Business Continuity Planning During The Ebola Crisis

Critical Functions of Malaysia Airport Holdings Berhad

Discuss About The Business Continuity During The Ebola Crisis.

In the contemporary society, business continuity is one of the critical subjects to explore and unveil the long-time-hidden information beneath it. Even though business continuity planning is important, it has been given a blind eye by researchers and business scholars for quite some time. These scholarsgive much attention to other subjects that have less and unfelt impacts to business organizations. Business continuity planning is precisely defined as a process in which organizations prepare for natural and human-made catastrophes. These are catastrophes that would cause a negative impact on a particular business, say, property loss, loss of life, financial loss as well as business interruption among other effects (Bernstein, 2015). The general aim of business continuity planning is to ensure the security of all business resources like human, financial, physical resources among others. Evidently, organizations that have a well-developed contingency plan usually have a successful recovery from a particular unpredictable disaster, say fire, etc. These are the organizations with exemplary continuity plans and whose personnel are adequately trainedon the same.

Thispaper aims at helping a selected established company to develop a plan in the zeal to help it reduce financial, human and business operations impact should that company face a disaster. To develop this plan, this paper will identify the selected company, identify the possible threats, identify the critical functions, undertake a business impact analysis, recommend a prevention and mitigation plan as well as structuring the implementation and maintenance of the plan. For this study, the company that will be helped to develop a business continuity plan is Malaysia Airport Holdings Berhad. Thiscompany is an Airport Management industry that was founded in 1991 and which is located in Malaysia Airports corporate office in Kuala Lampur International airport.This company operates on RM 777.3 million operating income with 10, 000 employees and therefore relevant in this study.

Airport companies like any other business have some unpredictable risks that have at times paralyzed the company operations when corrective actions are notimmediately taken and where at times these corrective actions fail to bring complete recovery (Elliott, 2017). Some of these threats include and are not limited to:

1. With the current advancement in modern technology, airports have become vulnerable to terrorist attack and this is one of the significant threats evidenced all over the world not even in Malaysian aviation companies alone. Many a times travelers have been hijacked and attacked while on board(Elliott, 2017) (Boersma, 2015). Other times the airport companies have been physically assaulted and in severe cases, sometravelers kidnapped leaving the company in a state of imbroglio if the corrective measures are not taken immediately.
2. While there have been significant cases of terrorism in airport companies, the offense has also been reported in various airport companies all over the world. Malaysia Airport Holdings Berhad is not an exception in this case. Crime, in this context, means performing a specific act in violation of a particular stipulated law, say theft, among other crimes.
3. Natural disasters. Natural disasters are some of the most contingent threats that can hardly be predicted. These disasters range from storms, earthquakes, heavy winds, flood among others(Jalali & Rahmandad, 2016). Most of the times these disasters strike without warning and leave the airport company in a state that can hardly and will be very expensive to recover.
4. Public disorders. Based on the fact that this company processes thousands of customers and passengers all over the world with different originalities, there is a considerable likelihood of the risk of violence and altercations. It is in this case; immediate corrective actions ought to be immediately taken lest the company operations paralyze abruptly.

Critical functions in an airport company perspective are those very vital activities in the survival of an organization and the resumption of business operations in the event of a contingent disaster (Jain, 2016). Usually, the most critical functions in any given company are the ones that:

• Are very sensitive to the extent that they should not take downtime.
• Maintain cash flow by fulfilling legal or financial obligations
• Play an essential role in maintaining the business reputation and the market shares.
• Are responsible for the safeguarding of irreplaceable assets of the company.

Identifying Possible Threats

Following the above insight on what the critical functions are, it is imperative to lay out the steps that are involved in determining essential business functions as well as spelling the considerations for determining the criticality of a function. The steps involved in deciding critical business functions are:

1. Identification of the vital functions of the company
2. Classification of these functions into two categories, i.e., high, medium and low. High functions are the most severe while the medium and low functions are the less critical.

