"Is the current BCP really useful?" Anxiety is growing against the backdrop of the worsening and frequent damages caused by floods and typhoons, and the increasing urgency of large-scale earthquakes and so on. However, there are many companies that have not even reviewed their BCP since they were formulated. What and how should be reviewed to make it more practical, and what should companies consider when formulating their BCP in the future? We talked to Gou YAMAMURA, General Manager of the Resilience Promotion Sec., Disaster Prevention Dept., Digital Service Div.
INDEX
- Will your BCP measures really work in the event of a disaster?
- It is important to review BCP measures to improve the credibility of the company
- How should BCP reviews be carried out?
- PACIFIC CONSULTANTS' Initiatives
Will your BCP measures really work in the event of a disaster?
The importance of a BCP (Business Continuity Plan) goes without saying. If a large-scale disaster occurs and serious damage is caused to management capital such as people, goods, money, and information, it may become difficult to continue business, and the company may be forced to close. If this happens, employees will have no choice but to leave the disaster-stricken area where they live for searching new jobs. In addition, population outflow from the disaster-stricken area will slow down the progress of recovery and reconstruction, and there is a high possibility that it will lead to the decline of the region.
In the "Basic Plan for Promoting Disaster Prevention Measures for the Nankai Trough Earthquake" presented by the Central Disaster Prevention Council in 2014, the government called for "companies and other related organizations to develop Business Continuity Plans (BCPs) and strive to continue important operations even in the event of a disaster." Since then, BCP development has progressed primarily among large companies, with the current formulation rate at 85.6% of large companies (including those in the process of developing BCPs) and 57.6% of medium-sized companies (including those in the process of developing BCPs) *.
However, while the figures show a high rate of companies formulating their BCPs, only about 34% of companies are conducting the "annual review" required by the government, and nearly half of mid-sized companies still have not formulated BCPs. There is also a large disparity by region, and the rate of BCP formulation in the Hokuriku region, where Noto Peninsula Earthquake occurred, is low compared to the national average, and it has been pointed out that this may be one of the reasons for the current delays in recovery and reconstruction.
It is important to review BCP measures to improve the credibility of the company
One of the issues with current BCPs is that they are not reviewed sufficiently after they are formulated. In many cases, they are left as they were when they were first formulated, and no training is conducted to check whether they are working, or even if they are, they have become repetitive.
However, BCPs need to be reviewed from time to time (at least once a year) and constantly updated to be more practical through training. One of the reasons for this is that damage estimates are constantly changing due to the effects of recent climate change, and factories and offices that were previously considered safe may now be subject to higher water levels, making it necessary to introduce new equipment and take other measures, and the environment surrounding disasters may be changing. In addition, when management policies change and the core business that must be protected first shifts to something different from before, this is also an opportunity to review BCPs.
Furthermore, in recent years, the role that companies play in local disaster prevention has been attracting renewed attention. This is because, under the premise that "unforeseen events can occur," there is a need to increase the disaster response capabilities (resilience) of society as a whole, so that social activities can continue as much as possible and recovery and reconstruction can be carried out as quickly as possible. The power of companies is essential for creating resilient towns.
> For more information on disaster prevention and resilience, click here
For example, in the event of a large-scale disaster, it is expected that public transportation will stop and many people will be unable to return home. If people try to return home, they may encounter secondary damage such as large-scale fires or building collapses, or cause road congestion that could impede the passage of emergency vehicles. Therefore, each company is required to secure a place where employees can stay safely at the workplace, prepare stockpiles of supplies, and function as a temporary evacuation site. Furthermore, if the company can provide this function to local residents, it can play the role of a local disaster prevention base. This will increase the company's social credibility, which will ultimately lead to increased sales and profits.
How should BCP reviews be carried out?
When reviewing your BCP, you need to check that there are no omissions or gaps in the countermeasures, that the damage and response plans are based on the latest disaster situation, and that they are in line with your current management policy.
BCP begins with diagnosis and training
Usually, the PDCA cycle is an effective method for improving a business. However, if you start reviewing your BCP from the planning stage (Plan) using the PDCA cycle, you will tend to include many items that need to be addressed, including low-priority items, and it will be easy for high-priority items to be overlooked or missed. For BCP, it is more effective to use the CAPD cycle, which starts with Check rather than Plan.
