1

How global crisis has helped shaped Business continuity planning in UK

Organization

BY

ADELAKUN OLUWAFEMI. A MBA

University of Wales April 2011

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

2

Executive Summary

Business continuity management in recent times has begun to gain more relevance in the UK

after the tragedy events of September 11 and July 7 bombings in London. Current trends are to

transfer the primary ownership of the BCP to corporate or general management and to integrate

business continuity and IT security planning.

This paper identifies the impact of crisis on business continuity and focus on how global crisis

such as September 11 and July 7 bombings has helped shaped business continuity planning in

UK organizations.

Information for this analysis was obtained from journals, articles and business continuity

proceedings. However, obtaining information for this research was challenging as most

organizations business continuity plan was not publicly available.

This paper has been able to identify gaps with business continuity plan and business continuity

practices amongst business organization.

Based on findings, this paper concluded firms must periodically re-evaluate the

comprehensiveness of their business continuity strategy to avoid catastrophic consequences from

a wide variety of serious internal and external threats, including increasing information security

threats.

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

3

Table of content

ContentsTable of content.......................................................................................................................................1

1.0 Introduction.................................................................................................................................4

2.0 Impact of global crisis on Organizations and Economy...............................................................5

3.0 How Global Crisis has helped shaped UK organizations.............................................................7

3.1 Changes with data back-up centers..............................................................................................7

3.2 Changes with human resource management................................................................................9

3.3 Changes with Testing of Business Continuity Plan (BCP).........................................................10

3.4 Communication.........................................................................................................................11

3.4 Developing scenarios.................................................................................................................12

4.0 Conclusion.................................................................................................................................14

References.............................................................................................................................................15

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

4

1.0 Introduction

All organizations from all sectors (public, private and not-for-profit) face the possibility of

disruptive events that have impacts ranging from mere inconvenience and short-lived disruption

of normal operations to the very destruction of the organization. Organizations are face with a

variety of threats and vulnerabilities and these continue to evolve. Business disruptions can

include natural disasters such as flood, tsunami (recent in Japan), fire outbreaks, oil spillage

(BP), hurricanes, power outages and system failure. Since 9/11 in the US and the 7/7 bombings

in London, the threats of man-made disasters such as terrorist attacks has taken a sense of

urgency as well. The reality of business is that increasing and dynamic natural, technological and

human induced threats, business complexity, government regulation, corporate governance

requirements, media and public scrutiny demand a comprehensive and integrated approach to

BCP.

Business continuity planning addresses the prospect that a disaster might interrupt organizations

business operations. Irrespective of sector an organization operates, the need to mitigate disaster

risk has become especially salient. This places an increasing importance of the need for all

organizations to conduct an effective business impact analysis as this will help management to

understand the criticality of different business functions, recovery time required and the need for

various resources (Dominic, Brahim and Ethne, 2001). Prior to 9/11, Business continuity

planning remains largely a supporting project or program that is discretionary except in highly

regulated industries such as healthcare and banking where BCP related requirements and

standards have been established.

Reoccurring barriers to effective implementation of BCP has been lack of top management

participation and involvement as BCP constitute a non revenue procuring area for companies.

Organizations shed expenses often slashing funding for BCP initiatives with a view to improving

their bottom line. This outlook is shortsighted as disaster cannot be timed or predicted.

Organizations that downsize BCP to improve immediate bottom line are abdicating their long

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

5

term fiduciary responsibility. This ‘it can’t happen to us” thinking too often leads to disastrous

results (Raymond, 2002).

2.0 Impact of global crisis on Organizations and EconomyCrisis such as the September 11, 7/7 bombings, the tsunami and earthquake in Japan (2011) has

both direct and indirect impact on lives, businesses, property and the economy as a whole.

Usually crisis has larger impact on the macro economy and psychological impacts on most

people.

