Circumstances over the past 16 months or so surrounding the COVID-19 pandemic, its global spread and the subsequent havoc that it’s wreaked on industries and businesses all over the world have served as a stark example of the possible disasters that can strike and the potentially severe impacts that they can have on operations. In tandem with this, it’s provided a monumental real-life case study, complete with a multitude of success stories as well as unfortunate tales of failure and loss, detailed with the factors that contributed toward each set of contrasting results. And, although retailers throughout the country are currently preparing to fully reopen to the public and welcome consumers into a post-pandemic retail environment, Stephen O’Keefe, industry expert and President of retail consultancy Bottom Line Matters, believes that they should also be preparing for the worst, revisiting their organizations’ business continuity plans to ensure the viability and capability of their operations during times of disruption.

“The industry has obviously been hit very hard by impacts of the COVID-19 pandemic,” he says. “The most obvious consequence has been a loss of sales during the past 16 months or so. However, the far greater and most detrimental result of the pandemic was the shutdown, at least in part, of the industry in cities and provinces across the country and the effect that it has had on people in communities everywhere. Everyone is impacted to some extent by retail. People are employed within the industry, providing them with a means to make a living. And people shop at retailers to purchase the items that they need. We saw when the pandemic hit that there were many retail operations that were not able to continue running anywhere near the levels that they could have been running at if they had been prepared. It’s such an important industry, serving a significant role in propping up the Canadian economy, that there is an obligation on the part of businesses to maintain optimum operation, despite the disturbance or disruption that might occur. And that’s exactly when the importance of a comprehensive and thoughtful business continuity plan comes to light. If developed and maintained properly, they’re hugely important in helping retailers and other businesses prepare for events like a pandemic, and others, ensuring that any negative impacts to the business are limited, or even mitigated altogether.”

Preparing to respond

He goes on to explain that, in addition to the destruction that the pandemic has brought, it should also serve as an impetus for those operating within the industry to place greater emphasis on the development of their business continuity plans going forward. It’s a need that’s highlighted in findings of a survey that was conducted by Gartner in March 2020, at the onset of the pandemic’s impact, which revealed that just 12 percent of those asked believed that their businesses were highly prepared for the disturbance and instability that was to follow, with 56 percent rating themselves as somewhat prepared and 11 percent stating that they were either relatively or very unprepared. It’s an uncomfortable and uncertain situation that O’Keefe says retailers and other businesses should never find themselves in, and one that they can avoid if the proper business continuity processes are in place and adhered to by the organization.

“The fundamental aspect to business continuity planning is to identify the incidents that can potentially effect a business, assess the impact and likelihood of the event taking place, and determine the appetite that the business leaders have in allowing such an event to go unchecked, possibly harming the operations of the business,” he explains. “There are several components involved in developing a strong plan that need to work in sync with one another. It has to be built in conjunction with an enterprise risk management evaluation which assesses the level of risk that a business might be subject to. It’s an assessment that provides a basis for the development of the business continuity plan. But it’s also one that should be performed ongoing. It’s a critically important step because it informs management, providing them with the information and data that helps them determine their tolerance for certain events. Based on the information, they can either transfer the risk by way of insurance, accept the risk, or put a plan in place to mitigate the risk.”

Allocating resources

Coupled with management’s appetite to proactively deal with potential risks, further informing their decision to put plans in place, O’Keefe suggests that the primary considerations are twofold, each involving resources that are available to the business. He adds that it becomes a bit of a numbers game at that point, but suggests that there are creative ways for businesses to execute against risk efficiently and get the most out of their continuity plans.

“Properly preparing for all events requires funding from the organization,” he asserts. “And it also requires human resources. One philosophy around business continuity is to ensure that the right people are put in the right positions in order to form an internal crisis management team which deals with events of risk directly. This approach often saves companies money by remaining nimble rather than investing in backup technology systems. Another philosophy is around the investment in technology so members of the organization aren’t required to engage. This approach removes the human error factor, enabling systems to assume the burden of risk. For example, if the power goes out, a system will engage the backup generator, and the company may never know that the lights had temporarily gone out. Each approach can be effective on their own. But increasingly, creative organizations are leveraging a mix of both approaches and finding a balance that allows them to build a strong plan and contingency to deal with negative impacts on the business.”

