Lockdown has highlighted crisis management; firms must ready for a range of risks
Organisations received a tough lesson in the importance of crisis management when COVID-19 struck earlier this year. States of preparedness varied widely as many companies and practices were immediately forced to move their workforces to remote working, and to grapple with the issues that ensued from lockdown.
This pandemic is an extreme example, but it is just one of a number of events that can cause major upheaval. The floods that affected numerous parts of the UK last winter, causing significant damage and disruption, provide another recent illustration of how critical business continuity planning is. Fire, staff illness and power outages are others that all too frequently disrupt an organisation’s day-to-day operations.
Relocating staff and premises is one part of crisis planning that all businesses had to deal with during lockdown. Feedback from ICAEW’s Quality Assurance Department suggests firms” responses to the crisis fell into two camps: those that had already moved to cloud-based solutions and found the move relatively straightforward, and those that still used mainly paper files or internal servers and therefore struggled.
ICAEW Senior Manager Janet Hartas says the experience is prompting the latter group to take action. “Informal feedback suggests that firms that were not using cloud-based solutions have either invested in this or are seriously thinking about it.”
As many firms have discovered in recent months, planning for all staff to work remotely involves securing the right technology (phones and laptops) for employees to use outside the office, keeping this equipment up to date and ensuring it is issued by the company, where possible.
Richard Anning, Head of ICAEW’s Tech Faculty, recommends that practices use virtual desktop infrastructure (VDI) on laptops. This involves users signing into a browser and using this to access a virtual company machine. “Use reputable public cloud-based servers to back up applications and files,” he says. “And protect data by avoiding emailing attachments. If staff absolutely have to send attachments then they should encrypt them.”
Preventing data breaches and cyber attacks will have to become more of a priority for firms as staff work remotely. Much of this protection, says Anning, comes down to patching and preventing phishing. “Make sure that staff are trained about phishing and keep sending messages out to reinforce this. It’s all about having a security culture – not keeping company data on home kit and using a VDI for all work-related matters.”
Existing insurance policies may provide some elements of cover against cyber risks. In this, as with other insurable risks, firms need to make sure that they are properly covered, not only for office-based work, but also when staff are working remotely.
Claire Phillips, ICAEW Professional Indemnity Insurance (PII) Committee Secretary, says the danger is that firms have gaps in their cover. “They should be speaking to a professional adviser about the value of different types of insurances that can sit alongside their PII policy, such as business interruption insurance and cyber cover.”
The market for PII has hardened over the past 18 months and many firms are either finding it hard to get the right cover or seeing premiums increase. Phillips’ advice is to prepare early for renewal and be thorough in reviewing and strengthening risk management processes. “You need to look at what you can do to mitigate the risk of a claim and be open and honest with your brokers in arranging cover.”
If a firm’s principals or key staff are absent or ill, this can also be critical to business continuity. Key person insurance can offer financial recompense, but it won’t help complete client work.
ICAEW strongly recommends that sole principals appoint alternates – a suitably qualified individual or firm who can continue running the practice in the event of the principal’s death or incapacity. Firms can register their alternates with ICAEW. There have been a few instances recently where the alternate has not been registered and this has caused a problem for the practice.
All firms must consider succession planning, recommends Hartas. “Say the firm is split along client service lines. Principals should think about what would happen if one of them was unable to work or died – who would pick up the reins in that area?”
One of the major lessons from the current crisis when it comes to people management is the need for greater data on how people are working and being affected by changes in firm practice, says Ed Houghton, CIPD Head of Research and Thought Leadership.
‘Having good data that describes how people conduct their work, how productive they are and how engaged and motivated they are can help create much better decision-making processes and support staff on a more individualised basis.’
Houghton advocates a set of principles that can guide decision-making through an organisation. “You can have a one-size-fits-all approach that will be efficient and appropriate in some crisis situations but there will be specific requirements that need to be maintained for specific groups over the longer term. That’s why flexibility of process is very important.’
Find out more about alternates, sole practitioners and sole principals here.