Property Rental Developer

The Challenge

The client achieved ISO 45001 for occupational health & safety by implementing controls and procedures to manage health & safety risks associated with day-to-day operations, as well as emergency preparedness and response. There was internal recognition that business continuity is a necessary part of managing risks and as such a prescribed need for business continuity planning; a logical extension ensuring the incident response capability goes to the level of protecting business risks and key activities.

The client had identified potential risks to the business of which there were a myriad and wanted specialist independent input to assess if they were taking sufficient mitigation actions. They had thought through the risks, for example:

• What if a tenanted property or office was impacted
• Have we done enough on cyber/IT
• As a small company growing fast, there are dependencies on key people
• Dependence on suppliers, contractors and significantly on developers (what if they have problems, can they still deliver services)

How could they mitigate risks effectively. How to evidence contractual responsibilities, for example, where do their responsibilities cease if residents are displaced.

After exploratory discussions with Teed, it was clear that business continuity planning needed to start from scratch by taking the client through the whole lifecycle.

The Solution

Teed’s consultant worked with the client from beginning to end, starting with a review of their current position, understanding the business and technology. Using proven methods and experience gained with similar organisations, our consultant carried out a business impact analysis (BIA) with business representatives to determine key activities and resource recovery options, taking account of both development and property letting risks.

Recovery strategies were developed or enhanced to meet business priority requirements during an incident. The business continuity plan wrapped up all this information into a clearly laid out document to enable swift action in the event of a disruptive situation.

A tabletop exercise was held with likely response team members considering several scenarios to tease out potential gaps in the thought process, including mass tenant displacement; loss of a key cloud service; loss of a key developer. From the BIA and exercise, 22 actions were noted to be taken forward. For example:

• Information security: certain technology suppliers are responsible for managing information so need to check that their information security is appropriate and would not be compromised
• Office security: there was a real concern that there is insufficient security at office premises, therefore work with the landlords to protect entry from unauthorised access (particularly given the client’s previous experience of disgruntled residents gaining access to a premises)
• People unavailability: some single points of failure could be mitigated with internal cross training and documenting procedures
• Legal responsibilities: clarification of legal responsibilities to displaced tenants, linking with insurance and response planning

Feedback from exercise participants was summarised by one attendee: “It was good to discuss the different scenarios and realise what things need putting in place prior to potential incidents”.

The Result

The client is now in a much better position to satisfy investors and stakeholders that they are prepared and on track to continue with planned business growth. There were no red flags when assessing gaps in business continuity threats, with amber status for some indicators where work is underway to improve on the current position.

Teed’s experience provided the necessary independent oversight and perspective to give reassurance to the client that they are doing what they need to do. Activity to take forward is manageable, affordable and signed off as justified to maintain and improve resilience.