Business Continuity Management – The need for a Business Continuity Plan to UK retail companies in the face of a major crisis
Table of Contents
1 Introduction 4
2 Literature Review 6
2.1 Essentiality of BCM 7
2.2 BCM implementation 8
2.3 ISO22301:2019 10
3 Methodology 12
3.1 Research design 13
3.2 Research methods 14
3.3 Data Collection 15
3.4 Ethical issues 16
3. 5 Reliability and validity of the study 16
3. 6 Limitations 17
4 Data Analysis and Discussion 17
5 Conclusion and Recommendations 27
So far, the year 2020 has been nothing like expected. The global spread of COVID-19 has created a global crisis, impacting global economies, states, companies and individuals around the globe for an unknown period of time. However, the COVID-19 is not the first pandemic to appear in the 21st century. In 2006, during the H5N1 avian flu, it was discovered the emergence of a pandemic poses the single greatest threat to businesses globally and that the effects of a pandemic on business operations could continue up to 18 months (Staples, 2006). Furthermore, in the scenario of a pandemic, companies will need “rigorous contingency plans” to limit the impact on the company itself and its employees, shareholders, consumers and the surrounding community (Staples, 2006).
A dictionary definition of crisis is “an unstable or crucial time or state of affairs in which a decisive change is impending” (Merriam-Webster). What is characteristic to a crisis is often destructive for businesses and an impact of a crisis can be severe or even fatal on companies. The current COVID-19 pandemic has affected companies in the UK in several ways. Large companies such as Flybe have entered administration, as the whole airline industry has faced yet the worst of the crises. Many companies have been obliged to lay off their employees and seize operations. Some companies and industries have experienced major disruptions in supply chains. Whilst in contrast, some companies have experienced heavy growth e.g. healthcare industry (Bounds, 2020). The impact on corporate profit is seen as the best indicator to assess the severity of a crisis (Smith, 2013). Within the framework of this theory, the severity of the current pandemic can be seen as fatal to many companies.
In the light of the current situation, business continuity is a highly relevant and essential topic.
Business continuity is fundamental for companies. In order to operate and create profit in the future, companies not only need to develop long-term and short-term strategies, but they must create a strategy that secures operations in the case of an unexpected crisis. Business continuity refers to “the uninterrupted availability of all key resources supporting essential business functions” (Hiles, 2014). Business continuity management (BCM) is the process of maintaining business operations after a disruption in order to ensure the company continues to achieve their corporate objectives (Hiles, 2014). Whereas a Business Continuity Plan (BCP) can be detailed as a plan that protects companies and their personnel, facilities, materials and activities from the broad spectrum of risks that businesses are faced with, whether it be at home or abroad (Blyth, Page15, 2009). The aim of this study is to critically evaluate the need of possessing and implementing a business continuity plan for UK retail companies during a major crisis, such as the current COVID-19 pandemic.
The current research on BCM and BCP’s confirms that a BCP is a crucial component for companies’ survival in a crisis (Hiles 2014). This thesis confirms the cruciality of the BCM and BCP but aims to provide a critical analysis of the implementation of BCP in the light of the current pandemic. The research will be built upon a survey on UK companies in the retail sector, aiming to offer the reader with current and relevant insights from the field.
The objectives of the research include:
• To evaluate and identify the main BCM and BCP frameworks and the different stages of BCM
• To analyse and determine whether UK companies were planned for such a crisis as Covid-19
• To identify and construct the advantages that an implementation of a BCP can create for a company.
2 Literature Review
The strategic importance of a business continuity management plan has been researched well by academics and several authors have highlighted the necessity of implementing and maintaining a BCP. This literature review will provide the reader of this thesis a theoretical foundation on the topic with insights on the importance and usefulness of business continuity management.
Business continuity refers to “the uninterrupted availability of all key resources supporting essential business functions” (Hiles, 2014, p.2). Business continuity management has matured from a technological and information system centred discipline into a holistic, business wide and strategic discipline. As information systems have developed, consequently the needs of the organisations and its stakeholders have changed as well (Elliot, Swartz & Herbane, p.1). Elliot, Swartz and Herbane describe four stages of BCM, reflecting the changes in the business operations and the surrounding society.
Figure 1. The development of BCM by Elliot, Swartz & Herbane (Page Number)
The key of the BCM is on building day to day resilience, regardless of the crisis (Elliot, Swartz and Herbane, 2010). By building resilience, impacts on key stakeholders and operations can be minimised and the company continues to achieve its corporate objectives. (Hiles, 2014, p.2).
As mentioned, BCM is about building resilience and ensuring the availability of key resources. Naturally, the key resources of different companies vary and consequently, the content of BCM varies. Factors such as the organisation context and the experience of the organisation and its management of crisis situations set the starting point for the development of BCM within a company (Elliot, p. 30).
As part of business continuity management, a business continuity plan (BCP) is created. A BCP can be defined in simple terms as an arrangement or a plan taken by a company or a business to dissipate organisational risk while proceeding with its business operations even under circumstances influenced by various disruptions such as Covid-19. (Elliott, Swartz, and Herbane, 2010)
2.1 Essentiality of BCM
BCM is without doubt, an essential aspect of business operations. One could imagine that the level and the nature of a disruption is highly relevant in BCM. However, it is argued, the magnitude of a disruption is irrelevant. BCM is intended to support companies in building day to day resilience despite the magnitude of disruption (Elliot, Swartz and Herbane, 2010). Arguably, this holds true in terms of the importance of BCM. Each disruption poses a risk to a company, whether local or global of nature.
