Last month Deloitte hosted a round table event to discuss how organisations could collectively respond the common consequences of events that impact whole areas and by association industry sectors clustered together. One area discussed was 'locational risk assessments' and what clients are looking to monitor and measure. Mark Naysmith is a resilience expert in our Enterprise Risk Services group and jointly hosted the round table event. Mark recently shared his experiences advising clients on this subject and I have summarised these in this blog.
We are increasingly seeing 'Blue chip' clients starting to adopt separation/dispersal strategies. This has in part been prompted by an apparent upturn in natural disasters (flooding being one of the UK's highest national risks now). This approach to strategy has been encouraging this still needs to be well informed.
From a 'common consequences' perspective, there are 2 key questions to ask:
1) How do I know when my locations are too close together?, and
2) How do I know that they are sufficiently far apart?
Arguably these are two sides of the same coin but both points should be considered. Blunt metrics are often founded in previous 'good practice guidelines' but are insufficient to influence business leaders to either invest in a separation strategy or placate their fears if they believe their business is at risk when it is not.
What is required is hard analysis and factual information to address the specific questions based on the location and operation of the business in question. Whilst we cannot always predict when an incident may occur we can identify single points of failure such as staff transport routes or shared power infrastructure and review these to determine whether locations are too close or are sufficiently apart.
A dispersal strategy may be a possibility for some businesses but moving away from your client base may not be an option. As one of our London based clients commented "this may not be a great location for a Data Centre but it's a great place for us to do business from". Under such circumstances clients have limited options but to adopt a point defence strategy backed by mitigation. The thinking in this instance is one of "we want to be close to our clients and if there's a common consequence they are likely to be impacted by the same event. However, we need to ensure that when this occurs we are more resilient and we recover more quickly than our competitors".
Point hardening may include a specific (not generic) risk informed approach to location strategy. There are multiple options to business hardening but before you make any decision it must be an informed one based on an accurate and factual assessment of the risks.
As with many risks, location risks are dynamic and change over time so the question of what to monitor and measure is one that should be revisited regularly by businesses.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
