Realistic about resilience
Ports need to create robust recovery plans to cover all eventualities, finds Alex Hughes
On the face of it, business and continuity planning (BCP) only offers a tangible return if a port is it by a disruption that is severe enough to prompt the plan’s immediate implementation. In those cases, return on investment in BCP is obvious; you can’t put a price on continuity of business.
John Robinson, managing director of consultant Inoni, explains that BCP is not the same as insurance, although it complements that form of financial protection near-perfectly. Insurance, he says, typically pays repair costs and, if there is business interruption cover, it will make up any loss of profits and costs for the duration of an agreed indemnity period.
“What it won't do is recover a port’s operation in time to retain customers, preventing competitors growing at one port’s expense and killing off that port’s chances of full recovery. Furthermore, analysing and planning to resume operations after an event places leaders under immense pressure, more so when they realise that there are some 'vital ingredients' missing that should have been in place if BCP had been thought through properly.
That said, BCP only generates a financial return after it gets used successfully. “However,” says Mr Robinson, “producing a paper BCP is just that: paper. And unless producing them is your line of business (as it is for us), I doubt business continuity will ever appear on an organisation’s books as a revenue stream,” he says. In this respect, it is no different to information security, HR, quality control or any discipline not directly billed for, he adds.
Nevertheless, having an appropriate plan in place can reduce insurance premiums, he points out.
Rupert Johnston, director of consultant Risk and Resilience, agrees that while it may feel like there’s no obvious immediate financial return on the investment in BCP, there are some very tangible organisational benefits to developing a mature resilience capability.
Resilience, for example, encourages integration of relevant ‘protective disciplines’, which can accrue savings, and successful analysis encourages organisations to look closely at themselves and identify where improvements can be made. It can also encourage organisations to connect their strategy and goals and to get rid of things that have no positive impact. Instead they can focus on developing the capabilities and response to both ensure objectives are achieved and protect the organisation’s key resources to enable this.
“Paradoxically, the better targeted the investment, the less likelihood of an incident in those areas – but nothing is risk free,” he says. “Each organisation must decide for itself what level of investment is in keeping with the degree of risk being faced and the amount of impact that would be acceptable.
“Many organisations are left to absorb intolerable, and often catastrophic, effects of disruption because key resources were not adequately protected or because the organisation didn't fully understand risk, or its knock on effects, and hadn’t mapped impacts,” says Mr Johnston.
While there is a risk of a port authority having a BCP in place that differs from that adopted by its terminal operators, Mr Robinson says that Inoni has faced this challenge in the past. The consultant has written plans for a port and separately for a tenant grain terminal operating largely independently from within the port complex. “In these types of situation, incidents have little respect for boundaries, and affected parties will potentially compete or conflict over a range of resources they have written into their plans. Examples include the use of apparently unused areas for assembly or rebuild; the way security lockdowns are implemented; mismatched expectations and responsibilities; emergency routing within the port when an incident takes place; communications protocols; and so on,” he says.
Fortunately, there are practices that allow BCP to become synchronised, both in peacetime and post-incident. Most notably, pro-active frequent communications, usually from the port operator, of key aspects of its plan with port tenants and users and involvement of local resilience forums can also bring commonality of understanding of risks and responses, along with provision of a point of contact for BCP in the port. Port-wide continuity exercises also offer an opportunity to meet, discuss and improve collaboration.
Kamal Achuthan of UCL agrees that there is a very real risk that BCP adopted by a port authority may be somewhat at odds with that of its terminal operators: “Planning has to be shared - as proposed in the research work we have done at UCL - and co-ordinated efforts made across port functions,” he says. In tandem with plans, there needs to be regular desktop and mock exercises for the plans to work, he adds.
Mr Johnston also says there are potential dangers if, in moments of crisis, port authorities and terminal operators pull in opposite directions. “Resilience best practice and common sense would say that the risk and resilience planning process should understand the context of the organisation and its key interested parties.
Discussing each other’s planning requirements, challenges and possible knock on effects is essential. Without this joined up approach there is a risk that ‘planning in a vacuum’ will lead to unrealistic or ineffective plans and capabilities. Co-operation is likely to also lead to economies of scale and more effective, ‘joined up’ and resilient planning,” he says.
Overly complex plans, though, can fail. Indeed, he notes that there are examples of overly complex plans being actually ignored in times of disruption. He also says that it is possible to fall victim of “paralysis by analysis”, whereby the planning process becomes so consuming that it doesn't lead to effective, executable plans.
“The most important thing of all is ensuring that the capability of a well-practiced team can make decisions and work around the unforeseen challenges of a crisis to deliver ‘success’. This is more about people than it is about complex plans,” says Mr Johnston.
Inoni’s Mr Robinson agrees: “Plans need to work and be capable of fast error-free adaptation and use, even by the second and third team, if primary staff are absent. If plans are too complicated or dense they won't be updated or used; too simple and they become pointless.”
BCP planning also has to constantly evolve since ports are constantly evolving. According to Mr Robinson, this becomes a real headache for larger multi-site or multi-department businesses. To get around this, Inoni uses software that produces all the online and offline materials with less effort - in effect a mail-merge of all the information, so when changes occur, the plan owner faces a much-reduced updating activity. “It also allows us to delegate tasks to individuals at port or functional level, again reducing the load on any individual and ensuring that data sourced by an area remains correct.” They are also reminded by email when a review or update is due.
Developing a sensible programme - within the parameters of the available resources - to maintain capability and communicate with staff as to their roles and responsibilities is also important. Additionally, teams have to be allowed to perform in a realistic setting by simulation or ‘live’ exercising. Risks, analysis and plans have to be reviewed at least annually, too. All this should enable the identification of lessons and improvement. Crucially, these then have to be actioned to drive improvement and are all essential components of protecting the initial investment in building a capability.
“Plans that either come off the shelf or are left too long on the shelf are usually ineffective. Resting on your laurels leads only to crushed laurels,” he says. “Plans are bits of paper. Well thought through and integrated plans, executed by capable teams provide the best defence against intolerable impacts. A well trained and practiced team is also most likely to deal effectively with those ‘curve balls’ that don't fit planning; the maintenance of this level of capability requires effort, but is the best, most realistic solution to achieving a decent degree of resilience and continuity.”
Furthermore, for any ‘plan’ (continuity or otherwise) to have a chance of succeeding, the people executing that plan must be capable in their continuity or crisis response role, which can often be an additional responsibility on top of ‘the day job’. Assuming this capability exists without testing the assumption is a route to failure, and a waste of investment.
The Marine Operations Superintendent’s role includes two main areas of responsibility: Read more
Applicants are invited to apply for the QSHE Compliance Lead vacancy within the Containers Departmen... Read more
Applicants are invited to apply for the above vacancy within the Marine Department, based at Greenoc... Read more