Until now, many firms are unlikely to have included continuity plans to take account of a worldwide virus that would lead to a near-complete lockdown of the UK economy; some firms will not have had any plans in place to cope with any form of business interruption!
Although we are still in the early stages of learning lessons from the Covid-19 crisis, you should be reviewing your BCP, or creating one if you don’t already have one, to ensure that, as far as reasonably possible, it is fit for purpose in the future.
So, what should your BCP review be looking at?
Events your BCP should now cover
Historically BCPs will have covered events such as fire, flood, terrorism, IT system failures, etc., but they now need to cover events such as viruses, cyber-attacks, war, adverse weather, etc.
Consequences arising from events
Your BCP will need to address the consequences from an event, for example:
- Fire – your offices and contents (client files, IT equipment, etc) may be partially or completely destroyed or water-damaged
- Flood – your offices and contents may be partially or completely water-damaged or you may not be able to access buildings for some time
- Terrorism – your offices may not be damaged but maybe inside an exclusion zone where access is denied for a period of time; it may be that an attack adversely affects a key client, which then leads to you being instructed for a prolonged period
- IT system failures – your IT systems may be affected by a cyber-attack or impacted on by an interruption of external power supplies
- Viruses – as Covid-19 has shown, your firm may be affected by a nationwide lockdown, severe economic and market conditions, and the effects of action taken by other countries (travel bans, lockdowns, transport restrictions, etc.)
- War – recent history has shown how a conflict in another part of the world can have an impact on our economy (oil prices, share prices, sanctions, etc.), and although you may not see these as having a direct impact on your firm they could, for example, a conflict in the Middle East could have an impact on oil prices, which then has an impact on share prices, which in turn has an impact on the confidence in the UK property market, which in turn leads to a crash or significant downturn in the property market.
Working through an event
Assessing the continuity risks your firm could face is a major part of preparing your BCP, but so is putting in place plans for getting back to normal as quickly as possible; these plans should cover areas such as:
- Key stages of the BCP
- Major issues to be addressed during and immediately after an event
- Problems that could adversely affect the implementation of the BCP
- Key staff
- Key tasks
- BCP checklists
- Testing.
Risks to your BCP
Past events have shown some of the weaknesses of BCPs and therefore you will need to take account of these, for example, during the London bombings firms were unable to use mobile phones to contact people due to the mobile networks being restricted for use by the emergency services.
With most people now restricted to their homes and using the internet for business and social purposes we could see the government restricting its use; how would your firm be able to operate if all, but emergency use was stopped?
Some aspects of your BCP may rely on you recouping losses from your insurance policies, however, this may not be possible and will be very much dependant on your policy wording, for example, Covid-19 has only recently been declared a notifiable disease, which means losses from it may be payable. You should now check your insurance policy to see what it does in fact cover and that it will be suitable for the events covered in your updated BCP.
The future
The current crisis will come to an end at some point, but we need to ensure we learn lessons from it and ensure we are prepared for the next one.
The Covid-19 crisis and its severe impact has taken most businesses by complete surprise, and although the SRA has said it will take a pragmatic approach to enforcement as a consequence, it has also said that firms should have had effective business continuity plans in place to cope with such events; it is unlikely that such a pragmatic approach will be taken with firms should a future event take place and they have not learned appropriate lessons!
We are here to help you through this tough period by providing a number of products/services that can be used remotely:
- Compliance helpline
- Free regulatory and compliance webinars
- Risk and compliance management system
- E-learning training library
- Learning management system (LMS)
- Policies & procedures bank
- Risk & compliance advisory services.
For more information on any of these services, please download our brochure and contact us for more details.