Calculating and managing risk An Eurostar case study

0
67

Introduction

e320-1

Eurostar is the high-speed rail service directly linking the UK to France and Belgium via the Channel Tunnel. It started operating in 1994, providing city centre to city centre services. The fastest London-Paris Eurostar journey time is just 2 hours 15 minutes. In 2007 the second section of the new UK high-speed rail line was completed. St Pancras International became the new Eurostar home and created a high-speed link to the continent from the heart of London.

Eurostar runs up to 17 services to Paris and nine to Brussels daily. In addition, some trains stop at Lille in northern France and Calais Fréthun en route. There are also direct services from St Pancras International and Ashford International to the gates of Disneyland Resort Paris. During the winter holiday season Eurostar operate services to Moutiers and Bourg St Maurice in the French Alps. This all means that customers get a fast and frequent choice of transport direct to the heart of Europe.

The importance of managing risk

Transport is never far from the headlines, particularly when services suffer severe delays or cancellation. Apart from the obvious annoyance and inconvenience suffered by the passengers, the reputation of the company can be affected by adverse publicity. In many cases, the cause of the problems could be outside that company’s control.

However, particularly in the transport world, and understandably so from the customers’ viewpoint, that may not matter. For this reason Eurostar proactively manage risk and potential risk to ensure that customers receive the services they expect and demand.

This case study examines how Eurostar proactively manages risk through its business continuity programmes.

Business continuity

Eurostar exists solely for its customers. The culture of putting the customer first is embedded into everything it does. Therefore, Eurostar is very aware of the need to provide a safe, reliable, convenient and comfortable service.

In order to ensure that this is the case, the company has established a business and service continuity department. The department ‘sets the pace’ and the policy framework. However, the responsibility for implementing and maintaining actions designed to improve business continuity and service resilience are firmly the responsibility of line management. This ensures internal clarity and accountability.

What is business continuity?

eps2112.tif

Business continuity can be described as the strategic and tactical ability of the organisation to plan for and respond to incidents and business interruptions, in order to continue business operations at an acceptable pre-determined level. It also involves managing the recovery itself or continuation of business activities in the event of a business disruption. This is achieved through training, exercises and reviews to ensure the plans stay up to date.

The principle of business continuity aligns perfectly with the company’s objectives and its key performance indicators. It implies and demands a proactive attitude to the management of risk to business continuity, particularly in the areas of customer service and the delivery of value for money.

Business continuity management is the process that identifies potential threats to an organisation and the impacts to business operations that those threats might cause. It also provides a framework for enabling the organisation to develop a resilience so that it can respond effectively in order to safeguard the interests of its key stakeholders, reputation, brand and value-creating activities.

Eurostar objectives

Eurostar’s key message for business continuity is Semper Paratus (‘always prepared’). It is far better in managerial terms to be proactive. Being reactive is too late. Eurostar adopts an open culture that encourages colleagues to share knowledge and concerns. This helped it to put together a realistic set of risk factors that might impact its business.

It also helps identify what it can do to improve or alleviate these risks in a sustainable way. It ensures that the company has taken account of all the risks that could occur and that efforts to avoid them have been put into place, as far as reasonably practicable. It also ensures that, if they do, the consequences are managed well, safely and efficiently.

This is consistent with the Eurostar objectives of safety, customer service, value for money, reliability and punctuality that are the cornerstones of the way the business wishes to treat its customers. Such a policy enables Eurostar to thrive and grow to achieve its future goals.

The business continuity plan is a documented collection of procedures and information that is developed, compiled and maintained in readiness for use in disruption. It will enable the organisation to maintain its critical activities at an acceptable level. It should also be proactive to avoid risks becoming reality wherever possible.

Benefits of business continuity

Eurostar’s emphasis on proactive management is highly important to the company’s ongoing growth. By continually identifying present risks and assessing possible future risks, the company has the ability to avoid problems as much as realistically possible. For example, passenger demand has risen by 4% over the first half of 2011 and Eurostar is already in the process of a major refurbishment of its trains and is purchasing 10 new train sets. These actions will help Eurostar to maintain its high levels of service to its customers.

Benefits

Eurostar has also considered what it should do when and if problems do arise. It has therefore set up complementary work streams for both business continuity and disaster recovery. An effective business continuity plan and programme has several business benefits:

  • Proactive identification of risks and their impacts contribute to proactively avoiding their effects
  • Provides an effective response mechanism, should the risks become reality, which minimises their impacts
  • Encourages cross-team working
  • Demonstrates a credible response to customers
  • Enhances the business’ reputation
  • Gains competitive advantage
  • Supports continuous and sustainable business improvement.

The business continuity management process provides the processes, principles and the terminology that the business can use to ensure that it is acting proactively to avoid interruptions in its business or at least mitigate their effect should they occur. Identification of risk to the business is therefore the starting point for action.

Calculating risk

Each Eurostar department is asked key questions so that a relevant set of risks can be established. Examples of the risks considered range from losing the main offices due to fire (long-term) or a bomb scare (short-term) to a train derailment, a major financial catastrophe or the loss of one or more of the vital computer systems.

