Business Continuity Management - Case Study Example

This report is a presentation of the business continuity management (BCM) process for the Morrison supermarket. It provides a critical analysis of operating environment and stakeholder, examines the critical activities of the supermarket, and evaluates the maximum tolerable period of disruption. It includes time recovery objectives, critical dependencies, and strategies for maintaining dependencies or critical activities as well as a media strategy for internal and external stakeholders. It also shows various arrangements such as critical dependency monitoring, plan invocation, generic response for managing disruption, and arrangements for embedding the plan into the day to day management systems and organization culture as well as plan development, review and training arrangements. Operating environment and stakeholder analysis Morrison supermarket is a public limited company that operates a chain of supermarkets within the United Kingdom. The company, which is commonly known as Morrisons, is listed under the London Stock Exchange (Wm Morrison Supermarket PLC 2004). It has 403 superstores that are all located within the United Kingdom. The supermarket recognizes six areas of the United Kingdom in which it conducts its business. These are Scotland, North area, Midlands, South East including Gibraltar, South Central, and South West. Morrisons does not provide a service for online-based home delivery, as with many large supermarkets in the UK. The organization has a decentralized structure such that people at the bottom of the organization power structure can make decisions about the supermarket’s day to day operations. The decision making process also avoid the bureaucratic structure common in a number of large organizations. The company has a main board and a junior board with the chairman and managing director (MD) representing the highest level of command. The main board comprise of the chairman, MD, Deputy MD, Finance Director and company secretary, Store Operations manager, Trading Director, and property director. The other levels of the organization structure include the district managers, store general manager and other four levels of store organization. These are categorized under direct store management. The supermarket has a number of both internal and external stakeholders. The internal stakeholders include the staff and the management team, and shareholders. On the other hand, its external shareholders are its customers, business partners, suppliers, creditors and debtors, the local council, and the UK citizens and government as well as other agencies and individuals that have a role in the operations of the supermarket. Critical activities and maximum tolerable period of disruption Morrison supermarket has a number of services that are critical to its business operation such that if disrupted they have the greatest impact in the shortest time. To start with, the main activity of the supermarket, which is retail of goods and services, is critical. The retail services includes catering services, retail of pharmaceutical products, fuel and gas retail, and photo processing services (Morrisons). The supermarket also provides services for people with disabilities like wheelchairs, staff assistance, dedicated parking, seating and induction loops as well as support for its customers (Morrisons) that are critical in the operation of the supermarket. The operation of the supermarket is supported by a number of activities that are also critical to its functioning. These include activities related to finance and cash flow such as financial reporting, insurance coverage, banking activities and credit repayment, payroll activities; regulatory and legal related activities including government compliance and contractual agreements (Hiles 2007, p. 356); and other activities such as status report production, supply of merchandise and other items, distribution of goods to customers, check out and point of sale (POS) services, more so the recording and backing up of sales information, marketing and sales promotion. A number of activities are also essential in supporting the recovery of the business operations in case of a disaster or crisis. These include backing up various company data and information in strategic locations; inventory of various company’s assets, including company properties and premises as well as staff, managers, and directors; and developing, reviewing and testing a business continuity plan (BCP) manual for the supermarket. Back up of sales and financial data is also important. The maximum tolerable period of disruption (MTPoD) is an important aspect for the supermarket in recovery from and management of a crisis. This period is dependent on the kind of business activity in consideration. The MTPoD for retail services is about 48 hours and should not extend into weeks to prevent loss of income and customers. Financial reporting, status reporting, insurance activities, banking activities, credit repayment, and payroll activities are tolerable within a month’s time. The resumption of legal and regulatory activities depends on the government provision. The MTPoD for back up of important information such as sales, and activities such as check out activities is also very critical and should be in terms of hours as that of the resumption of retail activities. Recovery time objectives (RTO) The recovery time objectives represent the amount of time required for recovery from a crisis or disaster. For Morrison supermarket, the recovery time objectives are grouped into four tiers. The first tier RTO includes activities that should be recovered within 24 hours, while the second tier RTO represent objectives to be met within 48 hours. In the third tier, recovery time is between two to seven days, while the in the fourth tier, recovery time is more than a week. The first tier of recovery time objectives includes the following: Resumption of retail activities within 24 hours after the start of the disruption. The restoration of the check out and point of sales equipments and resumption of on-duty staff to their respective