• Come up with a conclusion on which function is more critical than the other and arrange them in the order of their criticality.

• How frequent the function happens or occurs
• The business goal that is supported by the function
• How many departments perform the function in question
• Whether or not there would be a significant financial loss of the function is not executed
• Whether or not there would be punishment and other litigations for noncompliance because of a compulsory regulatory requirement.
• Whether or not the noncompliance is associated with downtime for the function.
• Whether or not the business function affects the business image and reputation of the company
• The priority that you would give the function in question about all the other functions in the business or company.

After much consideration and determination, this study has found that the most critical functions in the study company are financial, operations, reputation, and regulatory functions. These are the functions that would require immediate recovery in the case of occurrence of an unpredicted disaster lest the whole of the business entity collapses (Pereira, 2014).This is to mean, therefore, that these are the most critical functions in the company whose downtime should be reduced to as low as possible and whose breakage or nonfunctionality should be addressed and corrected as quickly as possible (Rackham, 2014).

A business impact analysis is used to predict the repercussions of a business function disruption and acquires information that would help to develop a recovery strategy (Stark, 2015). It precisely is a systematic process of determining and evaluating the potential effects of cessation of vital business operations resulting from a disaster, accident or emergency.

The purpose of this contingency plan is to prioritize the critical business functions in Malaysia Airport Holdings Berhad in the event of an unpredicted disaster.

• Business processes and recovery criticality. The critical business functions are identified and the impact of the event if a disaster determined as well as the estimated downtime.
• Identification of resource requirements. This involves the required amount of resources to resume business operations satisfactorily.
• Prioritization of the critical functions. This will aid inarriving at the order of recovery of business functions.

Malaysia Airport Holdings Berhad is the leading airport management company in Malaysia. It manages flights within and without the country linking different countries in the world. It is located in Malaysia Airports corporate office in Kuala Lampur International airport and was founded in the year 1991 (Root & Bruner, 2016). The critical functions of this company are operational, regulatory, and financial and reputation functions.

In the event of a disaster, the critical functions of this company will be faced with some challenges. Different disasters would bring about varying impacts to the business operations. The results would revolve within:

• Financial problems whereby the disaster negatively affects the financial capacity and wellbeing of the company.
• Legal problems. This would include noncompliance in the event of an occurrence of a disaster that directly affects this function.
• Loss of reputation. In the event of occurrence of a disaster, a company may lose its reputation and spoil its image in the external environment
• Operational challenges. Sometimes after a company is struck by a disaster, the company operate may be brought to a halt.

Depending on the function criticality, the required downtime for each function on the company would be:

Function	Maximum tolerable downtime	Recovery time objective	Recovery point objective
Financial	72 hours	48 hours	12 hours
Operations	80 hours	60 hours	24 hours
Reputation	88 hours	65 hours	36 hours
Regulatory	90 hours	72 hours	48 hours

Due to the nature of the company and the functions involved, the resources that would be required for recovery are financial and human resources (Levy, 2016). These resources requirement will be dependent on the scope of the disaster and type of the disaster

Based on the criticality of each function, the recovery priority would be financial, operations, reputation, and finally regulatory functions

This prevention and mitigation plan intend to do away withvulnerabilities and hazards, reduce their probabilities and reduce the consequences of certain risks or threats (Varma, 2015).According to the possible airport threats mentioned earlier in this paper, the potential mitigation and prevention methods would be:

Business Impact Analysis

Terrorism attacks as one of the major threats would be reduced by exploring new possibilities of and employment of video surveillance as well as PSIM platforms that will undoubtedly bring about situation awareness as well as provide the so-called actionable intelligence (Shin, 1014). Thismove will be arrived at by adapting vast amounts of data from different systems and routing the so acquired information to the relevant people and at the required time.

As mentioned earlier, crime is another threat to airport companies. Use of IP surveillance technology with video analytics that is entrusted in it will help reduce crime and provide immediate response in the event of this disaster (Wallace & Webber, 2017).

