Should continuity plans be a legal requirement?

The call came ahead of a major business continuity conference and exhibition taking place in London in March, which will examine the issue further.

Graeme Howe, event director of the Business Continuity Expo 2006, said it was time that UK based businesses took some responsibility for business continuity, by being adequately prepared for natural disaster, power failure, supply chain failure and other disruptions.

He suggested that regulations could be introduced similar to the legal requirement for firms to carry out health and safety risk assessments. This would ensure that continuity plans were not only put in place, but that they were "adequate" and "tested regularly".

Mr Howe claimed that too many UK organisations, particularly small to medium sized businesses, were "dismissing business continuity on the basis that they are extremely unlikely to experience a serious event such as bomb or earthquake."

He added: "But how many organisations can honestly boast they have never lost access to business critical systems? And just what has that cost the business? Have major orders been lost, employees been laid off?

"This lackadaisical attitude to business performance is unacceptable. Isn't it time organisations took some board level responsibility for ensuring continuous business success?"

'Little incentive'

Although acts of terrorism and environmental devastation had "raised awareness" of business continuity and disaster recovery, many organisations were still "missing the point", according to Graeme Howe.

He warned that it was often the "so-called smaller issues" such as email failure, transport problems or localised flooding that could "fundamentally undermine business success."

"Yet there appears little incentive today for UK directors to take responsibility for business continuity. Many boards allocate responsibility for business continuity to one individual with the belief that they are doing something about it," he told us.

"In truth, business continuity should not rest on one individual's shoulders. It needs to be driven by the whole organisation, with the ultimate responsibility laid at the feet of the board directors. This is not an issue that can be addressed half-heartedly, once annually and then left in a dark corner.

"Business continuity, disaster recovery and risk management are board level concerns. Yet despite an era of increasing corporate responsibility, from personal director liability of failure to comply with a raft of regulations to issues associated with health and safety of employees and corporate manslaughter, there is no redress against directors."

External pressure

Mr Howe said that UK public limited companies were already obliged to adequately prepare for disaster as a result of the Turnbull report, but that this overlooked the vast majority of firms operating in Britain.

Without any specific legal requirement to have a business continuity plan in place it was currently left to others, such as insurance companies or business partners, to apply pressure to ensure that firms were properly managing the risk of disaster.

A Business Continuity Institute (BCI) study, published to coincide with the 2005 Expo, revealed that almost 70% of British firms had a business continuity plan in place, but that 60% of business were still failing to test their plans on an annual basis.

"There is a clear requirement for a shift in mindset, from Government to senior management, to make business continuity a key component of overall strategy," said Mr Howe.

The Business Continuity Expo 2006 takes place on 15 and 16 March at ExCel, London.