Running out of stock, finding employees are unable to turn up to work and losing mains power: these are just three business critical incidents to have affected UK retailers recently. The consequences are severe: for the unprepared retailer, it could mean going out of business. Richard Thurston reports

The need to develop a business continuity strategy is obvious. Ninety four per cent of organisations responding to a March 2010 survey by the UK's Business Continuity Institute said their business had been disrupted within the last 12 months. Top reasons given were swine flu, IT and telecoms disruption, adverse weather, failing energy supplies and the increasing regularity of cyber attacks.
One might be tempted to add the recession as a very potent threat, with cost-cutting eating away at the stability of business processes. With finely tuned deliveries and a fragile supply chain a fact of life for many retailers, a well defined business continuity strategy has become a must have.

Lyndon Bird, technical director at the Business Continuity Institute, says threats to a business tend to be grouped around one of several areas: the ability to serve customers, the ability to be served by suppliers, employees, technology, the financial capability to keep trading and reputation. "Retailers are particularly susceptible to problems in those areas. In the supply chain, there are lots of criticalities particularly with distribution centres, logistics and transportation," he says.

While one store having to close might be highly detrimental to a retailer, having a distribution centre unable to open would be catastrophic, having a knock-on effect on multiple stores and seriously thwarting the company's ability to trade. A failure of technology could also cause a catastrophic business impact. Should a server go down which hosts PoS systems or stock control software, stores may again become unable to serve customers.

"Retailing has become very computerised, based on getting the right amount of stock in the right location at the right time," says Mike Osborne, managing director at ICM Continuity Services. "If they get that right, they can massively reduce the amount of stock. But the danger there is they don't have any buffer."
Osborne recommends that retailers work with a third party that can provide them with back up offices in which to work, and that can assist with telephony and IT resilience. This could mean having business critical data backed up in a remote data centre or working with a company that can bring in mobile data centres and back up power if required.

Of course, when a third party offers 'resilience', retailers should check what they are getting. Some telephony offerings promise resilience by offering secondary cables routed through the same ducts and telephone exchanges as the primary cable. This is not truly resilient because of the single points of failure. The same is true for datacentre back-up provided in the same building, or even town, where power outages or break ins could hit primary and back up servers at the same time.

"There are different levels of redundancy. If you have redundancy in the same location, that location could go down," says Richard Jones, principal business continuity management (BCM) consultant at Sungard Consulting. "That's when you can go to a supplier such as a Sungard or an HP, but you need to understand what the supplier is offering. They need good resilience and good disaster recovery as well."

Sainsbury's

One retailer that is frequently cited as being successful in business continuity is Sainsbury's. Companies of that size - the supermarket chain has over 800 stores, 25 distribution centres, 150,000 employees and 7,000 suppliers causing millions of interdependencies - face many issues that could easily go wrong. In
the 14 years Sainsbury's has had a business continuity strategy, it has had its scares, but thanks to its comprehensive business continuity planning the impact has been minimised.

One of its biggest challenges was the floods which were caused by intense storms in 2007. Four of its Gloucestershire stores were badly affected. Ironically, water supplies had become cut off, jeopardising the stores' ability to sell many foods. However, the impact was minimised by several measures. Firstly, Sainsbury's had defined so-called 'bunker lists': products which customers demand more of in emergency situations. Good relations with its suppliers meant Sainsbury's could quickly stock much higher quantities of these goods. Secondly, the company managed to move in vast containers of water to keep essential functions running. And thirdly, chains of communication had already been established at store level and across the company that were activated to ascertain the situation and the means to address it.

"It's important to have your networks in place to gather information," says Steve Mellish, head of business continuity at Sainsbury's. "We were able to keep stores open...and minimise the impact."

It was Mellish who established the supermarket's business continuity function as long ago as 1996. He was working in IT disaster recovery for the retailer at the time. "I saw the opportunity to deal with Y2K and the fuel crisis and the flu pandemic that could have had a negative impact," he says. "Things will go wrong somewhere on a daily basis, whether it's late deliveries or major roadworks. It's where you get the incidents beyond local capabilities that we have utilised business continuity very well in the past."

Mellish has now set up a central business continuity team with the ability to reach out to senior representatives in every part of the business. Many executives now have business continuity written into their job description, which encourages them to keep an active interest in the subject.

Mellish stresses the importance of technology in a successful business continuity plan, particularly in IT disaster recovery. But despite his technical background, he said that business continuity must remain business driven, with IT acting as a supply function. "It can't be driven by a supporting function like IT," he says. "That's a key challenge for a lot of organisations, particularly in retail."

The BCI's Lyndon Bird agrees. "Technology is not really the answer. Business continuity is about developing a strategy that addresses the risk and puts in place the solution, which incorporates technology," he says, adding that IT recovery, data protection, virtualisation and technologies to support homeworking are key ways technology can help.

But Bird remains unconvinced that retailers are well-equipped if the worst does strike. "Business continuity is not absolutely top of the retail agenda. The impression we've got from our work is that it was extremely difficult to get retailers to buy into business continuity beyond basic IT help. There is an education issue there," he says.

Technical resiliency is a great starting block. But with so many non-technical factors that can cause financial loss to a retailer, it will be those IT departments
that reach out beyond the comms room that will support the most secure businesses of the future.

Share Story: