In terms of Business Continuity, I think I've seen most scenarios. I've had a Chicago business flooded, a UK factory burnt to the ground, an earthquake in California, I'm just waiting for the plague of locusts!
Often, the businesses I see are not sufficiently prepared to handle a major business outage. Despite having disaster recovery and business continuity plans, they don’t anticipate the events that actually happen, and most of the time they probably couldn’t have. How many businesses anticipated COVID-19? Now, if you're in California, you should probably anticipate an earthquake, but if you are in a rural corner of England you probably don’t expect your factory to burn to the ground.
Businesses that I have seen struggle with business continuity often have plans that were created in response to audit findings, rather than owning and driving the outcomes from the top. These companies have absented themselves from the issue of business continuity by passing the responsibility to the audit committee and technology managers.
Other companies that have not fared well in a business continuity incident are those with a poor approach to risk. Risk Management works really well if you focus on corporate, strategic and customer risks, and poorly if you just create lists of things that might go wrong without considering their impact and likelihood.
Organisations often also have a purely technical disaster recovery plan. Yes, you need systems’ resilience, but that's only one component of business continuity. Their plans do not consider the big picture. For example, what if our team couldn't access our customers? Or our products couldn't be made? Or our service couldn't be delivered?
Companies that do well tend to be those that are fundamentally well-run businesses. They have a bias for action and delivery. They come together really quickly and focus on the right things. Rather than regarding the time pressure of a business incident as a constraint, they harness it into laser focus to resolve the situation.
The other organisations that thrive are those that have already built redundancy into their processes. A good example would be Japanese car manufacturers that operate in a just in time manner, particularly their use of dual-sourced components. For example, they would buy left-hand wing mirrors from one company, and right-hand wing mirrors from another. If the first supplier had problems, they could get the second company to help out. It’s not about duplication, it’s about appropriate redundancy.