department within the shortest time possible and less than 24 hours. Ensure the system for backing up sales information is running before the resumption of retail activities. The customer support should be established as soon at the disruption starts to handle customer enquiries. The second tier RTOs include ensuring banking activities and payroll activities are resumed within a week’s time. The third tier RTOs include resumption of financial reporting, status reporting, insurance activities, and credit repayment within a month’s period. Critical dependencies Morrison supermarket has a number of dependencies that would be critical in recovery from a crisis. People provide support to various systems and functions. For instance, the company staff and management are essential in the operation of the supermarket. They are organized as follows: The managing director and the chairman of the supermarket are the highest in command, and who together with the deputy managing director and four directors constitute the main board (Hiles 173). The four directors include the finance director who is also the company secretary, store operation director, trading director, and the property director. Directors in charge of various functional areas constitute the junior board. District directors and store general managers represent the direct management. This hierarchical structure of decision making is set up such that junior staffs act on orders from their seniors. Therefore, junior and district directors depend on the main board for directive, while the general store managers get orders from the district directors. The individual staffs at the bottom of the power hierarchy ladder have to wait for directives from the store managers before they can proceed with any work, especially if it is out of the ordinary. On the other hand, the senior management depends on their juniors to implement their decisions. There are also technical dependencies that are critical for the organization’s recovery. The company rely heavily on information communication technology (ICT) to support various functions. IT systems are used for information/data capture, storage, back up and processing as well as in security, personnel management and payroll processing. Both radio communication and telecommunication infrastructures are also critical. Therefore, providers for ICT services including software and hardware are therefore critical dependencies. Other stakeholders, including shareholders, suppliers and customers are also critical dependencies. The business needs customer and suppliers to survive, while shareholders are essential in decision making. Other dependencies include buildings, vehicles, merchandise, fuel, and food. People require food, while vehicles and machines require fuel. Buildings provide cover to both people and goods. Strategies for maintaining critical activities/dependencies Strategies for maintaining critical activities/dependencies are grouped into seven categories. These include people strategies, premises strategies, technology and information strategies, and stakeholders’ strategies. Stakeholders include suppliers, customers, and shareholder, among others. People strategies Documentation of various procedures, including operations for handling a crisis is done and reference properly. Succession planning is essential to ensure decisions making is not affected when existing management is affected or lost through a disaster. The workforce is multi-tasked such that each staff is able to handle several distinct responsibilities in the supermarket. This is useful in filling positions that may become vacant if some staffs are affected during a crisis. Third parties are also used to provide supermarket functionalities that may be affected during a disaster, or if it is less costly than the supermarket’s own arrangements. Premises strategies In case of some areas of a premises is affected, alternative premises of the supermarket are used. If the entire premises is damaged extensively and deemed inaccessible, and there are no strategic premises within the supermarket, then alternative premises may be sought from a different company. Some departments such as accounting and marketing can be established in remote locations if their premises are affected. Technology and information strategies Technologies such as radio communication, telecommunication, and electricity are provided from outside the organization by a third party. Back up systems such as generators power back up, and using at least two different communication infrastructures is essential for resilience and reliability. Technology such as radio communication and Internet is also provided for remote access. Information is stored in both hardcopy and electronic media to increase reliability and chance of recovery in case of damage. Strategic back up of information is different locations is also effected to increase its security. Stakeholders’ strategies The number of suppliers is increased to enhance their reliability in proving stock, and especially when a crisis results in damage of merchandise. The supermarket also ensures that its suppliers have robust business continuity plans to increase their reliability even when they are affected by a disaster. Contractual agreements are provided to various stakeholders, including employees, customer, vendors and shareholders, and are flexible enough to allow the supermarket space for recovery in time of disaster. Stockpiling of supermarket merchandise is also done to reduce the risk of supply shortage and to cushion the effect of sudden price increases in the market. The relationship with various stakeholders is also managed through clear and heuristic procedures. Critical dependency monitoring arrangements The monitoring of critical dependency is conducted continuously and reported monthly to the senior management team. Plan invocation arrangements The invocation of the business continuity plan (BCP) is the responsibility of the managing director together with the main board. The board determines whether an emergency requires the invocation of a BCP. This involves assessing the situation in order to