Business continuity planning (BCP) has received considerable attention recently due to the COVID-19 pandemic. Many organizations found that they either did not have a plan to address the many changes that occurred due to the pandemic or that their plan was incomplete or ill prepared.
Understanding the relationships between these business continuity risk factors can lead to a more conceptual approach to BCP that highlights economic uncertainty and sets up an organization for better success in the future. To this end, a survey of business owners was conducted to determine their level of concern about business continuity and what interconnected factors related to the COVID-19 pandemic had the largest impact on business continuity.
BCP
A business continuity plan is designed to mitigate risk, limit the effects of a crisis and reduce the time needed to restore operations to a state of business as usual.1 To accomplish this task, enterprises have been encouraged to follow a three-step process:
- Identify major risk factors that might cause business interruptions.
- Develop a plan to reduce or mitigate the effects associated with each risk.
- Train employees on how to implement the business continuity plan and test its effectiveness.
The first step—identifying major risk factors—may be the most important and the most difficult to accomplish. For what type of risk scenarios should an enterprise prepare? As the COVID-19 pandemic has shown, it is possible to overlook a major risk factor that can have a dramatic effect on a business. The pandemic caught many enterprises off guard, with no plans in place to deal with such an event. Businesses scrambled to find ways to employ a remote workforce, sanitize public spaces and fill in gaps left in supply chains. It has become more obvious than ever that businesses should engage in the BCP process to better manage future crises.
There are many examples of business continuity plans, and the BCP process has been the subject of various publications. One interesting example is a 2006 article concerning how VisitScotland (the country’s national tourism organization) used BCP to prepare for a flu pandemic using an eight-step scenario plan.2, 3 It also discusses the potential impact on travel to and from Scotland and how this might be affected by other external factors.4 Ironically, many of the factors (e.g., reduced workforce due to illness, significant reduction in travel, overwhelmed medical facilities) were witnessed during the COVID-19 pandemic.
These external factors have become more relevant during the COVID-19 pandemic, demonstrating in real time the interconnectedness of many variables associated with business continuity. In October 2020, the US State of Florida Small Business Development Center (SBDC) Network teamed with the University of West Florida Haas Center (Pensacola, Florida, USA) and the Florida Chamber of Commerce Foundation to survey 4,842 small businesses in Florida.5 Business owners were asked myriad questions pertaining to the pandemic’s effect on their businesses and their level of concern going forward. On a scale of 1 (no concern) to 5 (extremely concerned), respondents were asked to rate their level of concern about business continuity (maintaining operations, overcoming disasters), government regulations (complying with onerous and costly regulations), the supply chain (maintaining and securing products and materials), workforce quality (recruiting and retaining qualified employees) and economic uncertainty (instability of domestic markets and political governments) (figure 1).
Figure 1 shows that six months into the pandemic, business owners were still very concerned about maintaining their business continuity (an average of 3.85 out of 5). This is interesting, as many small businesses had already closed due to the pandemic, and their owners did not respond to the survey. Otherwise, this number likely would have been higher. But even when the primary risk is known, it may be difficult to address the interconnected risk factors.
As figure 1 shows, business owners were most concerned about economic uncertainty (4.26 out of 5). In addition to business continuity, they expressed a significant level of concern about government regulations (3.70), supply-chain-related risk (3.27), and recruitment or retention of a quality workforce (3.08). Figure 2 presents this information by industry.
Across all industries, economic uncertainty was the major concern. Digging deeper, it is clear that some industries place more emphasis on variables that are of particular relevance to them. The survey revealed some interesting patterns:
- In no industry did the respondents rate their level of concern as somewhat concerned or lower (< 2.5) for any of the factors.
- There appears to be a relationship between the level of concern about business continuity and the level of concern about other factors.
Investigating the Interconnectedness of Risk Factors
When developing a business continuity plan, one of the key components is identifying the factors that can disrupt business operations. The survey data provide empirical evidence of the interconnectedness of variables that should be considered when engaging in BCP.
Figure 3 demonstrates the relationship between concern for business continuity and concern for attracting and retaining a quality workforce, broken down by industry. In general, the level of concern for business continuity increased as the concern for workforce quality increased. Some industries (e.g., arts, entertainment and recreation) deviated slightly from this pattern, but a positive relationship (correlation = 0.52) was observed. This level of correlation is considered significant.6
IN GENERAL, THE LEVEL OF CONCERN FOR BUSINESS CONTINUITY INCREASED AS THE CONCERN FOR WORKFORCE QUALITY INCREASED.
As shown in figure 3, the concern for business continuity varied by industry. The highest level of concern was evident in the accommodation and food service industry, which also had the highest level of concern for workforce quality. At the other end of the spectrum were the administrative support and waste management industries, which reported the lowest level of concern for business continuity and the second-lowest level of concern for workforce quality. It is clear that workforce quality is connected to business continuity.
