References

BBC News. Fire breaks out at Harley Street block of flats in London. 2018. https://tinyurl.com/yboufdrb (accessed 25 April 2019)

MK Citizen. Clean-up operation at Milton Keynes' Saxon Clinic following last weekend's flooding. 2018. https://tinyurl.com/y55uoa8v (accessed 25 April 2019)

When disaster strikes: how to ensure business continuity

02 May 2019
Volume 8 · Issue 4

Abstract

Businesses that fail to plan ahead in case of disasters are leading themselves down the path of planned failure, says Adam Bernstein

Although the UK does not suffer from earthquakes and tsunamis, it is not immune from other threats. Cast the mind back to 2005, which saw the Buncefield oil depot explosion and the terrorist attacks in London; the flash floods in Kent in May 2018; and more recently, pity the TSB customers who found themselves dealing with the bank's failed systems and weeks of financial disruption.

The healthcare sector has not been exempted from its share of troubles.

Back in May 2018, the MK Citizen reported on a flash flood that affected the Saxon Clinic in Milton Keynes (MK Citizen, 2018). The majority of the hospital was flooded, causing extensive damage throughout and resulting in a clean-up operation that kept the staff busy right through a bank holiday weekend. Earlier in 2018, the clinic had to deal with power cuts, heating loss and road blockages caused by snow storms.

Recent instances of flooding and other extreme weather conditions in the UK illustrate why it is important for business owners to prepare for disruptions accordingly

And just a month later, in June 2018, the BBC ran a story on a fire that broke out in a six-storey Harley Street block of flats (BBC, 2018). It took 10 fire engines and 72 firemen to put out the blaze that burned on the fourth and fifth floors. The building housed flats, a dental clinic and an eye clinic.

These examples illustrate why clinics need to plan for disruption. If this is done correctly, clinic owners could put themselves in a position that will strengthen their business compared with rivals who fail to plan ahead. As the City of York notes on its website, “disasters have no boundaries and whether you are a small or large business you may be affected. The main purpose of business continuity is to ensure that the organisation has a response to major disruptions that threaten its survival’.

Understand the business

The first step is to understand the business in terms of the potential threats to its normal operation. With staff, clinics should look at every aspect of the business and think about the people employed, what they need to operate and how they serve their clients.

Assess the risks

The threats to the business are many and although some of them seem improbable, they should all be considered:

  • Natural disasters: flood or wind damage
  • Theft or vandalism: either could prove costly and pose health and safety risks
  • Fire: could physically destroy a business
  • Power cut: computers and other equipment can't operate
  • Fuel shortages: affects staff and deliveries
  • IT or telecoms system failure: technical issues or malicious activities
  • Restricted access to premises: no access to the premises for business to continue
  • Loss or illness of key staff: staff resign or are incapacitated
  • Outbreak of disease or infection: staff too unwell to work
  • Crises affecting suppliers: restricted supplies
  • Crises affecting business' reputation: poor social media activity leading to public retribution
  • Terror attack: destroyed premises and potential loss of life.
  • Despite rising costs, clinics should never skip on insurances

    They all sound very improbable, but they have happened, so each one is worth considering.

    Develop your strategy and plan

    On investigation, some risks can be ignored; others will be accepted but the clinic sets up a mutual arrangement with a neighbour to help each other out. Alternatively, it may choose to become self-sufficient.

    However it is approached, the plan must be written in plain English so that all can understand it. Guidance on planning is available via free software called ROBUST. https://robust.riscauthority.co.uk/.

    Build in protection

    Contemplate where redundancy can be built in without adding too much extra cost. Although there's no point renting a spare building or equipment just in case of disaster, knowing where the clinic can rent certain pieces of equipment may save the day.

    Remember, equipment—especially IT—can fail. The hard drive in a computer, for example, has a ‘mean time before failure’ rating, in other words, how long it's expected to operate before it fails. But that doesn't mean that it won't fail much sooner. Similarly, an (often automatic) update to the operating system on a computer may cause more problems that it cures. The key to both of these scenarios is to back up data regularly, at least once a day, and keep the backup offsite and accessible.

    Communication is critical to business. This is especially acute if the telephone system is based on VoiP (internet) rather than a traditional line. Plan to use alternatives. Is there someone with a wireless connection with whom the clinic can agree a reciprocal piggy back arrangement if the broadband fails? Consider a 4G dongle or a mobile phone plan that comes with plenty of data. Consider having phones on two different networks, in case one fails.

    Look at scanning and filing documents electronically. Fast double-sided automatic scanners will turn paper into PDF files that can be backed up and placed in a searchable archive on a computer. It will also be possible to store the originals elsewhere at a less expensive location to further spread the risk of loss.

    Insurance

    Despite rising costs, clinics should never skip on insurances. Indeed, business owners should make a point of recording when insurances are due and ensure that someone checks that they have been paid for. Similarly, it makes sense to note down the policy details and keep them offsite. Apart from the obvious insurance—premises, stock, vehicles, public liability and employers liability—clinics might also consider buying:

  • Directors and officers insurance that covers negligence when running an incorporated business
  • Business interruption insurance that will pay to keep a business alive following a catastrophe (unlike premises and contents which just pays to replace the physical)
  • Keyman insurance that provides money following the death of a key person to the surviving business partner(s) to keep the business afloat or to buy out the estate of the deceased
  • Critical illness cover that pays out following the diagnosis of defined serious illness that is terminal or life threatening
  • Permanent health insurance that pays an income where the insured can no longer work.
  • Regulatory

    It would be a mistake not to mention the regulatory threats through changing legislation, case law and tax policy, any combination of which could impact a business. The forever changing ground of employment law is great case in point. Employees have become more litigious and, as discrimination awards have no limit, a good case proven could cost an employer thousands. Similarly, ignoring a tax demand from HMRC—even though it may be considered pure fantasy—could lead to bankruptcy if not addressed.

    Write policies and risk assess

    Having good polices and also risk assessing threats to the clinic will enable the business owner to forestall any obvious threats, such as simple fire risks, or more complex terrorist activity, but may also help to lower insurance premiums on the basis that the business presents a lower risk to the insurer. Further, having a plan in place will mean that everyone will know what to do in case of a disaster. For example, by writing a bad weather policy, both employer and staff know the effort that is expected when trying to get into work, and the pay/leave arrangements for when they fail to get in.

    It also makes sense to consider employee issues—such as discrimination, bullying and sickness absence—a threat, in which case there should be policies for those too. The same applies to health and safety issues. A good policy will not necessarily get a business out of trouble if an incident occurs, but it will help it mitigate any penalties heading its way following an investigation.

    Of course, legal advice should be sought before writing policies that are available for all to read.

    Emergency contacts

    Another worthwhile move is to draw up a list of emergency contacts that includes key staff, the utilities (water, gas, electricity, telephone and broadband), employment agencies and key suppliers. Remember also details of the accountant, solicitor and the tax / VAT office (with references). Neighbouring businesses shouldn't be left out in case they need to be informed, and nor should clients who may need contacting. At the same time, thought should be given to diverting calls if the building cannot be accessed.

    Finally, having spent time, effort and money in creating a disaster recovery plan, it needs to be tested and kept up to date.

    Conclusion

    Ultimately, the threats affecting one business might be quite different for another. But the threats are real and should be considered in full, with plans being made to prepare for such eventualities.