establish that the trigger points warrant the invocation of the plan. If the situation calls for the activation of the plan, the senior management team is convened and advised of the situation as well as the response and actions to take to mitigate the emergency effects. Once the plan is invoked, everyone in the organization is informed. The procedure for invoking the BCP is documented in a clear manner. The occurrence of an emergency is ascertained by authorized experts who must report to the board. This assessment is initiated by the board main board and the managing director. The intensity of the emergency determines the level of involvement in response and delegation of duties. For minor incidents, the deputy managing director can assume the responsibilities of the managing director if he is absent. However, serious incidents require that the managing director is available to provide directions and give response on behalf of the supermarket. 8. Generic response arrangements for managing disruption The response of a disruption is organized to make sure effectiveness and positive outcome. A crisis response team is constituted in times of an emergency. The team is lead by a designated person, who is normally the managing director. However, the managing director can delegate this responsibility to a competent and appropriate company staff. The roles of every participant in the response team are clearly defined. The team is responsible for the operations and coordination of activities as well as communication during the response. The team is in charge of the communications with the media and other stakeholders of the supermarket. However, a key person is clearly identified to address the media and other inquiries. These arrangements are clearly documented in the BCP, which must be activated for the response. The activation of BCP is the responsibility of the main board. 9. A media strategy for internal and external stakeholders The media is consulted to provide communication to both internal and the external stakeholders. The communication of an emergency should be objective and highly accurate to avoid spread of false information and causing unnecessary panic. The managing director is the supermarket’s spokesperson and media person, although he or she can appoint a person within the organization to represent him or her. In case of his absence, the person next in command takes charge. Official press releases are provided to by authorized persons, and media conferences convened at specified time interval to address various issues of an emergency. 10. Plan development, review and training arrangements The business continuity plan requires continuous development and maintenance. This involves publishing a manual of the BCP, training the staffs in relation to the plan, performing frequent tests on the workability of the plan, and reviewing its contents to eliminate the shortcoming identified. The development of the BCP involves all key personnel and all departments. The top management must buy in the idea of BCP, champion its role and commit to its development. Competent personnel are in charge of its implementation, while a steering group is also identified to lead the response. Effective testing the BCP is very essential. The requirements of the category one responders to make arrangements for an effective testing are specified. The aim of the testing of BCP is to validate it, rehearse key staff on its implementation, and testing the functionality of crucial systems. Staffs are trained on various aspects of the plan. These include contents of the BCP and their role in implementing the BCP. Crucial knowledge and skills necessary in the response of an emergency are also learnt in the BCP related training. The review of the plan must be comprehensive. It should include the personnel required in response of an emergency and their responsibilities during the response. It should examine the organization structures to ensure that they facilitate the implementation of BCP. It should also consider suppliers and contractors as well as a risk assessment and business objectives. Embedding the Business Continuity Plan (BCP) into the supermarket The BCP is integrated into the core values and day to day management processes such that it has direct influence on the every aspect of decision making. The senior management team lead the rest of the organization in its implementation. It is also a primary part of the employee performance requirements as well as the structured system of appraisal. Every briefing of the team on supermarket operations and processes should include the aspects of the plan. The plan is also marked as one of the most important components of the supermarket, and time is often set aside to instil its content into the supermarket employees. Conclusion This report presented the business continuity management (BCM) process for Morrison supermarket, and highlighted various issues. It has critically analysed the operating environment and stakeholder of the supermarket, examined the critical activities of the supermarket, and evaluated the maximum tolerable period of disruption for various activities of the supermarket. It has included the time recovery objectives, critical dependencies, and strategies for maintaining dependencies or critical activities, and provided a media strategy for internal and external stakeholders. It has also showed various BCM arrangements such as critical dependency monitoring, plan invocation, generic response for managing disruption, and arrangements for embedding the plan into the day to day management systems and organization culture as well as plan development, review and training arrangements. Reference list Wm Morrison Supermarket PLC 2004, Student information pack. Web. 5 April 2010, . Thompson, J & Martin, F 2009, Strategic Management 6th edn. Cengage Learning EMEA, [p. 25] Morrisons n.d., Store services. web. 4 April 2010, . United Business Education Association 1990, Business education forum, Vol. 45. The Association, United States. Hiles, A 2007, The Definitive Handbook of Business Continuity Management. John Wiley and Sons, New York. Read More