The essentiality of BCM and BCP is reiterated by several academics. A successful business continuity plan is fundamental to re-establish organization tasks, ensure the organization’s fame, and limit the danger of genuine budgetary misfortune in a calamity (Venclova, Urbancova, and Vydrova, 2013). Further on, business continuity plans guarantee that firms have a system in place that acts as a safety net in case a complication arises such as COVID-19 (Morwood, 1998). Also, a BCP can help ease the human and financial stresses over the organisation by providing an alternate pathway for business transactions to take place (Morwood 1998). The benefit of having a BCP is reiterated as without a BCP the company will fail when faced with a crisis (Hiles, 2014)
However, the extent of whether a BCP contributes positively to the business is also contested. One issue is that the business continuity planning project does not generate revenues, so it is not treated with utmost importance in most organisations (Weems ,1999). Further on, many companies do not intend to invest heavily in preparing for unknown threats as they would rather wait for it to happen then defend (Sumtotal systems, 2010). Toft and Reynolds (2005) and Elliot, Smith and McGuiness (2000) have all presented their concerns of the companies’ ability to learn from the past crisis and business interruptions. Without proper understanding of the business and the past, the BCM cannot be effective (Elliot, 2012). The BCM should be viewed as more as a holistic strategy than a detailed plan. As the element of surprise is characteristic to crises, a BCP could not take into consideration every potential scenario (Myers, 2006)
This can be argued, as it is important to prepare for the unknown (Glendon, 2013). A contingency plan covers likely crises that are predicted to occur. However, a continuity plan deals with the unknown, where the risk is not easily predicted (Glendon, 2013). The idea of Myers is supported as rather than envisioning the specific disasters and planning responses to them, it will be more beneficial to look at the operations that may be affected (Cerullo and Cerullo, 2004). Thus, it is important for business continuity plans to be able to respond to certain operations that are affected rather than specific events.
2.2 BCM implementation
Elliot (2012, p.95) presents four stages of BCM: 1. Initiation, 2. Planning, 3. Implementation and 4. Operational management. The steps are interrelated, and the execution of each step impacts the execution of the other. The importance of initiation is highlighted. If BCM is seen as an add-on instead of an integral part of the company, the BCM will unlikely be successful. Consequently, if the initiation of BCM lacks the necessary dedication, the planning stage and the implementation stage are too unlikely to be successful (Elliot, 2012, p. 96). The lack of managerial support is supposedly one of the most common mistakes with BCM implementation (Blyth, 2009).
Figure 2. Steps of BCM by Elliot (2012) (Page Number)
A continuity plan fails when it takes longer than needed to get back to business after a disruption (Hotchkiss, 2010). A BCP normally covers key staff, assets, administrations, and activities required to guarantee basic business operations that precede inside arranged degrees of interruption (Jones, 2011). However, a plan means nothing if it is not implemented correctly. “An unexercised plan could be worse than no plan at all as you won’t know if you can depend on the plan” (Rothstein, 2007). Further on, it is essential to continuously maintain, review and exercise the BCP due to rapid changes in the business environment (Hiles, 2014) It is clear a company must possess the human and financial resources to implement a plan correctly as people and communication are everything in a crisis (Bloomberg, 2018). Implying, no matter how much a company plans, the plan would be insufficient without the rightful participation from the company’s employees.
The implementation of a BCP is seen as a more crucial aspect for smaller UK firms compared to larger firms. Small organisations often have a flat hierarchical structure and therefore are more prone to major incidents and disasters. The impact to the organisation all too regularly is terminal and as a result, the organisations entire supply chain and community are severely affected (The Federation of small businesses, 2020). In smaller firms the assets and the workforce involvement in business continuity management is limited, the hierarchical structure and IT framework of UK SME’s tend to vary from those of huge companies (Botha and von Solms, 2004). Accordingly, one can contend that the BCP procedures used in huge associations won’t be perfect for execution in smaller companies. One could additionally contend that the distinction in BCP techniques, tending to smaller companies, would be predominantly usage based. Hence a usage strategy for BCP philosophies that will guarantee straightforward execution would demonstrate importance to smaller companies (Worthington, Collins, and Hitt, 2009).
In todays’ world, how companies operate ethically has a huge importance on their position in the market and when faced with a crisis, the act to operate ethically becomes increasingly difficult. Christensen and Kohls (2003) laid emphasis on the importance of ethical administration by the business owners when they are subjected to a crisis. They brought forth various steps showing how to ethically deal with threats. In their research they also shed light on the process of ethical decision-making during crisis situations. They concluded that ethical administrative processes especially in times of great distress were highly dependent on terms of the consequences of the threats posed, the probability of a crisis occurring, and the costs needed to run critical business operations.
The International Organisation for Standardisation (ISO) is an independent, non-governmental international organisation with 164 national standards bodies. IS022301:2019 is an international standard used to outline how an organisation can best manage its business continuity by helping organisations respond to and recover from disruptions effectively (ISO, 2019). The ISO standard is extremely important to firms as it provides a benchmark and clear outline on how to implement a BCP as well as portraying how firms can best be prepared for a crisis. One of the research objectives throughout this thesis is to identify the different stages of a BCP and the ISO framework clearly details the stages a firm should take in order to possess a high quality BCP (See Table 1 below). Hilary Estall (2012), a member of the British Standards Institution (BSI) and a well-respected authority in management standards, defines the ISO 22301 standard as “an all-encompassing administration process that is utilised to guarantee that activities proceed, and that items and administrations are conveyed at defined levels”.
ISO22301:2019 replaced the IS022301:2012 version in order to reflect changes in the business world and to bring more value to its users. The update in the standard reiterates Hiles’ (2014) view that it is essential to keep up to date and make necessary changes to the BCP due to the ever-changing business environment. One major thing that distinguishes this standard from other managing systems is that it is internationally accredited for and thus companies that are implementing this standard can provide their clients, shareholders and owners with assurance of their due diligence. The ISO22301 standard provides for requirements that can be applied to all organisations regardless the industry and company size.
