Insurance

Insurance – and especially business interruption (BI) cover – is seen by many as the ‘catch-all’ for recovery should things go wrong, observes Ian Dunlop, managing consultant in the business continuity team, risk consulting, at broker Marsh.

However, insurers increasingly are asking those they insure for evidence that effective risk management (including business continuity arrangements) was in place before the event, so that the organisation can demonstrate appropriate risk mitigation measures had been taken. Those able to do so will benefit when insurance renewal terms are discussed, compared with organisations that lack the same approach.

“Insurance is fine, but it won’t get you up and running again on its own and the money can take some time to come through,” cautions Paul Taylor, business assurance manager for the Charities Aid Foundation. He suggests that a charity’s attitude towards BI insurance is largely determined by who depends on its services. “Who will struggle if you’re not around,” he asks.

If that service is a daily ‘meals-on-wheels’ visit to the elderly, or transport services to the disabled, the limitations of insurance may become evident. A contingency plan to use the local hotel’s kitchen facilities, or have a standby vehicle available from the local bus operator, could prove more practical than a BI policy.

“You have to consider your PR and the fact that as soon as you fail to deliver the service as usual, the press will latch on,” he says. “The better you are at business continuity, the less it is likely to get noticed and to win you plaudits for maintaining business as usual.”

But paradoxically it can sometimes mean a charity that proves resilient when disaster strikes attracts the attention of a potential donor better than one that has equally good contingency provisions in place but hasn’t had occasion to use them.

Following best practice

A major obstacle for charities in following the best practice procedures routinely used in commerce is that both money and resources are usually much tighter. Actions have to be justified and gain the approval of senior management, especially if they involve paying for the expertise of external consultants.

The expenditure is worthwhile if it enables plans and processes to be put together within a realistic timescale and to a satisfactory level, Taylor suggests. However, some organisations manage to formulate a blueprint simply through gleaning information from the internet, or by obtaining advice and guidance from those in other organisations who are willing to share their experiences.

Top

The Charity Commission’s website offers a number of publications, two of which CC49: Charities & Insurance and RS13: Tell It like it is (Reserves for charities) specifically address contingency planning and establishing a reserve from income to guard against potential setbacks.

Reserving is a particularly delicate issue. As the Commission observes, keeping back significant amounts instead of spending it on a charity’s beneficiaries can easily be interpreted as hoarding. In addition, some charities have set aside amounts for unforeseen events but neglected to also develop a policy for managing them.

In recent years, the Commission has stepped up efforts to rectify this omission through its Review Visits initiative. Conducted through the Charity Effectiveness Division, the initiative aims to help voluntary organisations improve their performance by defining best practice and achieving four targets: enabling them to maximise their impact; comply with their legal requirements; develop their innovation and effectiveness; and promote a public interest in charities.

Review Visits are made to both individual charities and groups of charities, usually under the umbrella of a themed project, to both improve the Commission’s awareness of the impact that its policy and guidance is having and also to identify and assess the risks that charities must deal with.

A further impetus for charities to be prepared for the unexpected came with the issue in December of British Continuity Management Standard BS 25999-1. The standard is a template for understanding, developing and implementing business continuity within all types of organisations, as well as setting out guidelines for best practice. Charities should also be aware of the information security guidelines of standard BS7799 (also known as ISO17799) and the Data Protection Act’s call for resilience in accessing data.

The ABC approach

But how do those given the responsibility of developing a contingency plan go about it? The task can too easily be pushed to the bottom of the ‘to do’ list, suggests Sarah Morrison, the charity partner at CLB Littlejohn Frazer, but being unprepared is costly. She cites the recent power cut that affected London’s West End as an example. A burst water main flooded an electricity sub-station and affected the supply, forcing many businesses and offices that had no back-up facility to close down for the day.

The Buncefield oil depot explosion of December 2005 proved that unexpected events could have more than a temporary impact; the area was cordoned off for weeks and businesses were unable to gain entry to their building, even where no physical damage had occurred.

“Charities and not-for-profit organisations need to ask themselves what would constitute a disaster for their organisation – such as the building becoming unsafe, or staff being unable to access the premises,” says Morrison. “They should then put together a contingency plan based on this. Sufficient insurance cover is a must and developing a good working relationship with your insurer can be hugely beneficial in the event that disaster strikes and a claim needs to be considered.”

A good start to addressing the problem is a simple ‘ABC planning guide’ that can be developed to deal with an unforeseen event:

• A is for alternative accommodation should your organisation’s premises become inaccessible. If this happens, are you able to make a reciprocal arrangement with another organisation for use of part of their building? Consider which staff you would need to relocate, which of them could work from home and how this would be facilitated. But bear in mind that a reciprocal arrangement with an office too close to yours could prove ineffective in the event of an incident affecting both buildings. Also ensure that someone is responsible for notifying postal and telephone service providers about redirection.
• B is for back-up of computer data, which means ensuring it is held off-site at a secure location. It is also good practice to hold a copy of your asset register off-site, so that insurance claims may be submitted more easily if the building suffers damage.
• C is for communication, which means deciding who will invoke the disaster recovery plan and how they will contact others. This may involve identifying a key group of staff and cascade telephone contacts. Who holds the staff’s contact details and how will these be accessed if entry to the building is not feasible? Are there enough staff in readiness to work remotely and ensure that key communication lines stay open? The ability to locate and contact employees reduces anxiety and ensures that the organisation can resume activities as quickly as possible.

And it is also important to incorporate a generic approach within any basic plan, suggests Marsh’s Dunlop. “Remember that in today’s society, things are dynamic and changing. Even an organisation with the very best business continuity standards can still be faced with something unforeseen and an incident that doesn’t meet the usual criteria”.

Organisations that operate worldwide must also adopt an approach that adapts to local culture and local management, he adds. The booming economy of India has slowly but steadily led to a greater cultural acceptance of risk and the need to manage it. But change has been slower in China, as acceptance of risk and admitting that something is wrong could be considered losing face, which makes discussing business continuity consequently difficult.

Those entering into any form of partnership as part of their work overseas would also be well advised to carry out the same ‘due diligence’ exercise as any business. And with charities expected to employ the strictest ethical methods, any contingency plan should ensure that prospective partners follow them as well.

Top