To mitigate natural disaster, modern video technologies that provide much situational awareness during and after a natural disaster will help.This move will help the officials direct the necessary response to the right places as well as evacuate the victims of the disaster to a safe place with ease.

The threat of public disorder can be prevented and mitigated by the use of video surveillance technology in conjunction with targeted analytics to monitor areas of high risk as well as response personnel to the fields before the escalation of the situation.

This involves putting the formulated strategies into practice and how to manage them for the wellbeing of the company as far as disaster management is concerned.

The implementation of a business continuity plan is significant to the general success of any hazard mitigating planning (Chung, 2015). The implementation process of this continuity plan for Malaysia Airport Holdings Berhad will be:

• Goal setting. Here, the planning team will define objectives for the entire process, peoples involved and the tools to be used. These goals are essential inputs in the implementation process, and they create understanding and motivation amongst the organization stakeholders.
• Identification of the risks. Here, both the threats and the possible dangers in the process of implementation will be identified. This gives the planning an insight of how to go about the implementation process.
• A decision on when to launch the process and tools. The team will decide on when to conveniently start the entire process to the broader audience, company stakeholders, and any other relevant persons. In this step, a decision on how to facilitate the launch will be made including training, looking for mentors among others.
• Planning of training. The company will study the current competence of its stakeholders. Areas where the stakeholders need to raise their level of expertise will be identified, relevant tools identified and the training is done(Sahebjamnia, 2017). In this case, people will be trained on how to deal with threats such as fire outbreak, crime, terrorism among other contingencies.
• Mentorship programmes. Mentors are critical to planning implementation process. Each critical function will get a mentor to mentor the associated people accordingly. Mentorship tools and resources will be provided in this step.
• Final acquisition and practice. All the stakeholders, fully aware of the plan will begin putting the plan into practice and do all that is stipulated therein to ensure that contingent threats are mitigated.

Continuity plan management is one of the most important processes because it ensures that the plan is up-to-date and operating well in a given company (Yuasa & Nakano, 2017). It is a process in which the planning team tracks the implementation progress and advises on the necessary update. This maintenance plan must include the method and procedures for evaluating, updating and monitoring the plan in a given period, say five years (Furfaro, 2016). The maintenance process will be as follows:

Monitoring the implementation. This will involve tracking the implementation process over time. The monitoring team will be responsible for the tracking of the mitigation actions and give a report quarterly(Hawkins, 2016). Every function will be monitored ranging from financial to regulatory function. The planning team will, in this case, identify the agency and assign to it the mitigation actions to monitor. In the case of educating the public or installing video surveillance systems, the monitoring agency will watch whether the process is proceeding as stipulated and give their report on the same.

Preventive Measures

Evaluating effectiveness.The plan’s likelihood of achieving its goals and objectives will be assessed by the monitoring team(Haji, 2016). In the zeal to increase the awareness of the public on risks and hazards, the monitoring team will conduct research yearly to know how much knowledge the public has on risk and hazard management. The evaluating agency, spelled out by the planning team will annually prepare a report that demonstrates the progress of the plan implementation (Kiessling, 2015). In this case, it will also evaluate the number or percentage of actions that have already been implemented.

Updating the plan. The planning team will review and revise the plan once in every five years to reflect changes in the development, progress in the planned mitigation efforts as well as the differences in priorities(Setiawan, 2017). This will help correct the flaws and ensure workability of the plan to suit the changing environment and people affected. The updating procedures will be stipulated by the planning team that will ensure that the plan is kept up-to-date and functional.

Conclusion

It is an undisputable fact that unpredicted risks will always strike any given company, whether small or significant. The good news is that the effects caused by these contingencies can be mitigated and reduced so that their results are not felt so much and that they do not stop or paralyze the company operations something that can lead to its closure. This can be achieved through the formulation of a reasonable and workable business continuity plan. However a plan is essential, it is crucial to appreciate that the implementation and maintenance of the plan are very imperative too as far as risk and hazard management is concerned. It is therefore critical to ensure that any business plan is implemented successfully and maintained to ensure that companies do not suffer much loss in the event of occurrence of a risk.

