What will you do when disaster strikes?

Our financial centres stand as iconic symbols of national prosperity – but if disaster were to strike and our worst case scenarios suddenly became reality, would we cope? FST’s Julian Rogers investigates.

The world is on alert. New threats and dangers are emerging all the time and businesses need to be able to react to whatever is thrown at them. Senior executives have realised the urgent need to put in place plans to cope with any costly disruptions should disaster strike. This is especially true in the financial sector, where world economies are particularly vulnerable to any potential disaster. This last year alone has seen devastating hurricanes, earthquakes and acts of terrorism – while the threat of an avian flu pandemic looms large. Disaster and continuity management has never been so critical in mitigating these risks.

The banks know only too well that any hampering of their operations could have a serious knock-on effect on the bank’s market position, share value and reputation. Institutions also cannot afford to see public trust eroded.

Lyndon Bird, Technical Services Director of the UK-based Business Continuity Institute (BCI), explains: “A badly managed incident not only directly loses trading income but also long-term market share. A lot of research evidence has shown a significant negative effect on share price, which in the long-term can lead to loss of business and market share, exceptionally poor image and public perception, and a loss in confidence from customers and staff.”

Business continuity management emerges
The events on 9/11 demonstrated just how vulnerable the global financial hubs are to major disruptions. New York was left crippled in the wake of the terrorist attacks, as financial firms scrambled to get operations back up and running. “9/11 was the main changing point at which top management realised almost any scenario was possible and that simple IT recovery plans were inadequate,” explains Bird. “With respect to threats, the concentration of all major financial trading houses and investment banks around one area, such as Canary Wharf and Wall Street, gives a very concentrated ‘target area’ for deliberate attack. The financial sectors’ liking for tall, glamorous, high profile buildings is an additional risk. Furthermore, when there is a wide area problem like 9/11 many companies will be calling on recovery sites concurrently and therefore might not get the occupancy they expect.” Bird continues: “The financial sector is the best prepared business sector, but they have concentrated most efforts on technology recovery (IT and telecoms) rather than on holistic business continuity management (BCM). I believe they could improve significantly in their crisis management and HR continuity planning.”

In the last few years, BCM has emerged as a serious component in a company’s armoury. Once relegated to the responsibilities of the IT department, BCM has now entered the boardroom and firms have specialist professionals and consultants to help with their planning.

Companies dedicated to business continuity have also appeared on the market to help firms in their hour of need. If, for example, the stricken firm is unable to operate because of a fire, operations can be moved elsewhere with minimum disruption. The continuity company can offer recovery centres, kitted out with workstations, networked computers, servers, broadband internet access and everything else needed to keep an organisation on the rails.

David Evans, Managing Director of business continuity provider Link Associates, says financial firms in particular have to be on their guard for threats around the world. “Financial institutions are more prone to disruption on the global scale. Global markets also don’t tend to have time on their side, which can be seen with the pressure for very fast recovery of data and systems. So they become a high profile target both for terrorism and security issues. They also become vulnerable in communication areas.”

Evans suggests that by ignoring business continuity and disaster planning, companies are throwing money down the drain in the long-term. “If you have very good management principles and processes in place and you have good people working on this, then eventually they will manage their way out of a problem. If you don’t put the resources into disaster recovery and business continuity, then what you get is a much, much slower response to the problems. That means, in effect, the company absorbs a much higher cost and loses a lot of its market share, as well as the confidence of its clients. The dangers are therefore quite high.” Furthermore, if plans are not in place, the disruptions can play into the hands of the competition, says Evans. “It creates great opportunities for competitors. If you are in a competitive market and everyone suffers a disruption, such as an infrastructure problem, if you respond quickly then you tend to gain market share. At best, it knocks a company a little bit, at worst it threatens its survival.”

In the UK, the Bank of England, the Financial Services Authority (FSA) and HM Treasury form the Tripartite Standing Committee that considers matters of financial stability. The committee recently carried out a survey of leading firms in the financial sector and found that most were ready to deal with the potential threats. Stephen Collins, Head of the Business Continuity Division at the Bank of England, believes the financial sector has good disaster recovery and continuity plans in place. “I am optimistic that the major players in the financial system take their business continuity planning responsibility very seriously and will continue to refine their arrangements so as to maintain and increase their already high level of resilience. There are very good cooperative mechanisms in place to facilitate these activities, both within the private sector and between the public and private sectors.” He continues: “There are also encouraging signs that smaller companies are recognising the need for appropriate continuity plans. An important current challenge is to ensure that those institutions that are not systemically important, but which nonetheless provide important services to their customers, also have business continuity plans of appropriate quality.”

