.

First things first though, we have to deconstruct the methodology used in business continuity planning. This will provide you with a menu list of items to pick from, depending on your risk appetite, and the resources you have at your disposal.

In April 2018, retailers attended a workshop where participants were presented with each component. The attached flow chart is a good visual reference to use.

Let’s look at this structure and then consider some examples.

Evaluating your risk appetite

Risk: A risk is something to consider, but not an absolute. It is by nature the possibility of a negative outcome just based on the activity. A race-car driver, for example, has a risk of being in a high-speed accident, but that does not mean it will happen, but it can.

Threat: A threat is something more significant than a risk, it is likely to happen because the negative outcome is observable and predictable. You must counter a threat in order to eliminate it because doing nothing might cost you some pain.

Probability/likelihood: If you ask 10 different people within your organization what the probability of an event having a detrimental effect on your business is, you will probably get 10 different responses on a scale of 1-10

Severity/impact: How much will a negative event cost you if it happens? Will it take too long to recover? A Business Impact Assessment (BIA), and determination of Time to Recover (TTR) is critical when conducting a risk assessment.

The Critical Steps of BCP

Planning

Taking all risks into consideration from the above exercise, you should categorize and prioritize the response on paper. Start to asign responsibilities.

Preparedness

Documenting the plan is not enough. Being prepared takes some work on your part. For example, it is not enough to state that in the event of a power failure, the business will secure a generator. You should negotiate the contract on the front side, to avoid having to do so in the dark at 3:00 a.m. on a hot summer day when your business has refrigerators holding your precious inventory (if you sell food).

Being prepared also requires knowing what to do in the event of a crisis. This is established when the roles and responsibility are defined and clearly documented in the planning stage. A periodic “tabletop exercise” to test (like fire drills, but sitting at a round table and having people talk about what next steps would be when the facilitator presents a hypothetical scenario) reinforces critical understanding.

Response

If planning is executed correctly, and all respondents are prepared, the response should be seamless and mechanical in nature. Just follow the steps.

But it is not always that simple and therefore a team needs to manage the event and response.

The response team on the ground that manages the tactical components of the response is typically referred to as the incident response team, and they can be field management if your business has multiple locations.

The more strategic decisions for events of a more significant nature is typically referred to as the crisis management team. This team also has a go-to person for media relations, to make sure the message is what the business intends to convey.

Think back to these 2 events; (1) the oil rig disaster in the Gulf of Mexico, and (2) the listeria issue at a meat processing facility in Toronto. One spokesperson came across as inconvenienced and wanted “his life back”, the second took full responsibility, said he would resolve the issue, and apologized openly and honestly. The difference – one knew what to say, the other talked off the cuff.

Recovery

Many companies are so exhausted after responding to a crisis that they neglect the recovery stage. This is human nature, we all want to get back out there when we are slowed down by injury or distractions.

The C – Suite does not always see the value of proper recovery, but it is cost-effective if done properly. Sometimes a band-aid approach just isn’t enough.

Process Improvement

Call it what you will, but there should always be a formal review of the event from start to finish for 2 reasons; (1) to correct any situation that led to the event, and (2) to correct how the organization responds to events.

So like the “wash, rinse, repeat” saying goes, once you have done all of this, revise the plan and start all over.

Planning

Business Continuity plans are a cyclical set of processes that should not be placed on a shelf. They live and breath and change as appropriate. Building the BCP into the foundation of the company is the difference between continuing with business in the face of crisis, or not.

Data Source: Bottom Line Matters

Here are some examples to reinforce what was covered

If you are a large retailer, with little appetitive you might…

Invest in a full-blown system that includes dedicated management oversight. The head of this initiative might want to introduce BCP in every function and strategic plan.

If you are a small retailer with little appetite you might…

Negotiate a contract or third-party service on the front side for a consultant to manage this process for. This would involve a service fee or retainer but would ensure response becomes seamless through a sort of fractional ownership of an expert.

If you are a large retailer with a huge appetite you might…

Pick and chose some of the steps, and build the methodology into exiting functions.

If you are a large retailer with a huge appetite you might…

Do nothing

and if you are like most you will…

Respond to every event as if it was a new crisis that never occurred to any business in the past, and therefore cannot be learned from.

Remember, you are as successful as the event that does not take place!

Hello, I'm Stephen O'Keefe. The information you read here is intended to help businesses answer some of the tough questions about everyday events in the retail environment. After spending over 3 decades in this industry we've seen a lot!

Join Bottom Line Matters Today