UK businesses are 'sitting ducks'

The Chartered Management Institute (CMI) said its 2005 study had uncovered "alarming inactivity" with businesses ignoring threats, neglecting the needs of their managers, and failing to communicate plans with employees.

More than half (51%) of organisations questioned had a business continuity plan in place, representing a slight increase on last year (47%). However this overall figure masked broad differences between firms - for example, of those with a turnover of £11 million or more, 66% had a business continuity plan, compared to just 34% from those with a lower turnover figure.

When asked to identify the threats most likely to have an impact on their organisation, 70% of managers said loss of IT capability was their top concern. Loss of skills was also highlighted (56%) and loss of personnel (55%).

However, what made UK firms "sitting ducks" according to the CMI, was the fact that most continuity plans failed to cater for the type of disruptions being experienced by organisations.

Despite an increase in incidents relating to loss of people - up to 41% from 25% in 2004, and skills - up to 28% from 20%, only a "handful" of plans covered these issues, according to the report.

Significant shift

Mary Chapman, chief executive of the CMI, said: "It's a matter of concern that many organisations still fall short when it comes to implementing thorough business continuity management strategies.

"However, the rising awareness of corporate governance responsibilities, and in particular the demands of the new Operating and Financial Review (OFR) regulations should ensure that managers focus on the impact and cost that the loss of staff and services can have."

The OFR regulations require companies to include certain information in their annual reports. The rules, which do not apply to small to medium sized firms, come into effect from 1 April.

The CMI added that a "significant shift" has occurred over the past year, over the factors that were influencing approaches to business continuity management. Corporate governance was now considered the "key reason" (34%, up from 24% last year), followed by demands from insurers (25%), central government (22%) and auditors (20%).

Boards led on continuity management for 27% of those questioned, while budgetary control had shifted into mainstream business operations, with 38% ensuring this happened at director level. Only 9% of organisations now gave financial control to risk managers and 5% to IT directors.

Those managers taking part in the study expressed "anxiety" over the lack of a communication with organisations about their business continuity plans, according to the CMI.

Of those with a continuity plan in place, just 58% saw their employees as a key audience, and only one in 4 had an awareness programme for all staff. Slightly more than half (53%) provided additional training for "specific, relevant, employees".

Inadequate rehearsal

The rehearsing of continuity plans was also highlighted as a problem for many. One-fifth of organisations admitted to never testing their plan and only half met what the CMI said was the "minimum recommended frequency" of rehearsing plans of once every year.

As many as 86% said their rehearsals had revealed shortcomings, while 13% admitted that these problems had not been addressed.

Nearly two-thirds (58%) do not measure business continuity management performance and 40% of organisations with a turnover of less than £10 million, do not audit their continuity programme.

John Sharp, policy and development director at the Continuity Forum, co publishers of the report along with Veritas Software, said: "The evidence suggests a small but consistent growth in business continuity management.

"However, having a plan is not enough. Major steps still need to be taken as too many organisations are scraping by with inadequate and untested plans that expose them to unnecessary risk."

The full report can be downloaded from the Chartered Management Institute's website - see link above/right.