MANAGEMENT GUIDE MANAGEMENT for the Hospitality Industry Managing threats and building organisation resilience What is business continuity? According to the Institute, business continuity management is defined as the holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities. Business continuity management is closely linked with disaster and emergency management, risk assessment, health and safety directives and various regulations. Failure to have a plan in place can result in damage to a business brand, image and finances. Ultimately, the lack of a plan could result in the failure of the business. Recent regulation in the form of the Civil Contingencies Act 2004 should provide greater structure and consistency in the public response to emergencies. Primary and secondary civil responders such as the fire service, police departments and health authorities are already obligated to develop their own plans. Local authorities will become fully responsible for providing business continuity advice and assistance to businesses and voluntary sector organisations by 15 May 2006. In the meantime, resources do exist to assist business owners with the development of a Plan (BCP). Incidents such as the Boxing Day tsunami; Foot and Mouth disease; terrorist attacks in Egypt, Bali, New York City, and London; and the SARS health crisis have each highlighted the need for the hospitality industry to establish or review the actions it takes in response to destructive events and emergencies. Why is a Plan (BCP) needed? In recent years the global hospitality industry has taken a battering both literally and figuratively. Incidents such as the Boxing Day tsunami; Foot and Mouth disease; terrorist attacks in Egypt, Bali, New York City, and London; and the SARS health crisis have each highlighted the need for the hospitality industry to establish or review the actions it takes in response to destructive events and emergencies. Many businesses will never experience terrorism directly; however, the threats of fire, theft, fuel crises, and other natural and man-made disasters are probable and continuous. In addition, the topic of global warming s effects has been continuously highlighted through the media. While its direct impact on the earth s climate is debated, serious storms, floods, and droughts wreak havoc on regions around the world. HOTEL AND CATERING INTERNATIONAL MANAGEMENT ASSOCIATION
2 A dire forecast by the ABI states that the annual cost of flooding in the UK could top 22 billion by the year 2080 if carbon dioxide levels continue unabated. Consider the following list of events, any of which could have a cataclysmic effect on hospitality, tourism and leisure businesses, and determine the probability of each one affecting your business: Cyclones and typhoons Terrorist strikes and bombings Fires, forest fires and ensuing smog Vandalism and theft (including data theft) Civil disorder and industrial action Flooding Earthquakes Fuel crises Computer and power outages, gas leaks and utility problems Epidemic and pandemic scale illnesses (SARS, flu, bird flu, foot & mouth) Drought Blizzards, snow storms, ice storms Oil spills and man-made disasters Transport accidents Key staff illness Disasters affecting suppliers and customers Subsidence, landslides, mudslides Sabotage Tornados and wind storms Hurricanes In the UK, the Association of British Insurers (ABI) estimated in 2000 that annual flooding incidents would cause between 1 billion to 2 billion worth of damage per single event and, unfortunately, this estimate was confirmed in the flooding experienced in the UK later that year. While not as expensive as the aforementioned incident, flooding in Boscastle, Cornwall, in 2004 cost 5 million for damage to cars and property and between 5 million to 10 million for business interruption according to the ABI.These figures do not, of course, take into account the emotional and physical distress caused by catastrophic events. A dire forecast by the ABI states that the annual cost of flooding in the UK could top 22 billion by the year 2080 if carbon dioxide levels continue unabated. What happens if I or my business fail to have a Business Continuity Plan in place? Experience has shown that businesses with regularly reviewed business continuity plans in place prior to an event are more likely to recover from the impact of the incident. Companies that fail to make contingency plans will find it difficult to sustain their business. For example, following the 1996 bombing in Manchester, over 600 businesses were affected and within six months 250 of these had gone out of business.the estimated costs of the bombing exceeded 600m. (Mid Beds District Council, 2005) Many businesses particularly small and medium business enterprises (SMEs) will not survive a catastrophe.the London Chamber of Commerce and Industry conducted research on disaster recovery in 2003 and found the following: Only 17% of London SMEs have a contingency or security plan in place Only one in five of larger London businesses have any contingency or security plan in place 80% of large businesses in London have back up plans in place that would help them survive if they, or London, were subject to a terrorist attack. 