Rightsizing a Business Continuity Program

By Mike Ciaccio

Many emerging biopharmaceutical companies neglect to develop business continuity plans because they are operating with constrained resources. Even with the limitations of a small organization, however, companies should still establish a basic set of business continuity plans to prepare for unplanned disruptions to operations.

A comprehensive portfolio of business continuity plans can be developed over time, but even small companies should develop business continuity plans for essential processes as a first step. These essential processes often include those that enable the company to meet its financial obligations (i.e., payroll, banking and treasury, and accounts receivable) and processes associated with employee safety (i.e., business and emergency communications).

Why are business continuity plans important?

Small to mid-size biopharmaceutical companies frequently design their business processes with an emphasis on process efficiency and cost control. They often overlook operational resilience during process design. This then exposes them to the possibility of business disruption if key personnel, partners, or systems are unable to perform successfully.

There are many recent examples that demonstrate the need for small and mid-sized biotech companies to develop business continuity plans for essential business processes, such as:

• The Silicon Valley Bank failure in 2023 that severely impacted companies that had no other banking partners to support their operations.
• The CrowdStrike content update failure earlier this year that disabled computer systems across the globe.

Also, we have seen situations where individuals with process approval authority left the company, either through attrition or otherwise, and their presence in computerized workflows or within partner support systems is not updated, leading to confusion about responsibilities and decision-making during business disruption.

There can be significant consequences if business continuity plans are not established for essential business processes. These can range from damage to reputation to delays in paying employees and vendors. In the worst-case scenario, companies may not have the ability to survive as an ongoing business entity.

Common impacts of operating without business continuity plans include:

• Attempts to restore processes are unorganized, erratic, and error prone.
• Difficulty in contacting key internal and external resources to restore operations.
• Insufficient institutional knowledge due to staff turnover that hampers process restoration.
• Lack of understanding the upstream and/or downstream activities, exposing the company to unnecessary risk.

Putting Basic Business Continuity Plans in Place

Recently, an emerging pharmaceutical company approached Converge Consulting to map business continuity plans after the Silicon Valley Bank failure. They relied solely on Silicon Valley Bank and its sudden failure caught them off guard.  For several days, the company was not sure it would be able to pay employees or vendors. To avert this risk going forward, they have both established relationships with multiple banking partners and developed business continuity plans for banking and treasury, employee payroll, and SEC reporting.

For each essential process, we documented a process narrative and the detailed steps used to execute the process. Additionally, we developed a cross-functional process map identifying each role, activity, approver, and system involved. Using this information to determine process vulnerabilities (i.e., no backup approvers, single points of failure), we then documented their likelihood of occurrence, impact, and mitigation strategies. Finally, we captured contact information for key internal and external stakeholders, along with credential information for the system access needed to complete the process if one or more stakeholders were unable to fulfill their role.

For a small investment in time, resources, and money, this company increased confidence in their ability to weather future business disruptions or events. Management stated that they regretted not developing business continuity plans prior to the Silicon Valley Bank failure.

Key Takeaways

• Emerging biopharmaceutical companies should develop business continuity plans for essential processes early, ideally at the time those processes are established. Keep in mind that when a company goes public, the need becomes greater because the investor community is now paying attention.
• Often, the place to begin is with processes that allow the company to meet their financial obligations and those that may impact employee safety.
• Identify process owners to author continuity plans and identify vulnerabilities. They should determine the probability and likelihood of each vulnerability and either develop a mitigation or document an assumption of risk.
• Over time, process owners can expand their business continuity plans into a program portfolio that includes other important processes.

For help rightsizing your business continuity program, contact our team at info@convergeconsulting.com today.