The timber industry has suffered losses of more than £25m as a result of 66 serious fires over the past decade. This shocking statistic from the Fire Protection Association highlights the need for the timber trade to have effective risk management and business continuity management strategies in place to protect this invaluable asset. In turn, this will improve the health of its business and help boost its competitiveness in a flourishing sector.

In order to have an effective risk management structure, a company – be it a forest manager or sawmill – needs to have robust procedures in place to:

  • identify existing risks to the business including property, people and product. For example, disease damaging the timber, fire in the main extraction system, loss of a critical CNC machine, a key customer or supplier going insolvent;
  • understand the consequences of not managing these risks effectively – in other words, the financial, environmental and legal consequences and the damage to reputation;
  • identify new risks which may arise through legislation, changes to the business, new projects and so on;
  • evaluate the effectiveness of current control measures such as smoking rules, electrical inspection, managing contractors, servicing and maintenance of key machines and plant;
  • assess the need for additional mitigation to either reduce the likelihood of a risk occurring or the severity of its consequences;
  • regularly monitor and review the effectiveness of those mitigation measures.

Before committing to a business continuity management (BCM) process, a timber company should research the following, taking into account the time and resources required to achieve its goals:

  • determine and document the key drivers and what you want BCM to achieve for your business;
  • visit the Business Continuity Institute (www.thebci.org) and other relevant websites;
  • find out about the British Standards Institution’s Publicly Available Specification (PAS) 56 “Guide to Business Continuity Management” and the new BS 25999, due to come into effect in 2007. It is strongly recommend that your process should be compliant with the new standard as this is likely to be the standard against which your BCM process will be judged by customers, insurers and other stakeholders;
  • consider attending a relevant workshop or seminar to hear from experts how they go about implementing BCM;
  • create an outline project plan and budget. If you do not have adequate internal resources, or you feel that outside expertise will be necessary, include an estimate for this as well as internal and other costs;
  • secure formal buy in from the top of your organisation and ensure that resources will be available in accordance with your outline project plan and budget.

For a robust business continuity process, it is fundamental that the company defines and understands its key strategic aims and establishes the mission critical activities (MCAs) required to achieve those goals. These can be established through:

  • Business Impact Analysis (BIA) – this identifies, quantifies and qualifies the impact on an organisation after a loss of, interruption or disruption to MCAs.
  • Risk Assessment (RA) – this evaluates the probabil-ity and severity of risks which could affect MCAs, so that they can be managed accordingly.

Once the BIA and RA have been completed, the remainder of the BCM process can proceed as follows:

  • evaluate the various business continuity and recovery strategy options;
  • prepare the plans;
  • create a BCM structure;
  • liaise with third parties who can assist in business continuity and recovery;
  • embed a BCM culture within the organisation, for example through training;
  • test the plans.

Aon Ltd is a leading provider of risk management, insurance brokerage and consulting services.