90% of businesses that lose data from a disaster are forced to shut within two years of the disaster 80% of business without a well-structured recovery plan are forced to shut within twelve months of a flood or fire 43% of companies experiencing disasters never recover 50% of companies experiencing a computer outrage will be forced to shut 43% of companies with a business continuity plan do not test it annually to ensure that it works 58% of UK organisations were disrupted by 11th September with one in eight severely affected
3 Every small, medium or large business needs to have a business continuity plan in place. By establishing a plan, businesses can ensure the minimum impact to their staff, guests and patrons, property, company finances and perhaps even the community at large. How do I create a Business Continuity Plan (BCP)? There are a number of different sources providing information, from basic to detailed, on establishing a business continuity plan (see list at end of this document). Some fee-based plans are available through companies specialising in the creation of business continuity plans, but there are also sufficient free guides and materials for those who wish to put together their own plan. Some of the key points to consider when creating a plan are: Identify and list potential events that pose a likely threat to your business Analyse how to minimise the risk of these event(s) affecting your business Start a BCP as soon as possible. Having a draft in place during an emergency is better than having no plan at all. An Integrated Emergency Management (IEM) system is used in conjunction with BCP. As mentioned in the Civil Contingencies Act, an IEM supplements business continuity and comprises six activities: Anticipation "Horizon scanning" or being aware of new risks as they arise Assessment Being prepared to modify plans to respond to new risks Prevention This often occurs through other legislation, such as initiating health & safety measures, flood defenses, etc. Preparation The process of preparing and managing emergency plans Response and Recovery Managing the response to the emergency and returning service to normal A dire forecast by the ABI states that the annual cost of flooding in the UK could top 22 billion by the year 2080 if carbon dioxide levels continue unabated. Business continuity plans are concerned with creating resilience within an organisation thereby enabling it to maintain a smooth running service where it can continue to provide its deliverables.the Institute has created a Publicly Available Specification PAS 56 that meets the requirements of the British Standards Institute. PAS 56 is a widely-accepted five-stage process for creating a BCP. A detailed review of the creation of a BCP is contained in Chapter 6 of the government document entitled Emergency Preparedness: Guidance on Part 1 of the Civil Contingencies Act 2004, its associated Regulations and non-statutory arrangements. (See References). Generally, the creation of a BCP should involve the following: 1. Buy-in Obtain high level management support for the plan it will fail without this support! 2.Team Work Create a committed team that will be responsible for BCP development but will also remain in place beyond the development and launch of the plan. Many large organisations have a dedicated Manager, which is worth considering particularly if the business is medium or large. 3. Understand Your Company Analyse and understand your business s key activities, its primary mission and its deliverables. Who or what does the business rely upon to meet its mission and how can these resources be maintained in a crisis? Will service level agreements entered into either by the company or its suppliers be affected by the event and, if so, how can this be minimised? 4. Identify and Analyse Risks Identify risks (see page 2) and determine where the risks lie. Are the risks internal or external? Do they involve customers or staff? Performing a standard risk assessment should help clarify the areas and types of risks to which the company is most vulnerable. Determine the severity level and the frequency with which the event or emergency might occur. For example, is the business vulnerable during the hurricane or monsoon season?