The tragic event of September 11, 2001 claimed about 3000 lives and left many injured (fox

news, 2010). Many organizations lost their key staff, information databases and intellectual

resources. Important and business data were lost and this affected may business which did not

have back ups or back ups were on site of the attack. The event caused the New York stock

market’s closure for about 6 days which impacted negatively on share prices and a resultant

effect on the city’s GDP which was estimated to have declined by $27.3 billion for the last three

months of 2001 and all of 2002 (Dune, 2005). The Dow Jones industrial average stock market

index fell 684 points to 8921 while the US stock lost $1.4 trillion for the week as the markets

faced decline (Barnhart, 2001). The 9/11 impacted on many jobs as the economy experience an

extensive mass layoffs which displaced nearly 13000 employees and in New York City and $2.8

billion in wages were lost in the three months following the 9/11 attacks (Makinnen, 2002).

Makinen (2002) in his paper ,The economic effect of 9/11: A retrospective assessment, reported

that the September 11 attack was followed by a massive loss in the tourism sector of the US

economy as reports shows that in the week following the attack, hotel occupancy fell below 40%

and 3000 employees were laid off. In general, the attack had an exponential effect on the U.S

unemployment rate.

For London, 7/7 bombings was the biggest attack in the UK since 1998 as reported by Professor

Michael Clarke, a terrorism expert (David, 2005). The tragedy events claimed about 56 lives and

left many injured. The bombings caused a day-long disruption of London’s transport and mobile

telecommunications infrastructure.  For most of the day, London was shut down to visitors (

Karin Brothers, 2008). The value of the British pound decreased 0.89 cents to a 19-month low

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

6

against the US$. The FTSE 100 Index decreased by about 200 points during the two hours after

the first attack (Dune

Although, the London bombs did not destroy any of the city's commercial infrastructure, many

firms were on standby as the extent of the damage became clear particularly the capital's

financial institutions that are so vulnerable to systems going down. This event has provoked a

reassessment of business continuity planning (Mark, 2005).

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

7

3.0 How Global Crisis has helped shaped UK organizations

Few organizations prior to September 11 have BCP in place, which were mainly focused on data

recovery and neglected some other areas. In the U.S, companies that have adequate back ups and

contingency plans were able to respond positively to the attack of 9/11. This became a wake up

call for most UK organizations as reports reveal that prior to September 11, the state of BCP is

dismissal in most organizations and non existence in many. This is not surprising since BCP has

not been given sufficient consideration. (Harris). Prior to the 7/7 bombings, research by London

chamber of commerce shows that over 50% of UK organizations still do not have effective BCP

in place. In recent times, companies are now beginning to see beyond terrorism as the only

disruptor to business activities and focusing on events such as flood, system failure and power

outages. This became evident in a research conducted by the data recovery specialist SunGard,

only 5% of business in the UK say that terrorism poses a primary threat to them. This

increasingly indicates that majority of UK companies see terrorism has a secondary reason why

business need to be concerned about business continuity, hence they simply want to know that

they can rely on IT system in the event of data recovery (Mark, 2005).

For most organizations the impacts of 9/11 attacks have provided some impedance for the more

widespread recognition and acceptance of BCP as a strategic function. This was reflected in the

swift response by UK banks and most organizations after the 7/7 bombings in London indicating

that contingency planning have increased considerable. (David, 2005). Subsequent to 9/11 and

7/7, there has been a tremendous change in BCP practices across many organizations in the UK.

3.1 Changes with data back-up centers

Although some businesses have learned from their mistakes and refined their recovery plans,

others have a long way to go. Prior to 9/11, most organizations have their back ups on site and

some have it within a central location; this was based on the premise of easy accessibility in the

event of any disruption. However, the increasing effect of crisis globally has given rise to the

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

8

need for organizations to have more than a single back –up data center located away from their

primary datacenter. Although this might mean additional cost for organizations, but the cost

associated with loss of data, reputation and survival cost could be more in the event of such crisis

if an effective BCP is not in place. Companies now have back-up centers across geographical

locations. A great distance between sites is still a positive aspect of BCP, but the ability to reach

and access sites under various scenarios must also be considered.

