Coronavirus: do you have a business continuity plan?
In this time of health crisis, companies are shocked to see how unprepared they are. The aim of a business continuity management system is to anticipate any disruption in order to minimize the impact. And it’s a voluntary standard that provides the guidelines: ISO 22301. Exceptionally, you can consult it free of charge.
The health crisis facing the planet in the early spring of 2020 has brought two now world-famous acronyms to the fore: COVID-19 and FFP2. The first refers to the famous virus; the second to the type of mask that is supposed to protect us from it. At AFNOR, we’d like to add three other acronyms that are very timely: SMCA, PCA and ISO 22301.
ISO 22301: Business continuity management
An SMCA is a business continuity management system. The BCP is the company’s armed wing: the business continuity plan. These two tools are described in a voluntary international standard: the so-called ISO 22301, the latest version of which dates from November 2019 and which AFNOR offers you to consult free of charge in its online store. Why tell you about it now? Simply because in the business world, it’s important to anticipate a crisis, so you can get through it without too much damage and recover quickly. ” The standard specifies the requirements for implementing, maintaining and improving a management system to protect against, reduce the likelihood of, prepare for, respond to and recover from disruptions,” summarizes Nicolas Scuto, project manager at AFNOR Normalisation, who led the group of professionals who updated the document for France.
Flooding, pandemic, a clumsy backhoe cutting the telecom cable in the street… In business, any disruption, big or small, causes a slowdown or disruption in production, delivery or service provision,” explain Yves Mérian and François Tête, members of the Club de la continuité d’activité and active contributors to the standard on the French side. Ten years ago, we’d wait six months, get compensation from the insurance company and move on. Today, this is no longer possible. Imagine booksellers at a standstill, taking two months to get back into business: in the meantime, the market will be taken over by Amazon and co! “Practical: the Club de la continuité d’activité (Business Continuity Club) provides a guide to setting up an SMCA in accordance with the ISO 22301 Guide standard in a small or medium-sized business. You can also take the training route: AFNOR Compétences has opened a “virtual class” to learn how to set up a business continuity plan (7 hours, €500 excl. VAT).
ISO 22301: assessing risks and defining priorities
In photo, Yves Mérian
Within the company, a pilot must be appointed to deploy, monitor and develop the SMCA. The pilot is often assisted by an external consultant, who helps with the implementation. The SMCA also has a representative on Comex. ” This person must be familiar with the environment in which the company operates, be able to assess risks and have a sense of priorities. It must also have access to all levels of the organization chart, to support functions such as IT, and to external services such as occupational medicine. This is essential for identifying the most exposed jobs and the most vulnerable employees, while respecting medical confidentiality. “Yves Mérian and François Tête.
On this basis, the company is responsible for carrying out a Business Impact Analysis (BIA). This exercise helps to define priorities (which workstation, which piece of equipment, which plant should be shut down first and last?), acceptable downtime (several hours, days, weeks?), and critical staffing levels (what to do without the IT hotline, without the mail service?). Several scenarios follow, which need to be carefully studied: partial interruption, total interruption, relocation, generalized teleworking, etc. And it’s on this basis that the famous PCA, or business continuity plan, defines the (strategic) solutions and (operational) measures to be implemented, depending on the situation: opening hours, telecommuting arrangements, staff rotation, Sunday working, crisis unit management.
ISO 22301: continuous improvement and resilience tool
As you can see, business continuity management is closely linked to crisis management, which is also the subject of a voluntary standard, XP CEN/TS 17091 (August 2019). The crisis unit will select the most appropriate BCP solutions, or even invent new ones, with complete agility. Because, let’s face it: ” In crisis management, we often find that the BCP was not right for the crisis in question. Because no two crises are alike! “Yves Mérian and François Tête, using the example of mask distribution in the current coronavirus crisis. That’s why an SMCA must be designed for continuous improvement: lessons learned during a crisis must be incorporated into the plan, so that the next crisis can be better managed. This is the concept of RETEX: return on experience. ”
In the photo, François Tete
In short, ISO 22301 needs to be at the top of the pile at head office. ” Those who have adopted it have no regrets, and feel better armed,” concludes François Tête, citing his own personal experience: ” I chair a building management committee, and I can tell you that it’s currently helping me to define how to deal with elderly occupants, what to do about cleaning, how to take out the rubbish …”. A crisis always causes damage, but if well managed, it can be minimized.
