After every natural disaster, people are deprived of basic services such as water, food and electricity. On the other side of the coin, the utility sector is always on the receiving end to succumb to any type of disaster, whether man-made or natural. In this scenario, this sector needs a comprehensive business continuity management strategy to serve the people even during a crisis.
The services of these utilities are critical to the economic and social well-being of a society. Thus, the continuity of utility sectors such as power distribution is a critical issue to be considered by senior management and relevant authorities.
Business Continuity Management strategy helps you prepare for the worst. However, the worst will not often happen. Why, then, do we need a separate policy and dedicated resources for a prophecy?
Risk management versus business continuity management
Business continuity is an integral part of risk management. Organizations cannot ignore the possible external effect on operations. Sometimes the internal risks can surprise and have an effect on both organizational and operational levels.
BCM is often mistaken for a disaster recovery plan, which is mainly limited to technology and data protection. However, it has more to do with a top-to-bottom approach, which requires continuity management at every stage of different operations in an organization.
A malfunction can be eliminated with risk planning and emergency measures. However, it is very difficult to measure the extent to which this failure can penetrate several activities of the organization.
Let’s look at some of the potential natural and man-made hazards that can interfere with the operation of utilities, especially energy companies.
The potential natural and man-made hazards to energy companies:
• Cyclone & Floods – Most of the Middle East, Malaysia and other coastal countries are susceptible to tropical cyclones, which lead to flooding. Power distribution companies from these areas may suffer infrastructure damage and loss of property and may need to relocate their activities while continuing to provide their services
• Power outages – The generator and grid outages are often predictable power outages and connected cities can go dark without power and gas
• Fire – Short circuits in electricity or man-made negligence can expose companies to fire accidents. Many vital records can be burned and even affect their IT
• Physical and cyber attacks – Physical attacks are very rare. However, the utilities are vulnerable to internal conflict and terrorist attacks. Here there is to some degree a risk of loss of people and property.
While cyber attacks are inevitable from hackers and anti-management groups. Although the data disruption may not directly affect the power supply, but may interrupt billing and other operations. This, in turn, can fluctuate cash flow and unbalance the balance sheets
• Pandemic – Epidemic diseases such as Ebola are very unpredictable. However, the rumors and fear can lead to adverse incidents within the organization.
All of the above incidents could damage the organization’s reputation, property and data, demotivate personnel and disrupt supply and demand activities.
Currently, every energy company is expected to perform
• Timely recovery to work
• Monitoring business and operational risk
• Dealing with technological failures, unavailability of employees, facilities incapacitated for work, interrupted critical suppliers
• Manage the reliability of the grid and a large number of interconnected business processes that support this goal
• Holistic approach to business resilience and disaster recovery
• Understand the risk and impact of disruption to business processes
Now the question is, “are you ready and equipped for any incident?”
If yes, check if you can meet the above parameters.
If not, then:
• Hold some initial hierarchical board meetings
• Check the power of internal Business Continuity Management
• Consult an external expert for Business Impact Analysis (BIAs) and
• Facilitate the internal BCM team with some test cases or simulation crisis workshops
Some case studies from power distribution companies in the Middle East and other countries have reported the need for Business Continuity Management automation. Many companies strive to bring all their BCM processes and records together in a centralized environment to proactively monitor and mitigate business failure threats with the click of a button through BCM software.
This important initiative towards BCM is also a step to comply with the regulations issued in accordance with Section 3, Part 1 of the National Emergency Crisis and Disasters Management Authority (NCEMA) Standard 7000: 2012. These regulations are designed to – Regulate Emirates wastewater and electricity sectors to develop BCM and BCP in accordance with NCEMA 7000: 2012.
Some of the NCEMA 7000: 2012 regulations include:
• Define own organizational criteria and trigger for executing a Business Continuity response in accordance with the respective Business Continuity Program in the event of a disruption
• Define a scope of BCM in terms of business-critical processes and functions
• Establish a BCM committee to address organizational, functional and operational issues
• Appoint a business continuity coordinator
• Execute BIAs – determine and document the RTO & RPO for all mission-critical processes and functions
• Identify threats and assess the impact of threats, the vulnerability of those effects, the likelihood of identified threats and finally calculate and evaluate the risks
• Measure BCM with internal audits, management assessments and measure against KPIs
• Provide awareness and training and perform test cases and exercises
• Above all, organizations must regularly review and update their BCM religiously
In short, utilities respond well to local emergencies. However, challenging economic environments and changing scenarios, forcing companies to put aside their long-term problems. Looking at the changing landscape, now is the time to revisit Business Continuity Management and show urgency for continuity preparedness.