UK Companies Complacent in the Face of Risk
UK businesses are still too cursory when it comes to risk planning, despite the events of the past 18 months roundly demonstrating the value of thorough contingency planning.
While the past year's seen a rise in the number of companies to adopt some form of business continuity planning, fewer managers see it as important to their business, and many see it as a tick-box exercise, according to Ruth Spellman, the head of he Chartered Management Institute.
Its annual research into business continuity planning with the Cabinet Office, "A Decade of Living Dangerously" identifies serious gaps in corporate understanding of risk, and a complacent attitude to taking action.
Even in areas where companies could see they might be vulnerable -- IT security being the Achilles heel for most companies -- 33 per cent of the execs surveyed hadn't tested their continuity plans at all.
What's more, there are less obvious weak spots that a company needs to make contingency plans for, says Spellman: brand damage, supply chain relationships or the loss of key clients could hurt a company's cashflow significantly, particularly in the current economic climate.
Negative publicity or bad press coverage is less of a worry than it used to be, too: 41 per cent identified it as a risk this year, compared to 51 per cent last year and 43 per cent the year before. Pressure to cut budgets could curtail time spent on what's considered more elaborate or longer-term planning.
What's more, tough times can encourage a silo mentality among teams, despite the obvious advantages of sharing more information across teams.
The opposite should be happening, says Spellman: this is the time for departments to open up their teams.
She also advocates that non-execs include it more frequently in their board agendas and that someone senior from within the company be available to report back on the big issues and how the company might tackle them.
The CMI findings are again a reminder, though, of the paucity of forward-planning approaches on offer for 'rehearsing' risk scenarios. It's possible to see how a business might practice its approach to a severe change in the weather, but planning approaches for less obvious issues -- reputation damage, or the kind of brand outcry Tropicana faced when it changed its packaging -- is harder to see coming.
That's why Spellman insists on a wider range of company stakeholders taking part in any risk discussion. Creating a cross-departmental BCP 'taskforce' would give managers and their teams a chance to identify what their biggest areas of vulnerability might be, how a problem would affect them, and what they could do plan ahead.
It's a pretty simple idea, but achieves several things at once: companies can start to think around potential problems and plan more thoroughly.
It brings real users into the picture, often an issue when technology fails. It's a valuable stakeholder and shareholder confidence builder.
It also takes the weight off the one individual (usually in finance) to whom risk's been delegated (or relegated). That's the kind of box-ticking of which Spellman would probably approve.
(Photo: James Cridland, CC2.0)