With regard to the supply chain, the pattern in figure 4 is very similar to that in figure 3. There was a positive relationship (correlation = 0.55) between business continuity concerns and supply chain concerns. The highest level of concern about the supply chain occurred in the wholesale trade, accommodation and food service, retail trade, and transportation and warehousing industries. This is to be expected given the importance of the supply chain to these industries. Thus, these survey data corroborated expectations about the relationship between the supply chain and business continuity.
One factor that may be overlooked in many business continuity plans is the effect of government regulations. The COVID-19 pandemic has shown that local, state and federal governments are willing to enact regulations that impact business continuity. Decisions by government agencies to limit the number of patrons allowed in a facility, the types of businesses allowed open to the public, the use of face coverings and travel restrictions significantly altered business practices. These types of measures have rarely been used by government in the past, but they appear to be part of the future. Indication from several countries is that face coverings may be a consideration for many years to come. Figure 5 demonstrates a positive relationship (correlation = 0.49) between concerns about government regulations and concerns about business continuity. Interestingly, the accommodation and food-service industry once again reported the greatest concern about the impact of government regulations. In large part, this may be due to the pandemic-related regulations limiting its services. The utility industry was at the other end of the spectrum, showing little concern for government regulations during the current crisis.
DEVELOPING A BCP SPECIFICALLY FOR THE ECONOMY IS HIGHLY RECOMMENDED FOR ALL ORGANIZATIONS, BUT IT IS A NECESSITY FOR THOSE IN INDUSTRIES THAT ARE HIGHLY SUSCEPTIBLE TO ECONOMIC CONDITIONS.
Figures 3 through 5 show the importance of both internal factors (workforce quality) and external factors (supply chain, government regulations) to business continuity. The last factor examined is economic uncertainty, which had the strongest relationship (correlation = 0.92) to business continuity (figure 6). This strong relationship means that 85 percent (r2) of the variance in the level of concern about business continuity can be explained by the variance in the level of concern about economic uncertainty. Business owners’ responses to the survey indicated that economic uncertainty was the most important factor explored thus far.
Major Takeaways
The observation that concern for the economy drives concern for business continuity is not surprising. Most important are the data supporting this claim. Some industries are very susceptible to economic conditions (e.g., accommodation and food service, arts, entertainment and recreation), while others are not (e.g., waste management).
Developing a BCP specifically for the economy is highly recommended for all organizations, but it is a necessity for those in industries that are highly susceptible to economic conditions.
The idea of developing business continuity plans based on the economy is a fundamental shift away from the usual method of BCP. Currently, many enterprises focus on identifying events that might cause a disruption in service. Any event that poses a potential risk to the business becomes part of the BCP process. Focusing instead on the concept of economic uncertainty enables organizations to develop broader or more general business continuity plans that can encompass any event that might affect the economy. Over the past two decades, there have been several notable economic crises. The COVID-19 global pandemic is set to surpass the negative effects of the 2007–2009 global financial crisis. Such events affect almost all organizations. However, regional economic events like the Argentine government losing access to capital markets in 2001–2002, the falling commodity prices due to the collapse of Russia’s economy after annexation of Crimea and the Ukraine, and the implosion of the dot com market in the United States all point to the interconnected nature of business these days. Organizations should consider developing specific BCPs for the loss of product, or markets, with any countries with which they do business.
The shift toward concept-level thinking is growing. Retail chains are moving away from the objective of opening storefronts to the more generic goal of ensuring product availability.7 Similarly, it might be better to focus on the risk posed by any third-party relationship rather than looking specifically at supply chain partners. This could apply to any professional services being provided (e.g., accounting, cleaning, maintenance) for the organization. The days of having one independent accountant to manage records may be over, as there is a need for a competent backup in case of an emergency. Organizations should consider each of their key business functions and decide whether their current business partners can provide the necessary reliability and redundancy, regardless of the external world events.
ORGANIZATIONS SHOULD CONSIDER DEVELOPING SPECIFIC BCPS FOR THE LOSS OF PRODUCT, OR MARKETS, WITH ANY COUNTRIES WITH WHICH THEY DO BUSINESS.
The factors affecting business continuity are highly connected. As the survey shows, survey respondents’ business continuity concerns were related to the economy, supply chain, workforce quality and government regulations. The survey data show that workforce quality is significantly related to the supply chain and government regulations. Likewise, government regulations are related to supply chain concerns. Organizations must consider the interconnected nature of the factors affecting business continuity when developing business continuity plans. Development of BCPs must include this level of interconnectedness in their considerations. BCPs should often start with what is the worst-case scenario that can be imagined. This will likely include situations where a domino effect is seen, where if one event occurs, then the next event is likely. Thinking about these links between events and how the organization can stop the fall of the next domino is necessary.
