Security Strategy of a Retail Company for a Business Continuity Plan
Case Study A retailer Business Continuity Management System
Tuesday 7th April 2020
The ASDA Business Continuity Management System; a case study of communications
We have all been watching the response of supermarkets following the initial panic-buying that happened in March in the early days of the COVID-19 pandemic, and that was widely reported in the UK press. Like many people, I am a signed-up customer of a few retailers. I have been impressed with all their responses, but in this article, I will explore the communications that ASDA have been sending to their customers and unpicking what this says about the ASDA Business Continuity Management System.
What has COVID-19 meant for Business Continuity?
The last few weeks have turned the world on it's head, and even organisations with Business Continuity Management Systems in place have struggled to manage their own particular situations.
Business Continuity Management Systems (BCMS) are used by organisations to plan their response to crisis or disruption that affects their ability to deliver their planned service, products or activities. A key component of a Business Continuity Management System is the Business Continuity Plan (BCP). The BCP is best described as a 'buffet' of actions that an organisation can take once it is in a crisis situation. The BCP helps the management team by offering them a series of tested scenarios that can be actioned and will help them restore themselves back to their 'normal' state.
Often, the Business Continuity Plan is developed from the viewpoint that an existing service, product or activity has somehow failed and needs to be recovered. The COVID-19 situation has caused some head-scratching as in general, processes have not failed, but rather demand for them has altered beyond recognition. Business Continuity in the context of COVID-19 therefore requires a serious amount of adaptation, collaboration and communication in order to manage the situation while it is ongoing.
The Business Continuity Response by ASDA
Whilst not being intimate with the ASDA Business Continuity Management System, I have been receiving the emails from Roger Burnley, the CEO at ASDA. I'm not daft enough to think that Roger cares enough to write to me in person, but the fact he is putting his name to these communications says something about the level of seriousness that ASDA is giving this. I am immediately reassured.
I have had four emails; starting on the 16th March (2 days after the Guardian later reported that panic-buying had peaked), and then at regular intervals to provide an update.
The emails tell a story about the immediate actions that ASDA took, and then subsequent actions they took as their response matured and adapted with the changing scenario. I have tried to illustrate the response in the diagram below.
A helicopter view of the email contents highlights five main workstreams in the Business Continuity Plan. These cover the:
- In-store service
- Delivery service
- Customer services
- Community actions
- Workers and their arrangements
I should add that I expect there to be two further workstreams regarding work with the Supply Chain, and collaboration with the UK Government, although I would not expect them to be communicated publicly.
In the initial email, which was on the 16th March, ASDA identified immediate actions to four of the five workstreams. They importantly made the most of existing services that were in place, such as customer services and using existing contact information for its customers. At this stage, it seems that basic facilities and changes were made to the service and working arrangements.
The next email, which was sent on the 21st March identified a further stream of work; ASDA were considering their wider community; especially the vulnerable, the immobile and the critical workers that were otherwise busy with their important healthcare work without the additional worry of having no time to buy essentials in a time of shortage.
The two emails received since (on the 25th March and 3rd April) have continued to demonstrate very positive progress; additional protection for staff in terms of safety and sick pay, as well as confidence for customers that the availability of food and supplies is returning, as is an enhanced ability to deliver it to people needing it.
The last email received also identified a new Volunteer Shopping Card. Effectively, this is a new service to support the community and ensure that people are able to receive needed supplies more efficiently.
It is important to note that the communication has continued; both in the form of email and more in-depth information on the ASDA website. Although not all customers may read the emails, it is crucial that an organisation maintains it's communications over the course of a disruption; it demonstrates leadership as well as a facility to let people know what has worked and what will happen in the future. In short, it builds trust.
What can you learn for your own Business Continuity Management System?
Business Continuity Objectives
Business Continuity Management systems identify the priorities within an organisations suite of products, services and activities that need to be delivered. The organisation can use this information to define its strategies and actions in the event of crisis or disruption.
Typically, an organisation will define a series of Objectives:
- Minimum Business Continuity Objective: the objective level of service to achieve
- Recovery Time Objective: Time based objectives to recover priority processes
- Recovery Point Objective: Data and Information required to recover priority processes
Extrapolating the response by ASDA, they may have set a series of 'Minimum Business Continuity Objective' that include getting stock onto shelves, staffing stores and delivery services, and availability of the Customer Services team. The 'Recovery Time Objective' was probably set initially at 2 days (14th to the 16th March), along with the 'Recovery Point Objective' to have product stocking data and customer information data for managers to use and inform customers. These objectives will have been reviewed and reset numerous time since the onset of the pandemic to cope with changes in the situation.
The three phases of a Business Continuity Plan
Typical business continuity plans cover three phases: 1) Pre-crisis resilience, 2) Crisis Response, 3) Crisis Recovery.
