Planning for business continuity includes identifying real risks and evaluating their impact on business activities and objectives. The risks to be included are the ones that could reasonably be held to apply to an organisation. Of course, each entity needs to make its own list, because many risks are situation-specific. For example, an enterprise in the middle of the desert is unlikely to include the risk of a plane crashing on its premises. On the other hand, for a company located next to an airport, the risk is more relevant. But what part should large-scale political or environmental shocks play in business continuity planning?
A completely ‘self-contained’ business may remain unaffected by national revolutions or continental flooding. Take that enterprise in the middle of the desert, producing fine cactus juice for example. As long as the market for cactus juice holds up, the firm may be unexposed to the effects of large-scale shocks elsewhere. However, the moment that the cactus juice company decides to outsource functions such as IT, accounting, logistics and customer service, things start to change. Now business continuity planning weaknesses in its suppliers, who may also be geographically distant, can also disrupt operations for the cactus juice company.
To get a measure of the problem, consultancy company PwC surveyed companies to find out how prepared they were to deal with upheavals and disasters on a global scale. 33% of survey respondents said the business continuity planning took no account of potential shortages of natural resources. 35% said they had made no preparation in case of political problems or war.
With so many businesses interlinked today, that’s a lot of potential risk that remains unmitigated and unmanaged. Enterprises need to follow each chain of supply back to its source, and each distribution path to its final destination to truly measure the associated risks. It’s rather like the chaos theory example of the butterfly on one side of the world triggering a storm on the other side. Companies should make sure they identify all such ‘butterflies’ that could affect them.