Guide to Effective Business Continuity Planning in Singapore

Just within the span of 2020’s first 3 months, businesses around the world have had to face both localised threats like the Australian bushfires and Iran-US hostilities, as well as threats on a global scale like the Coronavirus Disease 2019 (COVID-19) pandemic. Many businesses were disrupted, leading to their closure.

Therefore, businesses should always be prepared for events that may disrupt day-to-day business operations, interrupt supply chains and damage critical infrastructure. This can be done through the implementation of a Business Continuity Plan (BCP) which serves to mitigate the impact of disruptive events on businesses.

This article targets leaders of organisations who are able to initiate BCPs on behalf of their organisations, offering them insights into the value of BCPs to their organisations and guidance on how to implement BCPs within their organisations.

What is a BCP and the Purpose of It?

As its literal meaning suggests, BCP is the process of maintaining the flow of business activities and transactions. It serves as a countermeasure to disruptive events that inhibit business functions, such as cyber-attacks, natural disasters, pandemics and terror incidents.

Why is a BCP Necessary?

You continue to accrue revenue

You develop a stable way of accruing revenue despite the onset of disruptive events

Businesses may possess some measure of cash reserves to tide themselves through short-term downturns. However, such reserves will eventually be depleted if disruptive events bring business activities to a standstill for protracted periods. Even if businesses enjoy insurance coverage, it is unlikely for all losses suffered from disruptive events to be covered wholly by insurers.

The implementation of BCP helps businesses continue with their contractual obligations and ensures that some revenue continues to accrue to them from their clients, when disruptive events occur. Such revenue flows will help businesses cover their immediate operating expenses, thus keeping businesses afloat and providing business owners with a lifeline to re-organise and adapt to the disruptive situation.

You adhere to legal obligations owed to employees

Under section 12 of the Workplace Safety and Health Act in Singapore, employers have a legal obligation to ensure the health and safety of their employees at work. For businesses that hire foreign employees, the First Schedule of the Employment of Foreign Manpower Act imposes a further legal obligation on employers for the “upkeep and maintenance of (foreign employees)”.

Disruptive events can expose workplaces to health and safety hazards. For example, a terror incident in Singapore’s city centre, like what has been witnessed in Mumbai (2008) and Paris (2015), may result in damaged and inhabitable workspaces.

For employers that have already contemplated such events and prepared contingency arrangements, such as alternative workspaces and work from home arrangements (discussed below) as part of BCP, their employees will be able to safely continue working at these alternative locations and support the continued functioning of the business. This also reduces employers’ risks of breaching workplace safety-related legal obligations when disruptive events occur.

What is Included in a BCP?

Given that a combination of disruptive effects may arise from any one event, there is no “template” BCP for businesses to follow, and each BCP will have to be constituted according to the disruptive events that businesses plan to respond to.

Nevertheless, a BCP can be designed to include a system that:

• Provides for alternative work arrangements
• Draws on detailed plans for the restoration of any damage caused to critical infrastructure
• Seeks out alternative supplies to minimise business disruption

Providing alternative work arrangements

Disruptive events may hinder day-to-day workplace operations. For example, in response to the ongoing COVID-19 pandemic, reduced interaction in the workplace is being emphasised to reduce the spread of the virus.

Hence, in order to ensure smooth continuance of business, while not disconnecting communication between employees, alternative work arrangements such as “remote working” or “work from home” could be implemented as part of your BCP.

In doing so, your BCP could also provide policies for the separation of employees into office and home-based teams, with teams alternating between working from home and at the workplace, and for the prohibition of interactions between members of different teams.

Restoration of any damage caused to critical infrastructure

Disruptive events may result in damage to critical infrastructure. In such cases, BCPs will first have to focus on restoring the functions of such infrastructure, so as to enable other functions of the business to resume.

For example, BCPs for businesses in earthquake-prone regions of the world may include detailed plans to restore communications systems, since telecommunications cables are easily damaged by earthquakes. Restoration of communications systems will then make it possible for the implementation of other BCP measures like work from home arrangements.

Seeking out alternative supply sources 

Disruptive events may result in interruptions to supply chains of raw materials. In such cases, BCPs should ensure alternative supply sources for businesses to tap on.