The standard provides for detailed and specific requirements in seven different areas. The table below concludes the key parts and requirements of the standard:
Key content and overview of the requirements
4. Context of the organisation – Understanding the organization and its content
– Understanding the needs and expectations of interested parties
5. Leadership – Leadership and commitment
– Establishing business continuity policy
– Establishing the relevant roles
6.. Planning – Determining and addressing risks and opportunities
– Establishing business continuity objectives and how to achieve them
– Planning changes to the existing BCM system
7. Support – Determination of the necessarily resources for the establishment, implementations, maintenance and updating the BCM system
Persons doing work under the organisation’s control shall be aware of:
a) the business continuity policy;
b) their contribution to the effectiveness of the BCMS, including the benefits of improved business continuity performance;
c) the implications of not conforming with the BCMS requirements;
d) their own role and responsibilities before, during and after disruptions
8. Operation – Operational planning and control
– Business impact analysis and risk assessment
– Selection of strategies that consider options before, during and after a disruption
9. Performance evaluation – Monitoring, measurement, analysis and evaluation
– Determination of what needs to be measured and how
– Internal auditing
– review of the BCM system by the management
10. Improvement – Nonconformity and corrective action
– Determination of potential improvements to achieve the intended outcomes of the BCM system
Table 1. The ISO22301
The ISO22301 requires several mandatory documents and processes to be met by a company if they are wishing to be accredited for the standard. Some may argue that the time and cost to meet the criteria in order to implement this standard may not be worth it. However, the ISO22301 provides several benefits including compliance with legal requirements, thus reducing the number of potential fines, obtaining a competitive advantage by reassuring shareholders they will be able to deal with a crisis, as well as improving business performance and resilience by being able to prevent any large-scale damage. The standard can be implemented by large or small companies and the framework provides companies with valuable insights to their company with a clear and detailed view of how their company truly operates.
The awareness clause (ISO22301 Clause 7.3 listed in Table 1) in the standard reaffirms the need for those under the control of the organisation to be aware of the BC policy and their contribution to the effectiveness of the business continuity management system (Estall, 2012). Therefore, proving Bloomberg’s (2018) theory about people and communication being everything in a crisis is true to an extent.
It is fairly common for the terms methodology and methods to be used interchangeably. However, this is not the case. Methodology is the series of steps that are taken to collect and analyse data for a research project. It is usually referred to as the approach or paradigm that supports the research (Blaxter, Hughes and Tight, page 59, 2010). It is considered to be important that a methodology is replicable so that it can provide valid and reliable data. Whereas the term method can be used to relate to the tools of data collection and analysis (Blaxter, Hughes and Tight, page 59, 2010). This chapter presents the research methods that were utilised in the research and offers a justification for their selection. Among the areas discussed in this section are data collection, analysis, reliability and validity, ethical issues’ and limitations of the study.
The research approach is based on a research philosophy that is suited to the needs of the research. The research used throughout this project will follow the pragmatism philosophy paradigm (Kumar, 2005). Pragmatism argues that the truth is what ‘works’. Therefore, using this position means selecting the most practical methods and it typically involves using more than one method and research strategy. In pragmatic philosophy, the research begins with a problem and provides a practical solution (Kumar, 2005). This approach was selected because of its flexibility and its proven ability to generate a rich set of data.
Concerning data evaluation, there are two approaches, the deductive and inductive approach (Cresswell, 2002 ). The deductive approach starts by developing a hypothesis and then seeks to confirm or reject it with the data gathered. The inductive approach again seeks to develop a theory from the data that has been gathered. Within this research, as it is a new topic researched with no prior knowledge of the topic area, a combination of the two approaches was used. The inductive approach was primarily used for this study as it allows the data to be explored freely and to develop a new theory (Thomas, 2006). However, there was need to refer to the deductive approach as there will be comparisons with existing literature on the topic. One primary purpose of using the inductive approach allows for establishing clear links between the research objectives and the findings derived from raw data (Thomas, 2006). This is necessary for this research as the research objectives mentioned previously in this thesis aim to provide a correlation between how UK retail companies operate and gain an advantages/disadvantage in relation to implementing a BCP. The correlation can only be determined from the findings of the raw data sourced.
3.1 Research design
The research design was based on the selection of data to be collected and analysed. There are two main types of data. Quantitative data, which is in the form of numbers and measures and describes phenomenon (Saunders et al, 2012). It is often associated with the scientific method and grounded theory which is where data is usually collected from observations, the data can be measurable, and it can be used to test a hypothesis (Mason, Page 196, 2002). Quantitative data is widely seen as more objective meaning that the data can generally be proven to be true or not and can be conclusive. However, quantitative data generally cannot produce new theories. In contrast, qualitative data is seen as being subjective as the data retrieved cannot really be proven conclusively. Qualitative data is information in the form of words and is concerned with how people interpret their experiences and construct meaning (Creswell, 2002).
A mixed method was selected because it allowed an in-depth investigation of BCM and BCP frameworks to analyse and determine whether UK companies were planned for such a crisis as Covid-19 and to identify and construct the advantages that an implementation of a BCP can create for a company. Moreover, a mixed method can produce new insights from sources that are often overlooked (Cresswell, 2002). This study was exploratory, in that it seeks to develop new findings and insights about a situation (Kumar, 2005).
