How to deal with crises and civil emergencies: the 'legals' (Part 2)

Be Prepared... the meaning of the motto is that a scout must prepare himself by previous thinking out and practicing how to act on any accident or emergency so that he is never taken by surprise: Robert Baden-Powell

There cannot be a crisis next week. My schedule is already full: Henry Kissinger

Watching the news in 2014 was sobering. Sadly, 2015 has not started well either.

There have been countless crises, catastrophes and disasters: some at home; some overseas.

How should businesses prepare themselves? What planning should they make?

Last time we looked at the key risks for businesses; regulatory compliance issues and HR considerations.

Today we set out the final excerpts from Lexis®PSL Commercial’s Practice Note on what businesses (and those legal practitioners that advise them) can do to understand and deal with the risks posed by unexpected crises and civil emergencies.

We'll concentrate on:

• contractual considerations, and
• business continuity planning

Contractual considerations

Litigation may be a risk for a business where it becomes difficult to fulfil contractual obligations or where mistakes are made because staff do not have appropriate skills. This could result from staff absences or lack of qualified staff largely due to sickness, looking after ill dependants, or fear of infection.

Just because a pandemic or civil emergency may affect many businesses does not mean that a business which is unable to fulfil its contractual obligations (because, say, it is under staffed or cannot get access to its supplies) will be able to avoid its contractual obligations.

Force majeure and frustration

Businesses are well-advised to review the force majeure, business continuity and disaster recovery provisions which apply in their contracts, both in the context as supplier and as customer.

Where such provisions are inadequate for their needs, they should be renegotiated where possible. Going forward, new contracts should include provisions which provide appropriate protection.

Clauses dealing with force majeure:

• may not provide exoneration for acts or God, or where Government enacts emergency legislation
• may not include a right to terminate where long-term performance becomes untenable
• should be subject to a requirement to implement a business continuity work-around, unless this itself is precluded by the force majeure event

In the absence of a force majeure clause, the parties will need to give consideration to whether the doctrine of frustration can assist. There are significant limitations in seeking to rely on this doctrine.

Supply chain considerations

A business's ability to supply goods or services (as supplier) is only as good as the contractual supply chain upon which it depends (as customer). Businesses which are reliant on a contractual supply chain in order to supply their own products and services need to consider operational and legal steps in order to ensure the continuity of supply.

Operational steps can include:

• ensuring some degree of stockpiling of essential resources
• having extant contracts in place with alternative suppliers located at different sites/countries

In addition, businesses should consider including in their contracts with key suppliers the following types of provision:

• step-in rights
• work-around plans
• business continuity plans
• disaster recovery plans

A business continuity plan generally focuses on business processes. A disaster recovery plan, on the other hand, typically is specific to IT or technology functionality.

Business continuity planning

There are various practical environmental (including hygiene safeguards) and organisational management issues to consider when planning for a disaster or civil emergency. Such matters should be factored into the preparation of a BCP.

British and international standards

The British Standard on Business continuity management, BS 25999, was the British Standards Institute (BSI) standard for providing a basis for understanding, developing and implementing a BCP. It included best practice recommendations and was applicable to all organisations. Businesses were allowed adopt the standard without necessarily becoming certified against it.

This standard has now been superseded by BS EN ISO 22301 (ISO 22301) the latest version of which was published in 2014. Information on ISO 22301 is set out on the British Standards Institution's (BSI) webpage on business continuity. The BSI states that the benefits of ISO 22301 are:

• the ability to:
  • identify and manage threats to a business (whether future or current)
  • keep functions up and running that are critical to the business during times of crisis, and
  • demonstrate resilience to stakeholders and for tender requests
• the minimisation of:
  • the impact of incidents as a result of having taken a proactive approach, and
  • downtime during incidents and improvement of recovery time

Other organisations which promulgate standards or best practice in relation to BCM include The Cabinet Office, The Business Continuity Institute, The Continuity Forum, and Continuity Central.

Business continuity plan

A BCP is a written strategy for continuing business in the event of a business interruption event from a disaster, civil emergency or similar event.

A BCP would typically include:

• information on the scope of the BCP, ie who it covers and what it covers
• details of the BCP management team
• information to enable members of the BCP management team to carry out their responsibilities under the BCP
• details for staff, including:
  • their responsibilities under the BCP
  • instructions on what to do when an incident occurs or is ongoing
  • information on how a business will communicate with staff when an incident occurs and during any period of recovery
  • instructions on handling customers and third parties
  • information on training and review of the BCP
• the information pulled together during the planning process

What do you think? Do let us have your thoughts below.