For example, if a food and beverage business primarily obtains its ingredients from drought-prone regions, it should ensure alternative supply sources such as geographical regions with greater precipitation or hydroponics farms.

How to Design and Implement a BCP

There are 5 general guidelines in preparing a BCP. These guidelines may be summed up as the 5As, to be discussed in the order in which they should be contemplated.

1. Appoint a BCP team 

A BCP team should be appointed in advance of any crisis. This team can be split into a “command” group and an “action” group, to avoid duplication of roles and to ensure that plans are seamlessly translated into actions.

The “command” group should comprise members of the organisation’s leadership team who have an overarching view of how the various moving parts of an organisation function together.

On the other hand, the “action” group should comprise team members with specialised skill sets critical for the functioning of the organisation, such as corporate communications personnel, IT personnel and legal advisers.

The BCP team should meet at regular intervals to review existing plans, and revise them as necessary.

2. Assess potential threats to the business

The BCP team should brainstorm on a list of potential threats to the organisation. They should follow up on this initial brainstorm with a consultation of the wider organisation through surveys and interviews, so as to avoid blind spots in this assessment.

Once a list of potential threats to the organisation has been compiled, the BCP team should then explore how these threats would affect day-to-day operations of the organisation. Here, the different perspectives and knowledge of the “command” group and “action” groups will help to ensure an all-round insight into the effects of the potential threats.

Ideally, all levels of disaster severity ranging from minor disturbances to total losses should be considered, so that appropriate responses can be devised for each crisis level.

The findings from this assessment should be compiled into a report that remains accessible to personnel of the organisation, and open to their input at all times.

3. Action plan

Steps 1 and 2 will lay the groundwork for the creation of an action plan, which should comprise 3 phases:

• Prevention;
• Response; and
• Recovery.

Prevention

Certain disruptive events may be prevented from the outset. For example, cyber-attacks may be averted by strengthening existing cyber defences. Therefore, as part of the “prevention” phase, the BCP team should refer to the list of potential threats assessed in step 2, and consider if any of these threats can be avoided in the first place.

The mantra of “prevention is better than cure” underpins this phase of the action plan, and it will serve businesses well to be proactive rather than reactive.

Response

For unavoidable threats such as natural disasters, pandemics and terror incidents, the BCP team should then consider how best the organisation may respond to these threats, so business activities can continue notwithstanding the occurrence of such threats.

For example, in the event of a pandemic, having two separate teams alternating between working from home and at the office reduces interaction, and therefore the risk of transmission of highly-contagious viruses, among employees and will not result in the entire organisation having to halt work completely.

If time and resources permit, organisations can conduct regular drills of BCP responses. In preparing for a future pandemic, for example, employees may be given the option of working from home once every few weeks, so that they would be familiar with the process of telecommuting.

Most importantly, employees should be made aware of the rationale behind BCP arrangements, so as to increase their willingness to comply with such arrangements and minimise the efforts needed to ensure their compliance.

Recovery

Finally, as part of the “recovery” phase of the action plan, the organisation should be prepared to take steps to restore operations when the situation stabilises and an eventual reversion to the norm is in sight.

For example, organisations may have interim facilities and back-up systems ready for employees to continue their functions as before. In practice, there may already be substantial overlap with the “response” phase of the action plan if the disruptive events are short-lived in nature.

4. Approval

When disruptive events occur, any action plan should first be approved by members of the BCP team’s “command” group before implementation.

Existing action plans will always be based on hypothetical scenarios, and the “command” group will be able to refine the chosen action plan in accordance with any ongoing business developments.

5. Audit

A regular audit of the BCP should either be conducted internally, or by external consultants. The results of such audits will form the basis for the regular review of BCP that the BCP team is expected to undertake as part of step 1.

—

In summary, the 5As of appointing a BCP team are guidelines that may be relevant to organisations in formulating their BCPs, and can be applied regardless of their business activities and the type of disruptive event occurring.

However, the details of each organisation’s BCP will depend on the threats facing each organisation’s industry, as well as the resources available to each organisation.

We believe that an investment of time and resources into devising BCPs now will provide organisations with stability in future.

Given that the implementation of BCP may have implications on your employees’ work arrangements and your compliance with workplace-safety related legislation, you may wish to engage a corporate lawyer for legal advice on implementing a BCP.