4 5. Policy and Strategy Once identified, create policies and strategies to maintain the company s operations during the crisis.these should complement risk management and IEM strategies and use non-technical language whenever possible. Creating a checklist of contact details including emergency services, utility companies, insurers, suppliers, customers, along with a secondary list of specialist service providers such as temporary staffing agencies, plumbers, IT specialists, etc., should help the business address immediate needs. Consider, for example, whether the company can be relocated to other premises or whether temporary staff can be hired.this is also a good time to make certain insurance coverage is adequate.think about the worstcase scenario. Is the company prepared? 6. Communicate Develop a response to the incident and be prepared to communicate with staff and the public regarding the incident. A spokesperson should be designated and he or she should be prepared to issue positive statements regarding the organisation s handling of the emergency. Staff must be the first to be informed followed by patrons, guests, suppliers and the public. Remember, you want customers to have faith in your company s ability to deal with crises. Many will be unforgiving if there is a significant disruption to their service.the costs associated with the loss of customers combined with the loss of facilities, for example, may result in the demise of the business. 7. Maintenance, Review & Training Maintain, review and update the BCP on an annual basis with the assistance of the dedicated BCP team. Make certain the updated BCP is shared with all staff on a regular basis.training might include the actual acting out of the BCP to assist staff in understanding the procedures that should be followed.these practice runs will familiarise staff with the plan and also assist with refining the BCP process.the plan won t work if personnel aren't aware of it or know how to use it. In the hospitality industry, the high turnover of staff in any one facility guarantees that some employees will not have had the opportunity to be briefed about the BCP. The addition of the BCP to new employee inductions should remedy this problem. Make certain that updated copies of the BCP are located at accessible sites beyond the company s offices, such as staff members homes. Conclusion Companies with the foresight to create and incorporate a Plan are helping to ensure their continued existence in an uncertain environment. By preparing for the unexpected, you too can secure your company s greatest chance for surviving a catastrophic event. DISCLAIMER This HCIMA Management Guide is intended as a brief summary to the topic. While the information it contains is believed to be correct, it is not a substitute for appropriate professional advice.the HCIMA can take no responsibility for action taken solely on the basis of this information. HCIMA,Trinity Court, 34 West Street, Sutton, Surrey, SM1 1SH, UK Tel: +44 (0)20 8661 4902 Fax: +44 (0)20 8661 4901 Email: library@hcima.co.uk.website: http://www.hcima.org.uk Copyright HCIMA, December 2005. Registered Charity No.326180
5 REFERENCES Association of British Insurers (ABI),April 2005 Safe as Houses? Flood risk and sustainable communities. [online]. Available from: www.abi.org.uk/bookshop/researchreports/floodmanifesto.pdf [accessed 17 August 2005]. Institute (BCI) Glossary of General Management Terms. [online]. Available from: www.thebci.org/glossary.pdf Civil Contingencies Secretariat 28 July 2005. Letter to Key Stakeholders. Civil Contingencies Act Regulations and Guidance. [online]. Cabinet Office. Available from: www.ukresilience.info/ccact/2807stakeholders.pdf Emergency Preparedness Guidance on Part 1 of the Civil Contingencies Act 2004, its associated Regulations and non-statutory arrangements. [online] HM Government. Available from: www.ukresilience.info/ccact/emergprepfinal.pdf Mid Beds District Council, June 2005 Mid Beds Business Newsletter. Issue 2. Available from: www.atcm.org/newsletters/docs/29-businessnewsletterissue21.pdf BCP SAMPLE DOCUMENTS For an extensive list of free, downloadable documents see: London Prepared, General Checklists & Templates at: www.ukresilience.info/londonprepared/business/businesscont/templates.htm The 10 Minute Assessment www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/1 0-minute.rtf Things to Consider When Developing Your Strategy www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/d evstrat.rtf What Might Happen? www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/h appen.rtf Worst Case Scenario www.ukresilience.info/londonprepared/business/businesscont/docsandpdfs/ worst.rtf DTI: Understanding Management (with 10 point recovery plan) www.dti.gov.uk/bestpractice/assets/security/understandingbusiness.pdf?pubpdfdload=05%2f625 MORE INFORMATION RESOURCES Institute www.thebci.org Disaster Recovery Institute International (DRII) www.drii.org/index.cfm Home Office www.homeoffice.gov.uk Hotel & Catering International Management Association www.hcima.org.uk/publications London First www.london-first.co.uk London Prepared www.londonprepared.gov.uk Metropolitan Police Service www.met.police.uk MI5 Security Advice www.mi5.gov.uk/output/page5.html UK Resilience www.ukresilience.info DOCUMENTS AND BOOKS Home Office Business as Usual; Maximising business resilience to terrorist bombings, a handbook for managers www.ukresilience.info/contingencies/business/business.pdf London Chamber of Commerce and Industry Disaster recovery: business tips for survival. (May 2003) www.londonprepared.gov.uk/business/lcc_disaster_recovery.pdf Expecting the unexpected; Business continuity in an uncertain world www.londonprepared.gov.uk/business/london_first.pdf Weathering the Storm; A crisis management guide for tourism businesses. Lynch, Mary. 2004.Troubador Publishing. Book available to purchase at: www.troubador.co.uk/book_info.asp?bookid=176 How Resilient is Your Business to Disaster? www.londonprepared.gov.uk/business/resilient1.htm