Future threats
The one threat most on the minds of business leaders in Europe in a potential flu pandemic. If the virus were to mutate and spread between humans, the financial impact could be enormous, and firms would face the prospect of losing large chunks of staff through illness. “As we become more aware of pandemic flu, we are able to assess the risk and look at the response to that type of event,” says Evans. “The threat has always been there. However, the nature of the current virus and the timing since the last pandemic suggests that we are due another incident, so we have to prepare for those risks. Whether it is this year’s highest risk, I don’t know.”

Collins agrees: “The Tripartite Authorities have established a financial sector discussion group and have issued a questionnaire, in order to assist in drawing up sector-wide advice. It behoves all financial institutions to consider their own circumstances and to draw up plans to cope with unusually large staff absences over a prolonged period, especially as their current business continuity plans may be more focused on disruption to buildings, access and equipment than on absence of staff.”

The experts agree that if sufficient plans are not in place, a disruptive situation can snowball and even threaten a company’s survival. According to the London Chamber of Commerce and Industry, 90 percent of businesses that lose data from a disaster are forced to shut within two years. Figures show that 58 percent of UK organisations were disrupted by 9/11 – one in eight was seriously affected. In addition, a recent report estimates that for half of financial directors it would take a minimum of 12 months for their businesses to recover in the event of disaster. Almost a third didn’t believe that they would survive if their paper documents were destroyed. Collins adds: “In the short term, without adequate business continuity planning, businesses of any sort can be disrupted by loss of infrastructure such as buildings and equipment, access problems, staff absence and loss of data. In the longer term, it is no exaggeration to say that the survival of businesses may be put at risk if provision has not been made for alternative locations or means of conducting business in the event of a major disruption. Aside from the handling of direct physical effects, good crisis management, including media management, can have a major effect on share price, and hence future viability.”

Assessing the risks
In some cases, BCM planning can seem wasted. For example, huge amounts of work and money went into preventing possible computer meltdown as a result of the Millennium Bug. “One of the dangers is that we put in a lot of work in and it doesn’t happen,” explains Evans. “Just look at the work that went into the Millennium Bug. At the end of the day, two arguments spring from this – firstly, that too much work was done because in hindsight nothing happened so it wasn’t a real threat. On the other hand, you could say it didn’t happen because of all the hard work that was done to prevent it.”

Some events, such as terrorist attacks, can have a heavy impact on both financial institutions and the stock market. The atrocities of 9/11 struck, quite literally, at the financial heart of the US. Last year’s London bombings, however, struck the underground network, but the effects still reverberated throughout business in the City. “The attack on the London transport system on 7 July last year, although not primarily targeted at the financial sector, had several knock-on effects in the City of London and for the people who work there,” says Collins. “Of course, the events of 9/11 remain vivid in the memory. The cumulative effect of these events has undoubtedly been to increase the priority accorded to business continuity planning throughout the financial sector, causing managements to rethink the appropriate arrangement of back-up sites, IT resilience, staff dispositions, and so on.”

When major incidents occur around the world they grab both headlines and the attention of the financial institutions. However, according to Evans, this can have a positive effect and can help institutions plan for the future by making sure systems are in place. “I think they act as a focal point and it raises the profile of risk management and business continuity. You know your executives are seeing the same newspaper articles, people are talking about it, so business continuity people will use that as a springboard to raise the profile and educate people about the systems in place. It has the potential to strengthen a lot of disaster management cases.”

The largely unpredictable nature of disasters will continue to keep institutions on their toes. As Evans adds: “It doesn’t really matter what the risk is – whether terrorism, loss of infrastructure, power shortages, gas price hikes, market collapses or HR issues – it is the portfolio of these that disaster recovery and business continuity has to deal with. These high profile events can be used to test a company’s thinking in different areas and simulate its capability.”