In an article written by john-Paul, (2007) evidences shows that when most of Manhattan closed

down, organizations that had sited their main and back-up data center in the same area found that

they could not resume business. Merrill Lynch is one of the companies that has decentralized its

core IT systems after the attack. The financial services firm lost two data centers on September

11. It has now moved its primary datacenter to Staten Island, where it run on a separate electrical

grid to mitigate against the loss of power in one area and the New York site has a back-up.

Morgan Stanley is another financial firm that has separated its trading and back-up facilities,

which were within close proximity and dependent on the same transport and power infrastructure

prior to 9/11 (John-Paul, 2007).

Also, the tunnel fire incident of 2002 in Manchester, northwest England caused a major

disruption to telephone lines in Royal & Sun Alliance's main offices, an international insurance

group. 130,000 landlines across the region went down for a whole day and communications

problems continued throughout the following week. This was a serious incident as the bandwidth

available to Royal & sun Alliances was compromised and routing calls became a more complex

matter, hence company without the capability to work around any outages simply lost

businesses. Luckily for Royal& Sun Alliance, SunGard had recently upgraded a recovery center

some distance from Manchester, and outside the impact zone of the fire. In short, bandwidth was

restored within two hours of the incident being reported, and within four hours all telecom

services were fully operational, and servers and desktop PCs were in place for staff to use.

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

9

This seems typical of the post-9/11 attitude towards disaster recovery and business continuity

and not because of terrorism, but because of all the other hazards a business may face; it has

become business as usual (Mark, 2005).

3.2 Changes with human resource management

A survey carried out by the UK Tripartite Financial Authorities after the 7/7 bombings revealed

that human aspect are frequently overlooked within business continuity arrangements (David,

2007). Further lesson from 9/11 is that organizations need to think of the company as a whole,

including people and processes, as well as IT. “Prior to 9/11, many firms did not really take

account of staff in their plans. Having remote data centers is very good, but if there are no staff,

or absent key staff as a result of an incident, this can bring an organization to its knees,” said Ron

Miller, managing consultant at SunGard in an article written by john-Paul (2007). After the

collapse of the world trade center, staffs were evacuated and backup facilities were without

either primary or back up personnel to execute the BCP and keep the business operating

(Raymond, 2002). This places the need for employee consideration in terms of communication,

transportation and welfare in BCP planning and not just focusing on IT and data recovery

centers. For most London based companies, not until the events of July 2005 that organization

really began to explore this area. The terror attacks of 7th July 2005 caused wide-spread

disruption to organizations, not because of the minimal physical impact of the attacks on

London’s infrastructure, but because of the subsequent lockdown of the public transport network

and the psychological impact: people did not want to travel due to fear of further attacks.

Workplace recovery facilities were open, available, and unaffected, but getting staff into place as

per organizational business continuity plans proved a difficult task (David, 2007).

In view of this, Bob Piggott, head of group crisis management at HSBC, said the finance sector

has learnt crucial lessons from 9/11 and HSBC has established a direct communications links

with Transport for London and the Metropolitan Police with a view to providing adequate

transport facilities for its employees. However, providing transport facilities can itself create

risks which need to be considered. For instance, if employees are herded together onto one bus,

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

10

the bus could become a single point of failure should it be trapped in traffic jam. Also the greater

is the risk of loosing critical employees in the event of an accident occurring. If a number of staff

were to become involved in a serious road traffic accident, this could have a major long term

impact on productivity as well as the short-term ability to meet workplace recovery

requirements. A fleet of taxis or minibuses taking more than one route to any particular recovery

centre is a safer option and the risk associated with having employees clustered together is

minimized (David, 2007).

The need for skills and knowledge of employees to be back up is increasingly important

following the fact that many organizations lost principal intellectual assets during the 9/11 and

7/7 crisis (Raymond, 2002). This increasingly leads to the need for organizations to cross train

their critical executive positions.