3.2 Research methods
The inclusion criteria of this research changed throughout the process due to difficulties obtaining the required data. Initially, the inclusion criteria consisted of senior staff members who had extensive knowledge of business continuity and whom were involved in the business continuity management process for their company. However, after attempting to contact this personnel it was found to be to difficult due to the severe lack of responses and communication. Only one response was retrieved after contacting thirty potential respondents that fell into the inclusion criteria. One possible explanation for the lack of responses could have been that the potential respondents were too busy to respond due to the COVID-19 situation. As a result, it was clearly evident that it would take too long to gather the required data and therefore, the inclusion criteria needed to be expanded. Expanding the inclusion criteria is unfortunate as the data yielded may not provide the best representation in contrast with the previous inclusion criteria. However, it was a necessary change to implement into this research process.
The inclusion criteria of this study consisted of staff members who had a firm position in their company. For example, they had been working for their company for over one year. As well as, staff members who had prior knowledge of the related field of study, by understanding what BCM and BCP frameworks were and being aware what business continuity management is. Staff members who had been at the company less than one year or/and who had no knowledge of the field of study would be excluded from the research study.
The research methods were selected based on the needs of the research question and objectives. The first step was to develop a sample that could provide reliable and relevant information. A sample is a phenomenon or a group that is studied to provide in-depth and accurate information for research purposes (Kumar, 2005). There are two types of sampling strategies available to generate samples, random and non-random strategy. They differ in that the random strategy seeks to recruit sample that is not based on any criteria other than convenience, whereas the non-random strategy seeks to identify a particular group. A non-random purposive sampling strategy was chosen so that an appropriate sample population could be generated (Saunders et al, 2012). This involved the development of inclusion and exclusion criteria to ensure that only those with knowledge of BCM and BCP frameworks as well as crisis management were invited to participate.
The next step was the development of a research instrument. This project utilised the survey method and used a mixed style, via multiple choice questions, Likert scale questions and open-ended questions. Qualitative data was obtained via open ended questions. Open ended questions are a set of questions that require more than a yes or no. The questions are designed to prompt the participants to reflect on the questions and to provide a reasoned response. This was the rationale for the selection of this research instrument as it can provide rich data and new perspectives (Cresswell, 2002). On the other hand, quantitative data was obtained via Likert scale questions. A Likert scale rating allows for easy interpretation of the responses into quantitative data and shows the average behaviour and attitudes of the respondents. The questionnaires aim was to find out how UK retail companies are currently operating, how they are behaving and how they are responding amid this COVID-19 pandemic.
The structured questionnaire was selected because it offers participants limited choices concerning their answers and therefore can help to provide the research with accurate findings (Cresswell, 2002). The questions of the questionnaire have been developed based on the research question after a review of the secondary literature. There needs to be a systematic approach to the collection of information regarding BCM and BCP frameworks and the different stages of a BCP. For this study, a cross tabulation analysis method was selected to analyse the data from the Likert-scale, as well as a thematic analysis approach was selected. This is a recognised qualitative data analysis strategy and it involves the identification of patterns in a data set (Kumar, 2005).
3.3 Data Collection
Data collection is the gathering of data that is relevant and reliable and is of a sufficient quality to meet the high standards expected in a research project. This research has primarily taken advantage of primary data. Primary data i.e. raw data is collected by the researcher by utilising different research methods. In this case, primary data was collected via the questionnaire. Secondary data is the already existing data from articles, documents and textbooks (Kumar, 2005). Secondary data was used in order to gain a better understanding of the topic area however it was not utilised throughout this research.
The research sample was generated by the researcher who contacted potential participants via email. In total, 200 retail companies were contacted to ensure a high enough response rate, which is essential so that the data collected is representative and not skewed by outliers. The retailers contacted were provided with an information sheet and their informed consent was sought (Kumar, 2005). Once a suitably sized sample was developed, the researcher circulated the structured questionnaire. An internet questionnaire normally provides a high quality of data with a fast response rate (Bachmann, 1996). However, an internet questionnaire may provide difficulties with obtaining data as there may be limited responses (Kumar, 2005). As a result of this limitation, the questionnaire needed to be quick and easy to complete for the participants. The questionnaire was sent directly to the participants via email. The participants used the information sheet to help them complete the questionnaire and once all the questionnaires had been completed the participants responses were available to see online. They were safely secured and the most important points in the surveys were extracted and they were formed into a transcript that facilitates their further evaluation as recommended by Kumar (2005).
3.4 Ethical issues
Every research project must be ethical (Cresswell, 2002). The researcher adhered to the ethical guidelines of the accrediting institution. The researcher did not engage in any deception and the data collected was only used for academic purposes and not for commercial or any other purposes. Any data retrieved will be protected and will comply by the law of the Data protection act 2018. The informed consent of the participants was collected, and the structured questionnaire was accompanied by a participant briefing letter. This letter also allowed for the debriefing of those who participated in the survey. The participants only gave their consent after they had familiarised themselves with the research and its objectives (Easterby-Smith, et al, 1998). It was agreed with the participants that they could withdraw from the study at any time.
Ensuring confidentiality and privacy of the participants was a priority for the researcher. The participants identity was not revealed in the study and their details were not shared with others. The data collected was anonymised, so that the respondent and the response can only be connected by the researcher.