Pre-Crisis Resilience
Resilience actions for an organisation enable it to respond to all predicted disruptive events. Although a global pandemic may have been predicted, the velocity and severity of the situation would possibly have been under-estimated. However, what we have seen in the case of ASDA is that their resilience measures have probably included such things as:
- Having a flexible and trained workforce
- Having good communications with suppliers
- Having a method to communicate with customers
The immediate response (email sent 16th March) was communicated to all customers 2 days after the panic-buying peaked. Some might say that this was too late, but realistically, which supermarket doesn't want to sell all its products?
In the future, when COVID-19 is declared over, ASDA may review their resilience actions and improve them further. Immediate improvements might include early warning on panic buying, or creating additional storage for critical products. Further to the response that ASDA has publicly made, they will more than likely be involved in cross-sector co-ordination with other retailers, the government and the emergency services to manage a response to similar situation.
Crisis Response
In the crisis phase, the Business Continuity Plan covers scenarios that allow it to respond to a given situation. If buildings were burning, the fire service would provide the immediate response. In the event of COVID-19, the initial impact was panic-buying.
The examples shown by ASDA in their Business Continuity crisis response demonstrated a good range of actions. Some of these were very functional; for example, increase supply of certain products, limiting purchase amounts, and providing basic cleaning facilities. However, some of them were more structural; the move to ensure that the Customer Service Centre was able to operate at a larger scale was clearly seen as key to the whole cycle of business continuity that the organisation was about to go through.
There are learning points for all organisations here. What are your immediate priorities, but what can you do immediately that will help you manage the crisis as it unfolds?
Maturity of Business Continuity response increases
Over time, the communications from ASDA have revealed that when the realisation of the crisis situation began to unfold, the business continuity actions were evaluated and improved.
These are the most extraordinary of times and whilst it has only been a few short days since I last wrote to you – so much has happened in that time. Every day I become more keenly aware of our responsibility to help feed the nation – Roger Burnley, CEO Asda (21st March)
Over the past three to four weeks; the response has matured significantly. The resources to provide a more enhanced delivery service has been realised and the company has made hundreds of thousands of delivery slots available. The company has begun to restock shelves and manage the public expectation of availability.
In-store, the safety of customers has been managed with increased signage and controls. The safety of staff has been increased with the introduction of till screens and the sense of security for staff will no doubt have improved knowing they have payment protection and additional money in their March pay packets.
A further workstream then became apparent; within a week of the 14th March (peak panic buying) an immediate donation of £5 Million was given to FareShare and the Trussell Trusts, both of whom are charitable organisations that help provide food to people that need it the most. Further to this, the company also innovated with new services; the 'Volunteer Shopping Card' scheme was released at the beginning of April.
All of these actions show that ASDA are evaluating and developing their Business Continuity response over time. All organisations, whether they have business continuity plans are probably doing this to some extent. ASDAs example identifies that adopting a 'Continual Improvement' philosophy can provide initial results that improve over time.
What about Recovery actions?
At the time of writing this, there are some early indications that the UK Government are discussing 'Exit Strategies', however, it is likely that the impact of COVID-19 will last some time. The life cycle of infection and contagion will continue. Cleaning, sanitisation and social distancing are here for a while. In addition, some of the new behaviours and routines that people will have become used to over the past few weeks may persist; increased working at home, increased home delivery, demand for certain products.
In the recovery phase, a Business Continuity Plan supports the process to transition from a 'Crisis' to a 'Normal' situation. As indicated above, there will be likely be a new 'normal'. ASDA will need to understand that situation fully, although the current approach of reviewing the situations and adapting to it may cover the transition to a significant extent.
The new 'Normal' will likely impact current plans for future business strategy; there may be areas of the current strategy that need adapting – for example – how does ASDA adapt it's current supply chain model to ensure that high-demand goods are available?
Future strategies may also involve more collaboration with its staff and supply chains – for example, how could ASDA maintain links with employees that leave so they can be called on if needed, or how does it build more effective links with facilities managers to ensure store layouts can be adapted or changed at short notice.
All of these actions give organisations insights to their future recovery from business continuity. Whatever your approach to Business Continuity, the current COVID situation has proven that at anytime, situations can develop and impact an organisation.
Related Articles
4 key questions for Business Continuity
3 approaches to Business Continuity
Example Recovery Time Objective
Adam Faiers - Director
Adam has been working on Quality and Environmental management systems for most of his career in small, medium and corporate organisations. A keen advocate of the ISO approach as a platform for improvement, Adam ensures that systems are practical and useful for Managers and Staff to use.
Following a number of years working on software development projects, Adam has diversified into Information Security and Business Continuity management. Keen to formalise his industry experience, he is currently undertaking a Diploma in Business Continuity Management at Buckingham University.
Adam has a PhD from Cranfield University and now supports the MSc Environmental Management programmes through the advisory panel and visiting lectures.
We hope this article has been helpful
If you have any further questions or want to learn more about what we can do for your business, please contact us using the link or details below:
CONTACT US
Tel: 01908 255 525
Email: sales@spedan.co.uk
Source: https://spedan.co.uk/blog/iso-22301-business-continuity/case-study-a-retailer-business-continuity-management-system