Measuring risk

eurostar_train

The risk matrix that has been developed shows the gross risk. This could be described as a simple risk that has no mitigations (the company activity designed to prevent the occurrence of an unwanted event e.g. a procedure or a fire alarm) against it. An example could be the loss of Eurostar’s telephone Contact Centre in Ashford following a fire. The centre is the central hub of communications for Eurostar sales, ticket distribution and customer service. This would be a serious event since, were it to happen and no proactive action had been consider regarding how it would deal with the problem, all of the organisation’s core values would be compromised. It would lose much of its booking capability with the resultant impact both on revenue and reputation.

The gross risk is arrived at by the addition of a likelihood score and impact score in a simple matrix. Next, the mitigations are considered. These are the processes and responsibilities necessary to control the risk of an undesired event and limit its impact should it occur. In this example, even mechanisms such as fire alarms and trip switches on electrical circuits mitigate the risks. Back up locations that could be switched to easily to continue taking calls and bookings are one of the mitigations that Eurostar has arranged should its facility be affected.

Reducing risk

By considering the mitigations the gross risk can be rescored to produce a net risk which should be lower than the gross. If that risk is still high then further plans will need to be considered to reduce the net risk even further. Even if the risk is seen to be ‘reasonable’ there is always the possibility that its effect can be further reduced. In this context further management action plans are always considered.

Assessment of this type can be easily wasted. If having gone to all of the effort (staff time and other associated company resource etc) of identifying how the business controls the continuity risks identified, it is critical to ensure that these are more than just mere words. Checks must be made to ensure mitigating activity is actually in place and working as intended.

Therefore at Eurostar the matrix is revisited every six months and regular audits are carried out on the mitigations and further plans to ensure they are being progressed as stated. Failure to do so may mean the company has retained risk without adequate knowledge or mistakenly thinking it is under control.

Business continuity – Eurostar implementation

The company has organised itself so that it has a business continuity department that will lead the process and set the scene. It is implementing a recognised business continuity model.However, one critical and distinctly important point is that responsibility for delivery is very firmly ‘in the line’ (the responsibility of departmental line managers).

Each department has therefore nominated a business continuity representative (champion). The champions are responsible for:

  • assessing the business impact: what are the mission critical aspects, processes and equipment within each department and for how long can business be sustained without them?
  • assessing the risk of undesired events
  • identifying who has the responsibility for ensuring that all actions required are being carried out
  • considering whether further actions could mitigate risk even further
  • coordinating business continuity within their departments
  • investigating failures
  • spreading the word/briefing and training within their departments.

The business and service continuity department provides assistance through nominating its staff to individual departments. This enables a watchful eye to be kept on the whole process so that interfaces are coordinated where something could ‘fall through the gap’ between departments.

Training for risk

To ensure its staff are well trained to deal with events when they do go wrong, Eurostar has a full programme of exercises that allow them to experience what it will be like if a ‘disaster’ occurs. This programme includes major exercises on site (Eurostar carried out evacuation exercises in the Channel Tunnel recently in partnership with Eurotunnel and the Emergency Services) through to table top discussions where each participant informs others about what they would do at particular moments. Eurostar also carried out exercises using various locations in its offices as pretend ‘operational locations’ and playing out different scenarios.

To train staff in various emergency scenarios, Eurostar is about to commence the construction of a tunnel evacuation training simulator. This will allow staff to be better prepared in case something goes wrong.

Many companies operate different levels of business continuity management ranging from zero preparation through to a bespoke department such as Eurostar has adopted. It is interesting therefore to compare notes and to learn from best practice. Eurostar management visited airlines, airports and other institutions/ organisations to learn from them and in some cases were able to provide them with some ideas.

Reviewing levels of risk

Eurostar has a major objective that insists the company has looked carefully at the risks to its continuity. In any similar management process, the maxim of plan/do/review is important. This process forms an endless circle. It is important to understand whether the risks are still current and whether any new ones have appeared.

Therefore Eurostar reviews the risk matrix in its entirety every 6 months and adapts it according to the results. It has also developed an audit based on the requirements of the business continuity British standard. By turning the standard’s requirements into questions, Eurostar has been able to see where it satisfies the standard. Just as importantly it can understand where it does not meet it and can take action to rectify this.

Following the saying that ‘you cannot control what you cannot measure’ Eurostar has quantified the audit. Departments will score more points for the more important aspects of business continuity and targets for the overall score have been set. Another spin off of such a process is the ability to point out to each department where they can take action to achieve higher scores and to be able to prioritise, i.e. more important actions attract higher scores.

Through regular review of the risk matrix and audit results Eurostar can say with confidence that it knows what can go wrong and has taken action to prevent it. It has also carefully considered what it will do if any disruption to the business does occur.

Conclusion

img_0071

Eurostar is demonstrating how seriously it is taking the whole question of business and service continuity. This is already paying dividends in raising the profile of the process to everyone in the company. It is generally acknowledged that Eurostar is more confident in its approach to its day-to-day business because the company has considered carefully what could go wrong and how to put it right.

Preparation of this sort is vital to good business. Eurostar’s proactive and structured approach to evaluating risk and managing business continuity ensures it can deliver the high levels of service its customers demand without interruption.

Eurostar | Calculating and managing risk