3. 5 Reliability and validity of the study
Reliability refers to the ability to produce consistent measures each time (Kumar, Page 278, 2005). Reliability of the research was assured by utilising a research design based on a mixed method, collecting primary data and gaining insights into the related field via secondary data from credible sources . Validity can be detailed as the extent to which to which the data collection methods accurately measure what they were intended to measure (Saunders, Lewis and Thornhill, page 248, 2019). The data collected was valid because the structured questionnaire was based on the research question (Kumar, 2005). To ensure that the data collected was representative, the purposive, non-random sampling strategy was selected (Kumar, 2005). This ensured that only those who have an interest in the research area were invited to take part. In order to ensure reliability and validity the respondents were recruited via LinkedIn as it allows for easy communication and it allows the researched to find suitable respondents in the retail sector. Further on, a couple of screening questions were asked to see if the potential respondents were suitable to be included in the study. For example, one question asked was if they understood and were aware of the concept of business continuity management. Those who had no understanding were excluded from the study. Thematic analysis was employed to ensure that the data was evaluated as objectively as possible. Bias is always a risk when it comes to collecting data and to minimise the threat of subjectivity, the researcher took a critical approach to the primary and secondary data that was collected (Cresswell, 2002).
3. 6 Limitations
Limitations are a necessity for every research. In this research the study sample was chosen
to be in the retail sector area. As a result of retrieving data from the retail sector, there are limitations as results can vary across this industry therefore it is difficult to generalise across the industry. For example, different companies have been affected differently which is shown in the research. A flower shop and barber shop can yield completely different results to a fast food shop and so on. Although diversity can be connected to the representativeness of the data, the restricted scope of the sample provides for more accurate and reliable data in terms of reflecting the research objectives. Additionally, if the sector were to cover all of the industry sectors in the UK the data could not be compared and as the impact of COVID-19 varies between sectors, the reliability of the study would not be reliable.
Another limitation is that due to the current COVID-19 pandemic it may be harder to retrieve responses in order to gather primary data which was the case for this research study. The mixed-method approach is one that combines both qualitative and quantitative data (Easterby-Smith, et al, 1998). It is evident throughout this research that various approaches have been implemented to conduct the gathering of data. As with only using one approach, there are several limitations thus increasing the difficulty of interpretation (Cherryholmes, 1992). This research design may have allowed for more data to be collected and triangulation. However, practical issues related to the current COVID-19 meant that this was not feasible.
4 Data Analysis and Discussion
This section presents the findings from the survey and discusses the findings whilst reflecting on the theory presented in the literature review. 200 retail companies were invited to take part and 76 responses were gathered; thus, the response rate of the study was 38%. A further 9 responses were incomplete and therefore withdrawn from the study as they could not provide reliable data. The vast majority of companies had a BCP plan. Out of the 76 responses, 41 of the companies had more than 100 employees whilst the rest had less than 100 employees.
The first part of the survey concerned the general planning for risks by retail companies in the sample. The literature is unanimous in stating that there is a need for some sort of risk management plan and that a BCP is recommended because of its flexibility and responsiveness to a crisis. The sample was asked the question did they have a written Business Continuity Plan (BCP ) and a great many answered negatively 21.1%. Further on, 11.8% of respondents did not know if their company had a BCP which is very worrying. For the purpose of this research, respondents who answered “Don’t know” will be classed as company that do not have a BCP. It was then discovered, retailers who did have a plan failed to update it regularly and in general, many of those who have a BCP, have one that was often several years old. It was found that just under 50% of those with a plan, did not update their plan at least twice a year and this was particularly the case with retailers under 100 employees.
This is a concern given the changing profile of risk in the world. The literature all agrees that it is important that BCP’s are updated or else they are likely to be rendered ineffective. Venclova, Urbancova, and Vydrova, (2013) state that a successful business continuity plan is fundamental to re-establish organization tasks, ensure the organization’s fame, and limit the danger of genuine budgetary misfortune in a calamity, and failure to update the plans means that many companies are not able to deal with the problems caused by COVID.19
The finding seems to uphold the view of Systems (2012) who believes that companies do not invest in preparing for unknown threats as they would rather wait for it to happen then defend. This is somewhat borne out by the findings. Morwood (1999) believes a BCP can help ease the human and financial stresses over the organisation by providing an alternate pathway for business transactions to take place. However, it seems based on the findings that some companies without the plan felt that they did not need one and they could meet the contingencies of the COVID pandemic by reacting to events and being flexible.
The survey found that firms with more than 100 employees were more likely to have a plan and this means that smaller retailers are more vulnerable in times of crisis, which has been noted in the literature. One important finding was that those respondents rated their preparedness for a crisis on a scale of 1-10 . The ratings selected from each option was quantified and turned into statistics. Retailers with a BCP had an average rating of 5.88, meaning they were somewhat prepared. Whereas, retailers without a BCP had an average of 3.24 indicating they were unprepared. However, a 5.88 rating does not denote a particularly high rate of preparedness and may show that their business continuity plans were not fit for purpose (Morwood, 1999).
All stakeholders in an organisation must be aware of the plan so that it can be successfully implemented . It was found that the majority of the retailers (52.9%) did not distribute their BCP widely and denotes that they are hierarchical organisations. Further on, when asked about the organisations level of staff training towards implementing a BCP plan, 31.2% of retailers responded with a score of 5 or below out of 10 indicating their BCP plan would not be successfully implemented. The scores range tremendously, however there are some very low scores and therefore this is a serious failing and means that even some retailers who have a BCP are not conforming to the ISO22301:2019 criteria .
It is recognised in the literature that a BCM has a specific and dedicated group of people who are trained to manage risk mitigation efforts in a scenario such as COVID 19. Johnson (2019) and Hotchkiss (2010) have both recognised the importance of this. The majority of those with a BCP plan do have a dedicated team (56.9%). They are appointed to oversee the continuity of a business and to source alternative supplies or revenues. This is a crucial success factor for any business continuity plan.