For people within the organization, addressing the issue of human resources, it means providing them with the training necessary to execute on their roles and responsibilities with respect to the business continuity plan and ensuring that the right skills are in place in order to identify the biggest risks and respond to them. From a funding perspective, it’s about determining whether or not the resources being allocated toward the mitigation of certain risks are appropriate. And this, according to O’Keefe, is where interdepartmental tabletop exercises, which are meant to dig in to potential risks and determine their likelihood and level of impacts to the business, are such a critical component of business continuity plan development.

“Business continuity planning is about planning and preparing for, responding to, and recovering from adverse events,” he explains. “To do this, members from every department within the organization need to be involved to share their unique perspectives and the risks they perceive. It’s also extremely important to ensure that everyone involved is on the same page when it comes to terminology so they can communicate properly and are all contributing with the same understanding of the objective of the exercise. For instance, the maximum tolerable downtime – a period of time during which you can operate before you panic – will be different between departments. Ensuring that everyone is on the same page enables the proper heat-mapping of risks by the collective group in order to determine the greatest probability and impact. At that point, resources can be allocated and plans put in place to protect the business from impediments.”

Assessing probability and impact

A heat-mapping exercise, put simply, plots risks within one of four quadrants based on the probability and impact axes. Risks plotted in the upper right quadrant pose the greatest probable threat and impact to the business and should be pre-emptively addressed. Based on this exercise, combined with input from each participating member of the organization, a level of tolerance for any number of risks can be decided. And, as O’Keefe points out, there are a number of factors that need to be considered, including the type of operation and services provided as well as the location of the business, among others, yielding varying assessments of risk between organizations.

“To take a real-life example,” he suggests, “if a business is operating in Ontario and the topic of hurricanes comes up, the impact would be assessed as extremely high, but the probability would be very low because we aren’t coastal and don’t experience the effects of that kind of weather. However, if the same risk is assessed in Newfoundland, the probability would be judged as very high because of where they’re situated. For companies, for instance, that have head offices or stores located in an air traffic flight path, they may consider developing a contingency plan that addresses the possibility of an aircraft crashing into their properties.”

Leveraging research and expert insights

Ironically, he says, dealing with the impacts of a global pandemic has traditionally been one of the standard situations addressed at tabletop exercises within organizations, yet when the spread of COVID-19 occurred, most companies were unprepared. He explains that the likelihood of the event taking place was incorrectly assessed to be low, suggesting that teams do their research and elicit the input from experts to help determine risk in order to make sure that heat-mapping exercises, and the plans that they result in, are plotted and executed as accurately and comprehensively as possible.

“Experts actually predicted that a global pandemic was likely to take place,” he laments. “Some even correctly predicted the year. Interestingly, one company that had gone through all of these exercises, thinking that they were diligent and prepared for potential disaster, actually had a plan in place to respond to an aircraft crashing into their head office and causing total destruction. But they did not have a plan in place to properly deal with the event that the business could not welcome customers into their store as a result of the lockdowns that we’ve experienced. There was no contingency for this and the company entered the pandemic period without a way to develop an online presence and were left unable to sell through ecommerce. They had put a considerable amount of time and focus into considering a threat that was in the end far lower than that of the event that ultimately crippled their operations.”

Perpetual plan evolution

He adds that the development of a document outlining and detailing the business continuity plan and sharing it throughout the organization is a vital piece of the process, as is the consistent maintenance and updating of the document as a living, breathing and evolving script based on changes in the overall environment and landscape within which the operation resides. The retail industry veteran quickly admits that it can be a challenging endeavour to assess all of the possible risks to a business, plan for their possible occurrence and prepare the correct and appropriate responses to each of them, but stresses the importance in doing so and the significant role that leadership plays in ensuring that its criticality is realized by their organizations, securing the continued health and success of their operations.

“No matter which way you look at it, there will always be events and occurrences that will impact the retail industry. How companies create their plans and prepare for these events in order to properly respond to and recover from them should be seen as an integral part of doing business. To ensure this, it’s the responsibility of leadership to convey the need internally and to facilitate the vigilant attitude required by their organizations in order to safeguard their operations and guarantee their uninterrupted continuation well into the future. A common question that’s asked of business leaders about developing trends and impacts is around the things that ‘keep them up at night’. The best answer that I’ve heard given in response is, ‘Nothing. My team is prepared’. That’s the confidence and reassurance that a well-thought-out business continuity plan can provide for a business, instilling a sense of readiness, despite the event that occurs.”