Some industries (e.g., the food-service industry) are highly susceptible to external factors and should place more emphasis on BCP. However, this does not mean that other industries are free from business continuity worries; it only indicates that the pandemic is not affecting them at the same level. It is possible that other natural disasters or world events may introduce risk factors that are more relevant to these industries. This can be seen with worker strikes, which can shut down a significant amount of the economy, or natural disasters, which affect the infrastructure of entire countries or regions. Organizations should develop BCPs that consider which factors might arise that would significantly affect their ability to meet their mission. These events should become part of an organization watch list that is consistently monitored, so the organization can react as soon as possible.
A final consideration comes from the initial definition of BCP: The idea of a return to business as usual may need to be removed from the BCP process. Many enterprises have been significantly harmed during the pandemic because of the assumption that business would return to normal. As a result, they waited to take action. A more conceptual approach to BCP would focus on what to do now, allowing world events to determine when future changes should be made. Enterprises must continually evolve, and going back to the way things were does not fit into the evolutionary process. Organizations will find more ways to change today to meet the challenges of tomorrow if they take time to develop BCPs for various scenarios. Even just setting aside the time for deliberate consideration of the future provides an organization with more ideas of how they can adjust. Often, the organization will find there is no reason why they should not go ahead and change now before the next big event comes. And even if the BCP is never used, or ideas are never adopted, the practice of developing a BCP makes the organization better prepared to develop a BCP in a crisis situation.
ENTERPRISES SHOULD WORK TOWARD IDENTIFYING CONCEPTUAL FACTORS RATHER THAN SPECIFIC EVENTS.
Conclusion
The COVID-19 pandemic has challenged most businesses and highlighted the need for BCP. It has shown the vulnerability of many industries, while also providing a wealth of data. These data have revealed the relationships between business continuity risk factors. BCP involves untangling a web of related factors to clear a path ahead for the enterprise.
Shifting to a more conceptual approach may be necessary. BCP that focuses on economic uncertainty in general rather than on individual events may allow even unforeseen events to be covered by the business continuity plan. Similarly, thinking about third-party risk in general rather than the particular components of the supply chain, or focusing on product availability rather than store reopenings, may provide new concept-based insights into the BCP process. In other words, enterprises should work toward identifying conceptual factors rather than specific events.
BCP must define new paths for organizations rather than holding on until the crisis is over and then returning to the old path: “You can’t go back and make a new start, but you can start right now and make a brand new ending.”8
Authors’ Note
Special thanks to the Florida SBDC Network and the University of West Florida Haas Center (Pensacola, Florida, USA) for sharing the data necessary for this article.
Endnotes
1 Cerullo, V.; M. J. Cerullo; “Business Continuity
Planning: A Comprehensive Approach,” ISM
Journal, Summer 2004, p. 70–78
2 Page, S.; I. Yeoman; “How VisitScotland
Prepared for a Flu Pandemic,” Journal of
Business Continuity and Emergency Planning,
vol. 1, iss. 2, 2006, p. 167–182
3 Miller, K. D.; H. G. Waller; “Scenarios, Real
Options and Integrated Risk Management,”
Long Range Planning, vol. 36, iss. 1, 2003,
p. 93–107
4 Op cit Page
5 Florida Small Business Development Center
(SBDC) Network, “The Impact of the COVID-19
Pandemic on Florida’s Small Businesses,”
October 2020, http://www.floridasbdc.org/Reports/Publications/COVID%20Impact%20Survey_October.pdf
6 Cohen, J.; Statistical Power Analysis for the
Behavioral Sciences, 2nd Edition, Erlbaum,
USA, 1988
7 Alvero, K.; “The Global Pandemic’s Effect on
Business Continuity,” ISACA® Journal, vol. 3,
2021, https://www.isaca.org/archives
8 Sherman, J. R.; Rejection, Pathway Books,
USA, 1982
Gerald F. Burch, Ph.D.
Is a visiting professor at the University of West Florida (Pensacola, Florida, USA). His primary areas of teaching are in operations management and information systems at both the undergraduate and graduate levels.
John H. Batchelor
Is an associate professor of management at the University of West Florida. He teaches undergraduate and master's of business administration (MBA) classes related to management, human resources and entrepreneurship. His research interests include entrepreneurship, meta-analysis, experiential learning and emotions. He also serves as the chair of the UWF Business Administration Department.
Randall Reid, Ph.D., CISA, CISSP, Security+, A+, Network+
Joined the faculty of University of West Florida in the fall of 2003. He previously taught at the University of Alabama (Huntsville, Alabama, USA) and Bowling Green State University (Bowling Green, Ohio, USA). Reid’s primary research and teaching interests are in the security area and the pedagogical aspects of teaching.
Tyler Fezzey
Is a student at the University of West Florida. Her research interests include organizational behavior and cybersecurity. She is also a graduate assistant for the UWF Center for Entrepreneurship, a lending analytics intern at Navy Federal Credit Union and a member of the women’s volleyball team.