In the face of increased risk, charities must draw up contingency plans. Patrick McCurry provides some advice.
The terrorist attacks in London last July temporarily paralysed the city, and more recently the potential effects of a bird flu epidemic raised alarm. But it is not only dramatic events such as these that can put charities' operations at risk. A burst water main, a fire or a serious computer virus can also jeopardise a charity's work and potentially put vulnerable client groups at risk - the feature on page 26 shows how the worst can happen.
In response to these threats, a growing number of charities are putting in place business continuity plans - an attempt to make sure they can handle emergencies, continue to function and recover effectively afterwards.
1. Decide whether you need a plan Not every charity will need a formal strategy, but regulators and insurance companies are pressing charities, at the very least, to take risk assessment and mitigation seriously. For example, charities with incomes greater than £250,000 must include a statement in their annual report on the major risks facing the organisation and what systems have been established to mitigate them.
According to the Charity Commission, there is no uniform approach and it is up to the trustees to decide the best way to manage risks. A spokesman says that although a village hall charity might not feel that having a continuity plan in place for a bomb attack is the best use of resources, there could be other risks associated with its activities. "We would expect trustees to identify such risks and think about the best ways of dealing with them - even if some smaller charities may not formally designate these as business continuity strategies or business recovery plans," he says.
2. What should a plan include? A charity must first consider what its business essentials are - in other words, the minimum infrastructure and services it would need in order to function. These essentials will vary, depending on the charity. A grant-making organisation, for instance, could perhaps get by with inaccessible offices for a couple of weeks, but to lose all its data on grants would be a disaster. On the other hand, the business essentials of a care home would involve being able to provide continuous service to its clients.
Once the essentials are identified, the charity can assess the main threats, judge how likely they are to occur, then decide what can be done to mitigate them and which systems can be put in place if a disaster strikes.
3. Is the process expensive? The cost in staff time of drawing up a plan will depend on the size of the organisation and how robust its risk management systems are. Richard Weighell, a partner at consultancy PKF, says that if the charity already has a good risk management policy in place and therefore appreciates the major risks, it will take much less time than an organisation that has a paper policy but no other procedures.
A charity with turnover of about £10m, he says, could expect to spend 25 days of senior management time on producing a first-draft business continuity plan.
4. Make sure managers take responsibility One senior manager, such as someone from ICT or facilities, might drive the process, but it is important that managers across the organisation take responsibility for business continuity. This is because operational managers are the people who understand their departments best and can report any changes in processes or personnel that could affect the continuity plan. Operational managers will first need to be persuaded of the importance of such planning. "It can be hard at first to get managers on board, because people think disasters will never happen," says Terry Leahy, facilities manager at the Children's Society.
5. Keep the plan up to date A common problem with business continuity plans is that they are drawn up but then gather dust and, when needed, fail to work properly. It is crucial, then, to keep them up to date and, where possible, test aspects of the strategy. Having regular meetings of managers from different departments can ensure business continuity activities are co-ordinated and any changes in departmental procedures incorporated into the plan. An annual risk review can cover each department's preparations, with plans perhaps published on an intranet to make it easier to spot overlaps or inconsistencies.
6. Consider suppliers in your plan - Although the focus of a business continuity plan will be on the organisation's own activities, it is also worth looking at the role of suppliers, because charities can be affected by problems in the supply chain.
When carrying out tendering, some charities ask potential suppliers how resilient they are. For example, a charity that uses a printer's premises to store fundraising materials in the run-up to major campaigns might want reassurance that the company has alternative storage sites in the case of a fire.
7. Is it worth hiring an external consultant? Charities can use consultants with expertise in risk management and business continuity. However, if the charity hands over too much responsibility, the danger is that it ends up with a glossy document that nobody really understands. Even if the charity uses external help, it is important that it takes the main responsibility for the exercise. Information is available from sector bodies such as the NCVO (www.ncvo-vol.org.uk/askncvo). As with many other topics, one of the best options is to ask other charities how they handled drawing up business continuity plans.
CASE STUDY - CENTREPOINT
The terrorist bombs in London were a wake-up call for housing charity Centrepoint to develop a business continuity plan. The charity's then head office was only a few hundred yards from one of the explosions at Aldgate Tube Station.
"We learned a lot that day, in particular the effects of communication and transport networks being paralysed and the importance of being able to account for all your staff very quickly," says Stuart Rogers, director of business improvement at Centrepoint.
Since then the charity has been drawing up a formal business continuity plan focusing on issues such as where to move office-based staff and hostel-based young people in the event of an emergency.
"It's not just about terrorism, but all kinds of threats, including a fire or an epidemic affecting one of our buildings," says Rogers.
He says the charity has been developing an IT recovery infrastructure and a plan to redeploy staff and young people, based on different disaster scenarios.
Moving young people based at Centrepoint's projects and hostels would probably be easier than finding alternative office accommodation for its staff at short notice, says Rogers.
As for ICT security, the charity is implementing a 'mirror' system, which means the computer information held at head office will be replicated at a location outside London. "That means in the event of a crisis we can flick a switch and move to the other system," says Rogers.
HOW CHARITIES ARE FACING THE CHALLENGE
CHILDREN'S SOCIETY: TERRY LEAHY, FACILITIES MANAGER
We set up business continuity planning about five years ago. We have found the most important thing to be continuous review of processes and behaviours so that the plan stays robust. A couple of years ago, a workman accidentally cut off the phone system at our head office in London, which meant we were without phone lines for a week. Thanks to our business continuity planning, we had an arrangement with an external company to receive incoming calls on our behalf and pass the content on to charity staff via email ROYAL LONDON SOCIETY FOR THE BLIND: ANDY ROWELL, MARKETING AND COMMUNICATIONS MANAGER
We operate primarily from three locations. For some years now, we've run a comprehensive risk register that has become the basis of our plans for business continuity. We com-menced specific disaster contingency planning earlier this year. Although we are gathering information on normal situations, such as the loss of a location, we also need to identify elements that working with blind and partially sighted people necessitate. This will take a considerable time to pull together, but we consider it a worthwhile investment NCVO: TRACY KIERNAN, HEAD OF CENTRAL SERVICES
For the past three years, we've paid a retainer to an outside company so that in an emergency we could relocate our work to a temporary office.
We divide scenarios into minor, major and catastrophic. Not having access to our building comes under catastrophic. A major incident would be the air-conditioning flooding and wiping out our servers. We back up data and store it outside London. Keeping the plans up to date is crucial.
We contact staff regularly to ensure they haven't changed their phone numbers, so we can contact people quickly in a disaster.
SCOPE: THOMAS METZLER, ASSISTANT DIRECTOR OF ICT
We provide services round the clock, so we need to be able to safeguard our infrastructure. It's not like a private company where the risk is financial. For us it's more important - it's about people. Each of our departments at head office went through its own continuity planning, focusing on what services should be ensured and the location of data such as passwords.
We identified who could take over the work of the department at short notice and found a space at another Scope building to use as a temporary HQ in the event of a disaster affecting our main office.