References

Bernstein, A. (2015). Things happen: putting in place a business continuity plan. Nursing And Residential Care , 7 (4), 45-50.

Chung, L. (2015). Impact of pandemic control over airport economics: Reconciling public health with airport business through a streamlined approach in pandemic control. Journal of Air Transport Management , 9 (17), 64-77.

Elliott, T. (2017). City of Portland Water Bureau Business Continuity Plan (BCP)/Continuity of Operations (COOP) Case Study. In Congress on Technical Advancement , 56 (12), 34-40.

Furfaro, A. (2016). Modeling cyber systemic risk for the business continuity plan of a bank. In International Conference on Availability, Reliability, and Security. , 10 (15), 34-43.

Implementation

Haji, J. (2016). Airline business continuity and IT disaster recovery sites. Journal of business continuity & emergency planningg , 47 (16), 45-56.

Hawkins, J. (2016). Communities that care. In Encyclopedia of criminology and criminal justice (pp. 393-408). Springer New York , 7 (2), 49-53.

Jain, A. (2016). Implementation of Maintenance Management in a Medium Size Industry for Optimization of Maintenance Cost: A Case Study. Journal of Operations Management , 78 (9), 89-95.

Jalali, M., & Rahmandad, H. (2016). ynamics of Implementation and Maintenance of Organizational Health Interventions. International journal of environmental research and public health , 5 (7), 68-75.

Kiessling, F. (2015). Contact lines for electric railways: planning, design, implementation, maintenance. John Wiley & Sons , 37 (54), 56-59.

Levy, J. (2016). Business continuity planning for economic resilience in Hawaii. In Global Conference on Business & Finance Proceedings. Institute for Business & Finance Research , 80 (4), 56-65.

Pereira, S. (2014). Confrontations for the implementation and maintenance of educational groups for pregnant women in primary care. Demetra , 56 (13), 78-83.

Rackham, R. &. (2014). Emergency planning and business continuity: why blood services must plan for both. How the EBA working group (WG) is assisting blood services. , 56 (34), 46-53.

Root, Z., & Bruner, M. (2016). Evaluation of physical activity interventions in children via the reach, efficacy/effectiveness, adoption, implementation, and maintenance (RE-AIM) framework:. a systematic review of randomized plans , 57 (17), 67-78.

Sahebjamnia, N. (2017). Integrated business continuity and disaster recovery planning: Towards organizational resilience. European Journal of Operational Research , 10 (57), 45-53.

Setiawan, A. (2017). Risk analysis on the development of a business continuity plan. In Computer Applications and Information Processing Technology. International Conference , 70 (47), 45-56.

Shin, H. (1014). A Basic Study for Securing the Business Continuity of Local Governments in the Event of Earthquake and Tsunami. Journal of The Korean Society of Disaster Information , 5 (4), 37-51.

Stark, C. G. (2015). Maintaining Business Continuity During the Ebola Crisis. In SPE International Conference and Exhibition on Health, Safety, Security, Environment, and Social Responsibility. Society of Petroleum Engineers , 9 (6), 54-60.

Varma, A. (2015). Continuity of Operations Planning for Small Airports. Continuity Plan , 6 (17), 35-47.

Wallace, M., & Webber, L. (2017). The disaster recovery handbook: A step-by-step plan to ensure business continuity and protect vital operations, facilities, and assets. AMACOM Div American Mgmt Assn , 7 (23), 23-30.

Yuasa, Y., & Nakano, S. (2017). Improvement of Municipal Business Continuity Plan Using Self-Check Sheets and Future Issues. Journal of Japan Society of Civil Engineers , 45 (34), 45-65.