Further to safeguarding intellectual competences, organizations develop programmes to support

their key employees to work from home. However, Working from home may leave employees

distracted and unable to concentrate on the work properly which often arises from domestic

responsibilities or disturbances from kids, resulting in stress and frustration. (Nayab 2011). It

should also be noted that that employees working from home could be well exposed to domestic

hazards which could as well hinder them from working. Having corporate software programmes

on personal computers could be seen as an unethical practice. Employees working from home

require training and support from employers. This seems typical of the post-9/11 and 7/7 attitude

towards business continuity.

3.3 Changes with Testing of Business Continuity Plan (BCP)

Prior to 9/11, many organizations rarely test their business continuity plan and those that test

neglect their employees. Organizations spend time, efforts and resources to construct BCPs but

do not test them. Most likely these firms will not be able to successfully enact their BCPs when a

crisis begins. Merely documenting a plan does not guarantee success. To ensure usability, a BCP

must be diligently, comprehensively, and consistently tested. Live testing also trains staff. When

a crisis ensues, staff members who have been through the test are prepared to act with confidence

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

11

(Raymond, 2002). In a survey carried out by the department of Trade & Industry on disaster

recovery in 2006, it was found that of the 60% of UK firms that had a disaster recovery plan, less

than 50% had conducted live tests involving staff in the past year, and companies base their

plans on misconceptions and false assumptions.

John-Paul, in his article; disaster planning and business after 9/11 reveal that Morgan Stanley

conducts major tests every year. Over the Easter weekend, the firm takes advantage of the

powering down of all its main data centers in Canary Wharf to run a full simulation of a total

loss of data at all offices with 200 people. The firm also conducts business process testing twice

a year, in which it sends a team to the recovery site to execute trades. "It is very important in

terms of familiarizing staff with everything from getting to the site to knowing how to use it,"

said Richard Deighton, continuity manager EMEA business at Morgan Stanley.

Jon France, business continuity manager at business information provider LexisNexis conduct a

series of live disaster recovery simulations throughout the year. He acknowledged that full

scenario testing can be expensive and time-consuming and that is why some companies are

reluctant to test regularly. He added that the frequency of a company's simulation should reflect

the rate of change within the business (John-Paul, 2007).

Voca (the United Kingdom directs debit clearing house) now runs its business from a back-up

site for up to five weeks a year. It’s off site back ups appear to be a favorite method for

protecting data for 58% of solution providers data (David, 2007).

3.4 Communication

Communication is an important element of business continuity planning which has not been

given due attention. Reports reveal that after the 9/11 attacks, communication networks failed to

cope with demand as there were physical damage to mobile transmitters and landline

exchanges .however, the 7/7 London experience seem to show that these lessons have still to be

learned by many companies as most organizations still rely on mobile networks as a means of

communication during crisis. This increasingly calls for businesses to develop an alternative

communications system for emergencies.

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

12

Subsequent to the 7/7 bombings and the June 2007 car bomb, Royal British legion has developed

communication software called ACENS in reaching its employees during crisis. Its management

said “When England suffered persistent heavy snow fall in January 2010, we used AC ENS to

notify our staff of building closure and to avoid using transport in Central London. We also used

the system to notify all staff once the building had re-opened. We were very impressed with the

speed in which staff were notified and we were able to communicate by voice call, SMS and

email in one click of a button to our whole employee database. Feedback was that the system

saved time, money and stress when compared with the previous year in similar circumstances

during the bad weather of February 2009. As we had no way of communicating with staff

previously in a timely manner, lots of employees were left unsure of whether to venture into

work and in some cases, they travelled to work and had to turn around and go

back”(www.safeguardcomms.co.uk).

Post 9/11, HSBC’s Bob Piggott, head of group crisis management in an article written by John-

Paul (2007) said that the bank has provided all staffs in the UK a telephone number they can

ring to receive updated status message in the event of an incident. Providing this service can help

reassure staff, who might receive confusing reports from the media during a disaster.