The next question sought to understand if the BCP was developed in light of past crises. The results were mixed as 25.5% did not actually know if their BCP was developed due to a past crisis or not. However, 46.9% of the respondents believed that this was the case, stating that they had learned from past crises. This was especially the case with businesses with over 100 employees. One of the surprising finds was that few in their BCP had foreseen the need to deal with a pandemic such as COVID 19. Only 7.8% of those with a plan had considered the possibility of a global pandemic whereas 31.4% had somewhat foreseen it. In contrast to retailers without a BCP, a massive 92% had not foreseen a possibility of a global pandemic with 8% somewhat foreseeing it. This is something that is recommended, as not every eventuality can be planned for and instead the company should focus on potential disruptions to key operations such as supply chains in general terms (Cerullo and Cerullo, 2004).
The next question was how did the current pandemic impact your operations. The majority of the respondents with or without a BCP, showed that it had severely disrupted their business. When asked to rate the impact on their business, the average score out of 10 for firms with a BCP was 8.16 compare to firms without a BCP of 8.76. Both these figures are extremely high which portrays the severity of the crisis. It was also apparent that out of the retailers who took part in the study, that smaller businesses were more likely than larger businesses to be severely impacted. This is in line with the findings by Botha and von Solms (2004). The resulting figures are very similar for businesses with or without a BCP, indicating a BCP may not be of importance, as firms that possess a BCP will still be heavily impacted. However, this can be argued due to the scale of disruption as all firms will be impacted. Also, perhaps possessing a BCP will be of greater importance to deal with the aftermath of the impact, the results further on will shed light on to this matter.
The next question sought to understand if a BCP helps a company to function effectively during the pandemic. Of those who had a plan, they rated their performance during the crisis as 5.78 on average. In contrast, firms without a plan rated their performance during the crisis as 4.12 on average. This is evidence that a BCP acts as a support system during a crisis, which is supported by (Venclova, et al, 2013). Those who stated that they had a dedicated team to implement the plan reported even higher findings (8.4 rating). This finding was particularly evident concerning firms who have over 100 employees. There was also a correlation between those who regularly updated their plans and a higher score about functioning effectively (9.2 rating), which is aligned with the findings of Cerullo and Cerullo (2004). This clearly shows the benefits of a BCP plan.
The next question sought to understand the difficulty faced by the retailers when they were finding alternative ways to operate amid the pandemic. It was discovered, some 86.3% of them who had a plan were able to continue operations. Whereas 13.7% could not find alternative ways to operate and as a result had temporarily closed down their operations. A further on open-ended question was asked to see how firms are currently operating. The responses were interpreted as 81.8% of respondents stated they are following COVID-19 guidelines and restrictions in stores. A further large percentage of respondents stated they are focusing on the home delivery market and finally the smallest percentage said they are working from home. As the chosen sample is retail firms it is understandable not all retail firms can operate from home compare to other industries which explains the smallest percentage response.
Retail firms without a BCP were also asked the same question. 72% of retailers managed to find alternative ways to operate whereas 28% were not able to continue operations. Once again, there were similar responses in how firms are currently operating with the largest response being “following COVID-19 guidelines and restrictions in store.” (77.8%). Retailers who managed to find alternative ways to operate were then asked on a scale whether their current operations were improvised (1 on a scale) or prepared beforehand (10 on a scale). The results were very interesting, as firms with a BCP responded with a huge range of responses. Firms with a BCP had an average score of 5.7 showing they were not prepared beforehand as much as a BCP should make you prepared. Possibly providing the researcher with a signal that many of the BCP’s possessed by the firms could be classed as useless due to many firms having to completely improvise. However, COVID-19 is a huge disruption therefore many firms BCP’s may not have been able to deal with such a large event therefore they had no choice but to improvise as no level of preparing would have been able to deal with such an event. As expected, firms without a BCP had a lower average score of 3.22 indicating they did not prepare their current operations before the crisis and relied heavily on improvisation.
One of the key aims of any BCP plan is the ability to safeguard existing revenue sources and to maintain the profitability of the company. This is acknowledged as the main criteria of success for a company (Smith, 2013). The participants in the study were asked to rate their level of sales amid the pandemic where 10 represented an increase in sales and 1 represented no sales at all. Firms with a BCP had an average of 4.55 whereas firms without a BCP had an average of 3.35. Once again both ratings are very low which is understandable due to the severity of the crisis. However, retailers with a BCP are not as badly affected when it comes to sales which portrays the importance of possessing a BCP to maintain operations. Smith (2013) believes that the impact on corporate profit is seen as the best indicator to assess the severity of a crisis. However, it should be noted that firms may not see the benefits of a plan during the midst of the COVID Pandemic (Hiles, 2014).
An important question regarding whether retailers thought by possessing a BCP they were better equipped to deal with the crisis as oppose to not possessing a BCP was asked. The average rating for this question was 6.7 with 19.6% of retailers voting a strong 10 rating. However, some respondents voted very low as they believed their BCP did not help them at all as due to the magnitude of the crisis they were unable to continue operations so there was no point possessing a BCP in regard to this pandemic. It was found, the majority of respondents who answered low also had low distribution scores, as well as low staff training scores and they did not regularly update their BCP. There were several positive correlations between the responses for this question and earlier questions regarding the company’s operations. Retailers without a BCP were also asked a similar question. They were asked to what extent do they agree that if they had a BCP their companies’ performance would have been better during the pandemic. The average score for this question was 7.2 which is considerably high. Therefore, indicating retailers without a BCP believe if they did have one, they would have been in a better position to deal with this pandemic.