The process begins with training that simulates a disaster, followed by an evaluation and review of the results (Check), which leads to practical improvements and measures (Action). The next step is to develop a more practical and efficient plan (Plan), and finally to respond to the disaster and put it into practice (Do).
What are the three components of a BCP?
In addition, when formulating a new BCP, it will be easy to use and will not be missing anything if you consider the following three components. Consider these elements along a timeline and consider "what," "by when," and "to what level" you need to restore compared to normal operating levels.
Implement tabletop exercises and check for gaps and omissions
After formulating a BCP, it is important to actually try it out through training. Training will highlight things like "this is lacking" or "contact is needed here but there is no communication network." There are various types of tabletop training, as shown in the table, so choose one according to your purpose.
| Purpose | Method | Overview and Features | Participants |
|---|---|---|---|
| Improving the image of the damage and the issues | DIG (Disaster Imagination Game) | Using a large map, players can visualize the damage and consider countermeasures to that damage. | Approximately 10 to 50 people, each table can accommodate 5 to 10 people |
| Confirmation of action flow and division of roles | Timeline training | With simple situational definition for each phase, participants will create a flow using large-format poster board and sticky notes while reviewing action items, flow, and division of roles. | |
| Understanding the plan and building consensus | Read-along | Stakeholders in the planning process gathered together to read-along the plan. | Approximately 10 to 20 people |
| Walk-through training | Visit the disaster response section and the locations of the equipment and machinery used at the operation site, point to and confirm that the equipment is in operation, and check the response details. Check if there is anything missing. | Approximately 10 to 20 people | |
| Identifying practical issues to address, such as decision-making | Predictive tabletop training | Under minimal conditions, participants are asked to predict disaster situations, and based on that prediction, they exchange opinions with each other to identify and grasp issues that may arise during a disaster. | Approximately 10 to 20 people. Disaster Management Headquarters (Branch Office) team leader level + person in charge level |
| Improving practical skills and confirming effectiveness | Role-playing training | The game allows players to learn disaster response decision-making skills in realistic situations. With the controller providing moment-to-moment updates, players can work in a real headquarters environment to identify specific issues in disaster response. | Approximately 30 to 50 people. Based on the organization and structure established in the disaster prevention plan. |
DIG is a type of simplified disaster map exercise in which participants (stakeholders) imagine a certain scenario, imagine the damage that may occur and the response that should be taken, and share and discuss them on a large map. All participants brainstorm about all possible damages and their impact on the business, gather as many ideas as possible to compile a picture of the damage, and imagine what will happen in and around the company. DIG and read-through training, and walk-through training are basic, but more practical one includes situation prediction-typed tabletop training and role-playing training.
These exercises, assuming basic training has been completed, are aimed at improving decision-making skills in dealing with unforeseen circumstances.
For example, training participants are shown a simple situation such as "XX business office has been damaged by an earthquake, and nearby residents have begun to evacuate to the factory. There is no power outage, but mobile phone signals are difficult to connect," which are only simple situation that shown to the training participants
and the decision makers are asked to consider issues such as "What information is needed to smoothly distribute stockpiles in this situation? Should it be distributed to nearby residents who have evacuated?", etc. The information that clearly necessary for the decision makers is organized as the "information necessary in the event of a disaster," and the headquarters activities are considered to be required to obtain it and incorporated into the BCP.
If detailed information is provided during training, the training will lack reality. In reality, detailed information cannot be obtained, and communication between headquarters and business offices is not two-way. For example, it is entirely possible that one office can hear the other office, but not the other office. By conducting training under conditions close to a real disaster, it is possible to make the training more effective, rather than training for the sake of training.
PACIFIC CONSULTANTS' Initiatives
Development of consulting services
PACIFIC CONSULTANTS has been working on river disaster prevention projects under the Regional Development Bureaus across the country, while also formulating and reviewing BCPs for the Ministry of Land, Infrastructure, Transport and Tourism, Infrastructure, Transport and Tourism, local governments, sewerage systems, etc. In addition, we are widely involved in supporting the formulation of BCPs/BCMs for private companies, universities, railway operators, etc.
