A poignant Business Continuity reminder...

On Thursday, 11th July 2019, retailers across Australia suffered from an inability to accept card payments through what’s called the Eftpos transaction system, as a result of disruption to the national telecoms provider, Telstra. Bank ATMs wouldn’t accept cards, either.

Here’s an example news report of the problem.

I experienced the impact in a very minor (insignificant, really) way, whilst shopping at my local Woolworths supermarket in Sydney. Along with other shoppers, I had to queue at the few manned tills that still exist (they’ve been replaced by automated tills nowadays), and sign a receipt for payment. My inconvenience in paying for my goods was trivial. Many businesses, from cafes to supermarkets and major retailers were, however, severely impacted. After all, most of us take using our cards for payment for granted and increasingly, we don’t carry much cash with us.

Yet in order to be resilient, and minimise potential disruption like this, businesses that rely on using card transaction systems should plan for things like this as part of their business continuity planning. They should think about “reactive controls to deploy” in the event of a problem like this occurring (the bowtie is a good tool to identify controls).

I wonder how many shops were prepared to immediately, and effectively, respond to a “card transaction system outage” (whatever the cause). For example, is a fail-over option possible? Is there a cost-benefit to having good advisory signage in the back office area that is “ready to use at a moment’s notice”, to advise customers (as opposed to hastily-prepared cardboard signs – like the one in the photo, which was taken at a major supermarket)?

For large businesses such as retailers, do you have a tried and tested mass communications tool to quickly advise key people across your organisation what to do in the event of a major disruption like this? This could include advice to be vigilant and check the signatures of people who pay with cards at manned tills.

The following day in central Sydney, I happened to ask people who work in large retail chains about this disruption. I was curious to know what their resilience measures were. Some businesses were unable to take card payments for 20 hours (as they told me).

My main point is this: a disruption event like this can be anticipated and planned for. Other disruption events may be harder to anticipate, but with careful thought they can be anticipated, and response plans prepared. When measures are agreed up front in a Business Continuity Plan, you can communicate and test these measures to be ready to deploy them quickly when required.

If you think about and plan for disruption, you can quickly act to minimise the effects it has when it occurs.