Business continuity and disaster recovery in the retail sector

Citation

Gaddum, R. (2002), "Business continuity and disaster recovery in the retail sector", International Journal of Retail & Distribution Management, Vol. 30 No. 7. https://doi.org/10.1108/ijrdm.2002.08930gab.001

Business continuity and disaster recovery in the retail sector

Business continuity and disaster recovery in the retail sector

Last September's fuel crisis, autumn/winter floods, foot and mouth disease, anti-capitalist demonstrations in London, riots in Bradford, Burnley and Oldham and a Real IRA bomb in Ealing are a selection of the more exceptional events in the UK alone that resulted in disruption to retailers and their essential suppliers in the last 12 months or so. Now there may be an increased threat of terrorist action associated with the UK's role in Afghanistan supporting the USA, following the World Trade Center catastrophe on 11 September. Add to that the more likely, mundane, but nevertheless serious causes of disruption such as theft, vandalism, fires, power interruptions, storm damage, computer system failures, and plumbing problems (to name but a few) and one begins to understand the need for business continuity and disaster recovery.

Of course, the largest retailers have so many stores that they can expect some level of disruption to branches on a regular basis, for example, due to a planned refurbishment programme, and management of this disruption is an operational matter; it is dealt with on a regular basis. The impact on the company is relatively small, the likelihood is relatively high and the organisation has experience of dealing with these disruptions. Hence over time it may come to be treated as an operational problem. Business continuity management has no place here, other than perhaps in an advisory capacity and in case the issue escalates into something extraordinary. For example, if deliveries fail to arrive at a store on time, then that is an operational incident. It could well be the result of a road traffic problem; we all have plenty of experience of traffic-related delays on the UK's overcrowded roads. However, if those deliveries continue to fail to arrive and this is occurring simultaneously and widely throughout the UK, then something extraordinary is occurring and its impact is clearly greater.

An escalation path from operations management to business continuity management is required. Some guidance will be necessary for operations to ensure that the business continuity team is notified of incidents that could worsen to create a serious business impact, if not resolved as planned, besides immediately contacting the team in the event of a major incident. It is all very well having a business continuity management group, but that group is ineffective, if it is not informed of, and involved in, incident response at the earliest possible juncture.

The potential impact of any incident on a retail business is the key determinant for justifying business continuity and disaster recovery mitigation efforts. For a smaller retailer with few alternative channels, the temporary loss of a single store could be business-critical, which makes it worthwhile reducing the exposure to such a disruption and developing plans to recover, should the disruption nevertheless occur. There will also be exceptions for large retailers, where the store in question was more important due to its revenue generation, proximity of other stores, and so on. The 1996 Manchester bomb and the consequential four years to return its store to normal trading undoubtedly had a significant impact on Marks & Spencer, its affected staff and customers. The nature of the disaster, particularly if it results in fatalities and injuries, also introduces particular problems that are outside the normal remit of operations management and where business continuity management can make a positive contribution.

Business continuity management must strike a balance, focusing on preparing for and reacting to incidents that lie beyond operations management and where the impacts are truly business-critical. For a large retail operation, individual stores are less critical. There are many of these and the business will survive the loss of any one store. The loss of a major warehouse, distribution centre or a single critical supplier could result in a serious business impact – as could any disruption affecting the company's headquarters operations and its IT systems. A loss of IT systems could, for example, result in an inability to accept electronic payments from customers by credit/debit/store cards, inability to update inventory records with goods sold and deliveries received, failure to pay staff and suppliers and a loss of financial control.

So what are the business continuity priorities for a retailer in the event of a major incident?:

1. 1.

   First and foremost, it must protect the public, in particular its customers and its staff, and be seen to be doing so. The power of the media is such that any failure in this duty could result in damage to the company's image. In fact, serious consideration should be given to the development of a crisis PR communications management plan, which might also proactively address serious PR-only incidents, for example, a product recall due to suspected product contamination. Protection of the public will require appropriate and well-rehearsed emergency procedures, liaison with the emergency services and with neighbouring businesses. In the example of the 1996 Manchester bomb, members of the public were evacuated to Victoria Station and, when the bomb subsequently went off, 240 injuries were caused by the collapse of the Station's glass roof. Muster points should be selected with care.

2. 2.

   The sale of merchandise must be recovered. This will require the re-establishment of inventory control and distribution and a means of allowing customers to review, select and make their purchases.

3. 3.

   Financial control must be re-established, with suppliers and staff paid, in order to obtain their confidence and support for business recovery.

4. 4.

   Once the business has been stabilised the company can direct its attention to longer-term recovery activities associated with getting back to normal. This might include the compilation of insurance claims, removal of damaged furnishings and stock, redecoration, rewiring, refurnishing and re-equipping, culminating in a controlled return to normal operations.

It certainly does not have to be something as dramatic as a fire or a bomb to threaten to disrupt the business. For example, high street jeweller, Beaverbrooks, called in Guardian iT following a software fault at head office, when the administration system holding its vital stock control data was out of action for three days. Guardian's technical experts worked through the night to load back-up tapes on to a new server, so that staff could continue working as soon as possible, highlighting the importance of effective IT disaster recovery arrangements (a replacement server) and support (Guardian's technical experts).

For many retailers, business continuity planning must now encompass e-commerce operations, including an Internet-based facility for its clients to order its products. To many customers, the company's Web site might be their principal means of interaction with the business – ordering goods and establishing when they will be delivered. This new store is expected to be open 24 hours a day, 365 days a year, Web site pages to be available within a few seconds and the security of credit card details guaranteed. It may handle vast transaction volumes with minimal staff support requirements. Yet the retailer has little or no control over the PCs that customers use to access its Web site or the traffic problems that they might encounter as they traverse the Internet's infrastructure via Internet service providers and telecommunications carriers. This creates a whole new set of demands on a retailer's business continuity and disaster recovery operations to meet the new threats and to make sure that this new channel remains highly available and secure – because, if it fails, the impact on revenue and corporate image is potentially immediate and fall-back call centres are likely to become rapidly overwhelmed.

Clearly there is a strong case for business continuity management in the retail sector. However, business continuity management is best applied judiciously to obtain maximum benefits for a minimal effort and expenditure over time. This is best achieved by undertaking a business impact analysis to determine which areas of operations and business processes must be the focus of attention. Then we can determine how these can be protected from the risk of business interruption and develop plans for timely reinstatement in the event of an incident.

For more information: www.guardianit.com or Tel: 01932 835900.

Robin GaddumManaging Consultant, Guardian Consulting