One important question was concerning the ISO 22301 certification. It was found that the vast majority of companies who had a BCP were not certified to ISO level. The results show that only 11.8% of respondents were ISO certified as seen in the graph below. Whereas 27.5% of firms that have a BCP didn’t even know if they were ISO certified and 60.8% of firms were not ISO certified. This is extremely high and indicates that just by having a BCP it does not denote that you are in an advantageous position over a firm with no BCP as it is the importance of implementing the BCP that is a true indicator of whether firms are in an advantageous position. Rothstein (2007) clearly states “An unexercised plan could be worse than no plan at all as you won’t know if you can depend on the plan”. The 11.8% of respondents were clearly in a better position than the others as their overall scores regarding all questions were considerably higher, proving that ISO certification is an important feature of a company and should be part of the company, not just an “add-on” (Elliot, Swartz and Herbane, 2010).
Even among those companies with dedicated teams and who regularly updated their plans found that they did not have ISO certification. This may mean that the BCP plans that have been developed by these companies are not suitable and will not help a business to stay operational and return to profitability (Hiles, 2014: Morwood, 1999).
The primary data showed that many retailers have developed a BCP and that they have helped somewhat in the current COVID 19 pandemic. This was particularly the case when it comes to big firms. However, for many firms, the problem is the BCP could have been better framed and implemented by distributing it further, training staff and regularly updating it as the results showed firms that do all of the above have performed better during this pandemic than firms who haven’t.
5 Conclusion and Recommendations
The aim of this research has been the examination of business continuity management in the light of the COVID-19 pandemic. More specifically, the objective of the research was to identify the main BCM and BCP frameworks and to analyse whether UK companies were planned for such a crisis as Covid-19 and to identify and construct the advantages that an implementation of a BCP can create for a company.
First the theoretical framework was established. The literature review of this thesis utilised relevant literature from the field, displaying BCM as an evolving and maturing discipline. Currently, BCM can be considered as a holistic strategical tool for companies to ensure the functioning of operations and to build day-to-day resilience. The ISO 22301:2019 standard is an internationally accredited standard of BCM. The ISO 22301:2019 provides for specific steps and requirements that a company must take in order to receive a certificate. The vast majority of authors in the field of BCM see BCM and BCP as an important strategic tool for companies. Nevertheless, there exist opposition in terms of the usefulness of BCM . The main argument opposing BCM relies on the unexpected nature and content of crises and thus the usefulness of BCM is contested.
After the establishment of the theoretical framework, the research on the topic was concluded. Primary data was collected and analysed for the purpose of the research objectives. The research adopted a pragmatic and inductive research approach. The sampling strategy was a non-random and purposive approach, as the study sample was limited to UK retailers. To collect primary data a structured questionnaire was designed to collect qualitative data and turn that data into a quantitative form (Saunders et al, 2012). The data was evaluated thematically. Reliability and validity were ensured by using a systematic and critical approach. This research was ethical, and it sought to protect the privacy and wellbeing of the participants. Limitations to the project were acknowledged and steps were taken to minimise their impact on the validity and reliability of the data and analysis .
The findings drawn from the primary data support the stance taken by the majority of authors in the field. Implementing BCM and having a BCP provide for more resilience and capability to continue business operations during crisis situations. The UK retailers with a BCP were much more prepared for a major crisis such as COVID-19 compared to UK retailers without a BCP. Further on, as retailers with a BCP were more prepared, this resulted in their operations not being severely affected compared to retailers without a BCP, which was portrayed throughout the primary data collected. Nevertheless, during a pandemic such as COVID-19 it needs to be kept in minding that companies cannot prepare or protect themselves against certain governmental restrictions such as the “lock-down” stage .
The primary data gathered also identified current trends for UK retailers, as the responses signified what measures UK retailers are taking in order to maintain operations. It was discovered that both retailers with a BCP and without a BCP were taking similar actions to maintain operations. The main finding from this section was that firms without a BCP were more likely to stop operations completely. One major issue in regard to BCM is the importance of implementation. The literature emphasises the point that a BCP must be implemented correctly and the findings from the primary data received seem to agree with this theory. The main pitfall of the companies is that BCM and BCP are not implemented at all. One reason behind the lack of implementation is that the BCP has not been integrated to the company properly and thus the BCP has just remained as an ill-fitted tool .
The majority of retailers that took part in the survey possess a BCP (67.1%). However, the level of updating and reviewing, the distribution of the BCP and the management of the BCP ranged an incredible amount between the respondents. 49.1 % of the respondents did not update and review their BCP accordingly, 43.1% did not know or did not have an assigned business continuity management team and 52.9% did not distribute their BCP accordingly. These findings clearly show a lack of successful implementation. Additionally, this indicates the lack of ability to meet the ISO 22301:2019 criteria. It is worth noting that many retailers who didn’t distribute, update and review their BCP accordingly actually suffered similarly or even greater than firms without a BCP.
The findings were clear in indicating the advantage of retailers who possessed the ISO 22301:2019 certification. Out of 76 retailers, only 6 of them met the ISO criteria. However, what is noticeable is that these 6 retailers had the highest average scores on preparedness, staff training, maintaining operations and scored a low rating on the overall impact of COVID-19 on their company.
In general, the findings presented that smaller firms are less likely to have a BCP than larger firms. According to the literature it is smaller firms who are more vulnerable to different disruptions and therefore not possessing a BCP could be distressing depending on the circumstances. Only 45.7% of retailers with less than 100 employees had a BCP. In contrast, 85.3% of retailers with over 100 employees had a BCP.
The literature on BCM and the research study concluded as a part of this thesis support the importance of having a BCM system and a BCP. Furthermore, the survey concluded in the UK retail sector highlights the benefits and competitive advantage that a company with a BCM system can have. Nevertheless, this research has also taken into account that even a BCM system cannot protect the continuity of operations in every situation. The COVID-19 pandemic has shown that a disruption can even lead to the lock down of the world. However, finding alternative ways to continue operations and ensuring the safety of the staff is also a key part of the BCM system. Companies that have had a BCM system in place have at least in theoretical level been prepared to continue operations on all levels of the company.
