Business Continuity Lessons Learnt.

10 key questions to ask about your business resilience

For some it’s still a long way off, but for others, a return back to a normal life is starting to re-appear. Whilst the UK’s coronavirus lock down has been extended, others such as China, South Korea, Australia and New Zealand, are beginning to ease restrictions and allow businesses to return somewhat back to normal.

Whilst this is great news, and no doubt something businesses and employees alike are keen for, there are a few things we should do before we all race back to the office. As the Coronavirus / Covid-19 pandemic took hold earlier this year, many businesses suddenly found themselves in a world of chaos. For businesses that didn’t have robust continuity plans, such as the Australian Government where many departments still use desktop PCs, they were automatically on the back foot. Procuring laptops along with the other half of the world is a costly nightmare, and with every delay, the business’ reputation is taking a beating and the mountain of work further increasing over an already disrupted and exhausted workforce. For those with continuity plans, their credibility was tested, with desktop plans that were never tested or massively outdated, automatically falling some of the easiest challenges. For others, the plan may have stood up to a large degree, and for the rest, they crossed their fingers and hoped. So now that the initial carnage from coronavirus is over and we start what would be considered “business as usual” for some, audit (or the business), needs to take stock and evaluate everything that happened before we all forget and get caught up in our return to normal. Best practice says that after all major instances where a Disaster Recovery or Business Continuity Plan has been enacted, a lessons learnt session should be conducted. This is important to ensure any failings are not repeated and the business is better prepared for the next global pandemic (or other issues). There are many ways which a lessons learnt exercise can be ran, however it is important that opinions and insights are captured from all levels of the business; not just those at the top.

Here, we will break down some of the key activities which should be considered as part of your business continuity debrief / lesson learnt exercise:

Who:

All members of the business continuity team and Executives should be included. In addition, the company as a whole should be indirectly included as part of the debrief session (we will get to this bit below).

What:

Lessons learnt from the recent COVID-19 / Coronavirus situation.

When:

The debrief / lessons learnt exercise should be performed as soon as possible after the event to ensure nothing is forgotten about. In the case of coronavirus, the exercise should be held now before people become consumed with returning to the office and all the logistics that will involve.

How:

For business continuity committee members and executives, this should be performed as a forum. For all other team members, a survey should be sent to ensure the most responses are obtained from across the business. The survey should be conducted before the debrief session so that the results of the survey can be discussed and action taken as necessary.

The Debrief Agenda

There are so many ways you can cut and dice this, but to ensure that all basis are covered and everyone gets to show their perspectives, an agenda similar to the table below is a great starting point.

Business Continuity Debrief Table / Agenda

Such a table will also ensure that all members are able to speak and contribute equally. Furthermore, given any meeting is likely to be done via video chat, tools such as Microsoft Teams and WebEx have whiteboard functions which can be used to encourage contribution whilst making it interactive.

When developing a survey to be sent to the broader business, its important to consider both the business / operational elements, but also their personal wellbeing and how they how they feel they have been supported by the business. Key questions to ask would include:

• What systems could you not access / did not operate as normal which impacted your ability to work?
• How was your home set up?
• What tasks / critical activities could you not perform?
• Do you feel that management dealt with coronavirus well?
• Was there sufficient communication from management?

There are many more questions which can be asked. Depending on the size of your organisation, it is important that a survey be simple enough so that results can be quickly analysed, but still provide the opportunity for employees to voice any personal opinions. Situations such as this may already be impacting on employees perceptions of management, so it is important that any survey is also seen as a chance for employees to be heard and listened to.

Applying this to your internal audit team

For audit teams, there has been a significant amount of change. Disruption to audit plans, changes in the way fieldwork is completed, and being pulled into various other areas to either provide support or assurance throughout the pandemic, means such a debrief exercise is just as important.

The above table can still be applied to any internal audit business continuity debrief. Furthermore, all team members should be asked to provide feedback on how they felt and what they would like to have been done differently.

At the end of the day, for may of us, the days of going back to the office seem like they are still a long way away, but regardless of whether yo’re still in lockdown or about to return to the office, a debrief session is critically important to ensure audit (and the business) can improve and learn from our mistakes and ensure we are prepared for any future instances.