PwCs research addresses the issues of business continuity and crisis management, as well as analyses the level of business continuity management system development in Russian companies.
In todays world, companies are constantly faced with large-scale incidents these can be cyberattacking, serious failures in IT infrastructure, technological accidents, natural disasters, epidemics or pandemics. In this regard, such a process as crisis drills becomes particularly important. Of course, one can not prepare for all threats in advance. However, practice shows that companies that have prepared in advance for negative events are able to recover in a shorter time, and their processes, even during the elimination of large-scale incidents, do not stop completely, which ultimately allows minimizing losses from the incident.
For preparation of the analytical report one used the data received as a result of the anonymous poll of respondents from different branches: financial sector, spheres of information technologies, transportation, telecommunications and others were used. As a result, an analysis of Russian companies response for crisis situations is presented, which includes, among other things, a comparative assessment in some areas from 2019.
Roscongress Foundation analysts highlighted the main theses of this research, accompanying each of them with suitable fragments of video broadcasts of panel discussions held as part of business programs of the key events hosted by the Foundation.
As compared to 2019, the share of companies that faced significant interruptions in their operations increased: 47% in 2020 against 40% in 2019.
The survey results show that up to 47% of companies have encountered a significant incident in their activities that led to the stoppage of critical business processes or services. At the same time, most companies were not able to return to staff mode in a short time it took more than four hours to restore critical business processes or services. Among the reasons for long downtime the respondents mainly mentioned the failure of the information system, interruption of power supply, and cut of the communication channel.
According to the authors of the research, one of the main factors of the success of actions to resolve emerging incidents is the degree of preparedness of the organisation and early development of the main measures and actions for crisis response.
Companies that were able to recover from a major incident in a short period of time noted that factors such as developed recovery plans (25 percent) and formed recovery teams (25 percent) affected the speed of response.
The availability of a pre-established crisis headquarters and regular testing of plans and crisis drills have also had an important impact on the rate of recovery.
Crisis management issues are more actively addressed by organisations with large industry regulation: the financial sector, FMCG, oil and gas sector and government agencies.
Despite the increased interest of organisations in conducting crisis drills compared to last year, almost half of the participants of the study do not implement this element in the processes of business continuity and crisis management.
Quite often companies perform tests only for a part of functions or resources, practicing the inaccessibility of specific objects, such as information systems. As survey results show, this testing format is chosen by 28% of respondents. At the same time, in a significant part of cases (46%), companies test the possibility to restore a process, function or system as a whole, without any reference to the type of accident, i.e. no specific scenarios for each test are developed.
Analysis of the research results conducted by PwC experts shows that 50% of companies use tools to automate crisis management processes. The most common are systems of crisis communication automation (SMS-notifications, e-mail-mailing, etc.) and systems of monitoring and recording of incidents they are used by 62% of respondents.
Business continuity and crisis response processes should be documented, including continuity plans, crisis communications plans and escalation procedures.
The authors of the research point out that the heads of companies need to actively develop the processes of increasing their readiness for crisis situations, implementing them systematically, as part of the business continuity management process. The roles and responsibilities of crisis team members and recovery teams should be distributed within the company.
All departments involved, including information security, information technology, risk management, personnel management, physical security, business continuity should be involved in the preparation and conduct of crisis drills.
Crisis drills should be conducted on a regular basis. Ideally, all key parts of the company should be involved in the exercise or testing, and the recovery of all critical processes should be tested. Drills should not be an end. It is mandatory to prepare a report on the results of the drills, describing both positive observations and identified shortcomings with a plan for their elimination.
Crisis drills should be scenario-based, linked to a specific threat or set of threats, in order to develop processes, identify latent deficiencies in procedures and understand the level of preparedness for such threats.
We also invite you to see other materials posted in special sections of the Roscongress Information and Analytical System Entrepreneurship, StayHomeEkonomy and Pandemics, dedicated to possible ways to counteract epidemics, one of the most serious threats of non-economic nature, ways to stabilise the economy in a complex epidemiological situation, as well as measures to develop entrepreneurship.
