On 11^th March 2011, the public announcement protocols gave Kazunobo (informally known as “Kaz”) and his investment banking team approximately one minute of advanced warning before the magnitude 9 earthquake whose epicenter was some 450km away began to shake his Tokyo office. For Kaz a swaying office was by no means unusual but he was now experiencing the largest earthquake to hit Japan since records began. One which shifted the country’s main land mass 8ft to the east and jolted the earth on its axis by as much as 25cm.

The significant damage to the country caused by these violent tremors was soon eclipsed by the destruction brought by the ensuing tsunami. The wave, sometimes reaching 40m tall, washed more than 10km inland killing 16,000 people and displacing more than 200,000. 4.4 million households were left without electricity and 1.5 million without water. The Fukushima nuclear reactor melted down.

When the severity of the Fukishima disaster became apparent Kaz’s thoughts turned to the safety of his colleagues. Tokyo’s 35 million residents were suddenly all at considerable risk and many wanted either to evacuate the city or stay at home with their families. Tokyo, however, is the centre of the 3^rd largest economy on earth and home to the largest stock exchange in Asia. To pull the shutters down on the city’s banking industry would have been unacceptable to many firms doing business in or through Japan and would have been catastrophic for the nation’s recovery from this disaster. As difficult as it is to acknowledge amidst so much destruction; the show must go on.

For many, having robust operations which can withstand disruption and continue to offer uninterrupted service is a significant business differentiator. For Kaz’s investment banking division, deploying robust Business Continuity Management (BCM) or not is the difference between maintaining a licence to trade or having it revoked.

Facing the unpredictable

Kaz had realised long ago that the “it won’t happen to me” fallacy was a dangerous one. Sure, you may feel you understand the risks from within your business (although again that’s a dangerous assumption) but it’s the unpredictable which you should worry about. Of the ten most common causes of disruption to technology firms in 2014, five were natural ranging from hurricanes to floods to fires i.e. half of the risk to business outage was un-forecastable. Yet, studies indicate that 48 percent of business owners have no continuity plans and 75 percent of those companies fail within 3 years of having faced a disaster. 

As a business leader Kaz understood his responsibilities well. Critical functions had been identified and maximum allowable outages had been estimated. Thus, he knew where to focus his attention. By testing his firm’s BCM protocols every quarter he knew the drill well and, more importantly, he knew his staff knew the drill too. A good Business Continuity Plan (BCP) marries the priorities and requirements of all stakeholders. Staff are kept safe and well cared for and clients can trust in the ability of a firm to get back up and running in an acceptable time frame.

Continuity planning

While subtly different from industry to industry and even business to business a BCP will center around a handful of key characteristics. Firstly, it should include staff. An efficient and swift communication broadcast is of paramount importance. The town is flooded, travel is impossible, how do you let your staff know whether the office will open and if so in what state? However, even the most robust communication systems will be strained in times of crisis. It is important that employees understand their responsibilities should the unexpected occur whether that’s a mouse gnawing through the mains power supply or the fourth largest earthquake of all time crippling an entire country.

The second pillar is technology. Very few businesses operate free of a reliance on computing and connectivity. How do your service providers ensure that you won’t suffer lengthy outages? What happens when transcontinental undersea internet connections are severed?  

Third is disaster recovery. Most firms will have an alternative site agreed from where they can operate a skeleton staff should the usual place of business be knocked out. Logistics, stock management, postal services are usually taken for granted, but if your BCP doesn’t provide for how these would work in an unusual situation they could be debilitating to your business.

Luckily for Kaz’s business, he was able to calmly invoke the processes which had been so frequently practiced. Key processing staff were quickly relocated to the offices in Hong Kong and Singapore. Client-facing staff chose either to work remotely from home or from the recovery site 60 miles outside of Tokyo. Telephony support, group email accounts, local systems access etc. were all opened up to colleagues in neighbouring countries. Clients knew that the Bank would be under pressure but didn’t experience any adverse impact.

Anticipate, prepare and weather the storm

Expect the unexpected and be prepared. For the 7,900 businesses in the greater New Orleans region that went out of existence after Hurricane Katrina, the advice came too late. Plan for a rainy day, sometimes quite literally. The New York Stock Exchange shut down for two straight days in the aftermath of Hurricane Sandy when the contingency plan proved too complex to execute. Anticipate, build robustness and practice. Beware the coming storm.

Gilles Hilary is an INSEAD Professor of Accounting and Control and The Mubadala Chaired Professor in Corporate Governance and Strategy. He is also a contributing faculty member to the INSEAD Corporate Governance Initiative.

Steve Mintey is an operational risk expert and an INSEAD EMBA.

Follow INSEAD Knowledge on Twitter and Facebook