As mentioned, BCM is a maturing field. This research has been limited to the retail sector only, providing insight on a narrow field. Further research on this topic is highly topical and arguably very essential in terms of future disruptions. By collecting and providing data from different sectors and comparing results, companies could be in a better position in the future. Learning from the past is essential in order to thrive in the future .
Advisera (2020). The basics of ISO-22301. [online] Available at: https://advisera.com/27001academy/what-is-iso-22301/ [Accessed 1 July 2020].
Bachman, L.F. and Palmer, A.S., 1996. Language testing in practice: Designing and developing useful language tests (Vol. 1). Oxford University Press.
Blaxter, L., Tight, M. and Hughes, C. (2010) How to Research. Maidenhead: McGraw-Hill Education (Open UP Study Skills).
Blyth, M., 2009. Business continuity management: building an effective incident management plan. John Wiley & Sons.
Bounds, A (2020). Coronavirus claims thousands of UK businesses. [online] Available at: https://www.ft.com/content/5d198135-b38f-4512-b611-9f017f76929d [Accessed 28 June 2020].
Botha, J. and Von Solms, R., 2004. A cyclic approach to business continuity planning. Information Management & Computer Security.
Cerullo, V. and Cerullo, M.J., 2004. Business continuity planning: a comprehensive approach. Information Systems Management, 21(3), pp.70-78.
Cherryholmes, C.H., 1992. Notes on pragmatism and scientific realism. Educational researcher, 21(6), pp.13-17.
Christensen, S.L. and Kohls, J., 2003. Ethical decision making in times of organizational crisis: A framework for analysis. Business & Society, 42(3), pp.328-358.
Cresswell, John (2002). Research Design: Qualitative, Quantitative, and Mixed Methods Approaches. Sage: New York
Easterby-Smith, M. Thorpe, R. and Jackson, P.R. (2008), Management Research, Third
Edition. London: Sage.
Elliott, D., Smith, D. and McGuinnes, M., 2000. Exploring the failure to learn: Crises and the barriers to learning. Review of Business, 21(3/4), p.17.
Elliott, D., Swartz, E. and Herbane, B., 2010. Business Continuity Management 2e: A Crisis Management Approach. Routledge.
Estall, H., 2012. Business continuity management systems: Implementation and certification to ISO 22301. BCS, The Chartered Institute.
Federation of Small Businesses (2020). Coronavirus (COVID-19): Advice and guidance for small businesses and the self-employed [online] Available at: https://www.fsb.org.uk/campaign/covid19.html [Accessed 28 June 2020].
Glendon, L., 2013. A winning combination: The 3Cs of business continuity. Journal of Business Continuity & Emergency Planning, 7(1), pp.44-55.
Herbane, B., 2010. The evolution of business continuity management: A historical review of practices and drivers. Business history, 52(6), pp.978-1002.
Hiles, A., 2014. Business continuity management: Global best practices. Rothstein Publishing.
Hotchkiss, S., 2010. Business continuity management: In practice. BCS, The Chartered Institute.
International Standards Organisation (2019). ISO-22301 – Business Continuity. [online] Available at: https://www.iso.org/publication/PUB100442.html [Accessed 28 June 2020].
IRM Association, 2018. Emergency and Disaster Management: Concepts, Methodologies, Tools, and Applications.
Jones, V.A., 2011. How to avoid disaster: RIM’s crucial role in business continuity planning. Information Management Journal, 45(6), pp.36-41.
Kumar, Ranjit (2005). Research methodology a step by step guide Sage: New York
Mason, J., 2002. Linking qualitative and quantitative data analysis. In Analyzing qualitative data (pp. 103-124). Routledge.
Morwood, G., 1998. Business continuity: awareness and training programmes. Information management & computer security.
Myers, K.N., 2006. Business continuity strategies: Protecting against unplanned disasters. John Wiley & Sons.
Rothstein, P.J. ed., 2007. Disaster recovery testing: Exercising your contingency plan. Rothstein Associates Inc.
Saunders, M., Lewis, P. & Thornhill, A. (2019) Research methods for business students. 8th edn. Harlow: Pearson.
Saunders, M, Lewis, P and Thornhill, A (2012) Research Methods for Business Students,6th edition, Pearson: New York
Smith, K., 2013. Environmental hazards: assessing risk and reducing disaster. Routledge.
Staples, J., 2006. A new type of threat. Harvard business review, 84(5), pp.20-22.
Systems, Sumtotal, (2010). The CEO’s Guide to Succession Planning: Managing Risk & Ensuring Business Continuity. Available at SSRN: https://ssrn.com/abstract=1633523 or http://dx.doi.org/10.2139/ssrn.1633523
Thomas, D.R., 2006. A general inductive approach for analysing qualitative evaluation data. American journal of evaluation, 27(2), pp.237-246.
Toft, B. and Reynolds, S., 2005. Learning from Disasters: A Management Approach.
Venclova, K., Urbancova, H. and Vydrova, H.V., 2013. Advantages and disadvantages of business continuity management. International Journal of Industrial and Systems Engineering, 7(4), pp.895-899.
Weems, T.L., 1999. Business continuity planning-for the rest of us. Disaster Recovery Journal.
Worthington, W.J., Collins, J.D. and Hitt, M.A., 2009. Beyond risk mitigation: Enhancing corporate innovation with scenario planning. Business Horizons, 52(5), pp.441-450.
Figure 2- Questionnaire for participants who answered yes to Question 1
Figure 3- Questionnaire for participants who answered No/Don’t Know to question 1