For private companies, we conduct risk assessments based on disaster hazard assessments, expected damage and occurrence probability, etc., based on information such as current flood-prone area maps and landslide warning areas for the locations of facilities that are the subject of business operations. We also support the formulation of mid- to long-term BCPs by building models that take into account future climate change impacts and running multi-stage simulations of the situation several decades to 100 years into the future. Even if things will be okay for the next few years, it is necessary to consider predictions of what the situation will be like in 50 or 100 years' time and proceed with the consideration of countermeasures.
In addition, we aim to support the formulation of plans that prioritize the opinions of employees on the ground, such as by gathering detailed information through interviews with not only management but also employees on the ground about what should be prioritized for protection from disasters, and then reflecting this information in the formulation of BCPs. This is because the people working on the ground are often the ones who foresee what is necessary to continue business.
Development of disaster prevention services
PACIFIC CONSULTANTS has developed and provides the following services and application tools that enable companies to easily and efficiently analyze their own risks, in order to help more private companies, especially small and medium-sized enterprises, raise their disaster prevention awareness and develop BCPs.
- "Shiraberu" (https://xrain.pckk-service.jp/RiskMap/) displays disaster risk information related to floods, landslides, earthquakes, and tsunamis from all over the country on a map, and diagnoses and reports the disaster risk of a selected location. Companies can carry out simple risk analyses and advance measures for facilities and premises they manage and operate.
- "Doshaburu" (https://xrain.pckk-service.jp/dosyabull/storeLink/) is a service and mobile app that combines risk assessment information using XRAIN with landslide risk information and topographical information, displays it on a background map, and uses the device's location information to provide users with the necessary information directly. By registering facilities managed and operated by companies, users can receive notifications of the risk of landslides and heavy rain, making it possible to use the service for efficient patrols.
- We are currently developing a service called "emaxien" (https://www.youtube.com/watch?v=K-lN574bP78) that uses digital technology to collect and monitor information during disasters, support response considerations, support decision-making, and guide actions. A distinctive feature of this service is that "emaxienGather" collects and consolidates information reported and posted from PCs and smartphones about the current situation and damage status (location, situation, photos, etc.) of branches, subsidiaries, factories, and disaster sites, and further automatically consolidates, classifies, and organizes damage information by location and type of base, damage level, importance, etc. In addition, we plan to implement a function that displays all information in a list, displays key information in a topic, and displays it in various formats according to user needs (changing the format according to the user's role and required information), as well as automatically creating and outputting report materials to disaster countermeasure headquarters, etc.
For government agencies and local governments
At "roadside station", which are expected to play a role as disaster prevention function hubs, we support the formulation of BCPs by holding repeated discussions with practitioners about the current state of facilities and equipment, responding situations to the past disasters, and surrounding conditions, etc.
In that case, the BCP will be a thick file because it contains a wide range of content and a lot of information. It is not realistic to pull out this file and refer to it when a disaster occurs. We have created a simple BCP (action card) to serve as a guide for general employees who actually respond to disasters. The action card selects only the necessary keywords, shows what needs to be done along a timeline, includes illustrations, and has check boxes, so that it can be referred to and acted upon when a disaster occurs. We have taken care to make it easy to use, such as by color-coding it according to the type of disaster, such as earthquakes, typhoons, and floods.
The formulation and review of BCP requires the assessment of important operations and specific functions necessary for business continuity, as well as disaster hazard assessment and risk assessment based on expected damage and occurrence probability, etc. However, this is difficult to achieve from only one company's perspective.
PACIFIC CONSULTANTS has many experts in disaster prevention for rivers and roads, BCP formulation and training, and has comprehensive knowledge and know-how, including many achievements in companies and government. We would like to contribute to improving the business continuity of companies and building disaster-resistant towns by formulating more practical and effective BCPs.
*From the "FY2023 Survey on Business Continuity and Disaster Prevention Initiatives of Companies" (Cabinet Office)