3.4 Developing scenarios

Although, companies are more aware of the need to develop effective BCP, majority of the

companies are still lacking behind in terms of developing scenarios and planning for different

type of incidents. It is often seen as a cost and hence, they plan for potential industrial specific

ones forgetting that hazards can come in different ways (Continuity compliance, 2010).

A highlight from the BP’s response to the Gulf of Mexico oil spillage shows lack of readiness

and preparedness in BP’s emergency response plan. Evidences from articles and related

materials reveal that BP has failed to recognize and plan for different scenarios. In an article

written by rick jervis (2010), the energy giant never anticipated an oil spillage as the one

spewing from the gulf of Mexico as its plan only offers technical details on how to use chemical

dispersants and provides information on what to say to the media, it did not mention how to react

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

13

if a deep water well spill oil uncontrollably. This indicates that BP has not considered this in its

emergency plan. Further evidences in his article reveals that most of the techniques attempted by

BP to contain the swelling well from a 100-ton containment device that didn't work to a mile-

long tube aimed at piping out the spewing oil were not mentioned in the plan. This increasingly

indicates that BP engineers were only improvising as there were no readily available documented

plans for such incident.

Rick Steiner, an oil spill response consultant who has reviewed the plan, in the same article

reveal that parts of the plan read like boilerplate used by BP from region to region and

underscore the energy company's inability to adequately prepare for a major spill in deep water.

Although, the plan also promises that BP can respond to a "worst case discharge" of around 1

million gallons a day, BP engineer struggled for months to control a well spewing one-fifth of

that. (Rick, 2010).

Bp’s response failure should be a wake up call for organizations as the need to develop scenarios

becomes increasingly an important aspect of effective BCP. However, if BP has considered an

oil spillage it would have been able to respond positively and timely to the crisis. Disasters are

not limited only in industry specific incidents. Hence the need for organizations to give

consideration to potential specific and relevant risk event that can disrupt both business

continuity plans for organizations as well as potential relevant impact such an event could have

on all stakeholders and environment surrounding the organization (Rick, 2010). Companies

therefore need to develop scenarios and alternative plans supporting each scenario while

focusing on critical issues and response methodologies necessary to mitigate unforeseen events

before they actually occur (continuity compliance, 2010).

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

14

4.0 Conclusion

Surveys indicate that the majority of firms recognize natural disasters as a significant threat and

may have disaster contingency and recovery plan in place. However, such plans only address one

class of threats, while ignoring other serious threats, both internal and external. This paper has

been able to examine how global crisis has helped shaped BCP planning in the UK. Although

many firms after the 9/11 and the 7/7 claim to have developed contingency plans, it was apparent

that many are still neglecting important areas while focusing on industry specific risks.

A large number of firms are minimizing the importance of testing and maintaining the BCP, yet

testing is critical to developing an effective BCP and to assess the effectiveness of the BCP

before an actual disaster occurs. There is clear evidence that a company without a BCP has a low

probability of survival. However, even after the 9/11 terrorist attacks in the United States, only

53 percent of the firms surveyed in 2002 by Ernst & Young had a BCP (Virginia and Mich,

2004).

Further observation of this paper is that many of the existing BCPs are seriously deficient and

outdated, as they do not address many of today’s major risks of business systems interruption.

The overwhelming conclusion is that firms must periodically reevaluate the comprehensiveness

of their business continuity strategy to avoid catastrophic consequences from a wide variety of

serious internal and external threats, including increasing information security threats. Current

trends are to transfer the primary ownership of the BCP to corporate or general management and

to integrate business continuity and IT security planning. Some companies have given this

responsibility to a new corporate position, a Chief Continuity Officer (Virginia and Mich, 2004).

While no amount of security measures can provide absolute protection from all potential

intrusions and disasters, a comprehensive BCP will dramatically increase a company’s defenses

and reduce the impact of any business.

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

15

References

Barnhart, B., 2001. Markets reopen, plunge. Chicago Tribune [Online] 17th September. Available at: http://www.chicagotribune.com/business/chi-010917markets,1,2882341.story. [Accessed 28 March 2011].

Contingency compliance, 2010. Contingency plan and crisis management efforts by BP under fire from DHS. [Online] 19 May. Available at: http://www.continuitycompliance.org/information/regulatory-compliance/contingency-plan-and-crisis-management-efforts-by-bp-under-fire-from-dhs/. [Accessed 23 February 2011].

David, H., 2007. Work place strategies for a changing world. [Online]. Available at: http://www.continuitycentral.com/feature0613.html [Accessed 29 March 2011].

David, H., 2005. Business continuity lessons from July 7th. [Online] 15 July. Available at: http://www.continuitycentral.com/feature0225.htm [Accessed 29 March 2011].

David. K., 2005. London’s day of terror. [Online] 8 July. Available at: http://www.dailymail.co.uk/news/article-354944/Londons-day-terror.html#ixzz1HosVLSo3. [Accessed 29 March 2011].

Dominic, E., Ethne, S. and Brahim, H., 2010. Business continuity management: A crisis management approach. 2nd ed. Oxon: Routledge.

Dune. L., 2005. U.S. Stocks Rise, Erasing Losses on London Bombings; Gap Rises. [Online] 7 July. Available at: http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aflPCIrU37Ns&refer=us. [Accessed 30 March 2011].

Fox news, 2010. 9Years Later, Nearly 900 9/11 Responders Have Died, Survivors Fight for Compensation. FOX News. [Online].11 September. Available at: http://www.foxnews.com/politics/2010/09/09/report-responders-died-ground-zero-illnesses/. [Accessed 29 March 2011].

John-Paul, 2007. Disaster planning and business continuity after 9/11. [Online] 11th September. Available at: http://www.computerweekly.com/Articles/2007/09/07/226632/Disaster-planning-and-business-continuity-after-911.htm. [Accessed 18 March 2011].

London chamber of commerce and Industry, 2005. The economic effects of terrorism on London- experiences of firms in London business community. [Online]Available at: http://www.londonchamber.co.uk/docimages/754.pdf.[Accessed 29 March 2011]

Makinen, G., 2002. The Economic Effects of 9/11: A Retrospective Assessment [Pdf]. Congressional Research Service. Library of Congress. [Online]27 September .Available at: http://www.fas.org/irp/crs/RL31617.pdf. [Accessed 28 March 2011].

Mark, V., 2005. In wake of London terrorism, business continuity plan follows a pragmatic course.[Online] 30 August. Available at: http://www.techrepublic.com/article/in-wake-of-london-terrorism-business-continuity-planning-follows-pragmatic-course/5843482. [Accessed 18 March 2011].

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.

16

Nayab, N., 2011. Key Areas of Encouragement for the Work from Home Employee. [Online]. 21 March. Available at: http://www.brighthub.com/office/home/articles/68833.aspx#ixzz1I0jvUlfI [Accessed 29 March 2011].

Raymond, J.G., 2002. Why do business continuity plan fail. [Online].Available at: http://www.rmmag.com/Magazine/printtemplate.cfm?AID=1483. [Accessed 26 March 2011]

Rick, j., 2010. BP response shows lack of readiness. [Online] 17th May. Available at: http://www.usatoday.com/news/nation/2010-05-17-oil-plan_N.htm. [Accessed 29 March 2011].

Royal British legion.[Online] Available at: http://www.safeguardcomms.co.uk/downloads/Royal_British_Legion_AC_ENS.pdf. [Accessed 30 March 2011]

Virginia and Mich. J.C., 2004. Business continuity planning: A comprehensive approach, [Online], Available at: http://www.auerbach-publications.com/dynamic_data/3138_1893_bcp.pdf. [Accessed 25 March 2100].

How global crisis has helped shaped UK organizations. Adelakun Oluwafemi. Adeshola A4019368 MBA Risk management, University of Wales.