It is often difficult to explain the intricacies associated with business continuity planning to someone who has little experience or knowledge about the topic. The basic concept of business continuity can sound so simple, and in many ways it is, but the real challenges are (1) convincing them why they should care about business continuity and (2) explaining the real value of spending the time and money necessary to develop a sound program. Without being able to convey these messages, business continuity can become an area where organizations choose an easy (and cheap) approach.
Unfortunately, a comprehensive body of research or empirical evidence does not exist to prove the value of business continuity planning. Instead, business continuity professionals must rely on current events to demonstrate that incidents can, and very well may, affect any organization and its interests. Often, for people to change a skeptical perspective as to how to implement business continuity, they need an example that hits close to home and proves that something similar could indeed happen to them. That is the purpose of this perspective:
- To provide recent, real examples of actual organizations that have suffered the consequences of unexpected incidents;
- To realize that events of this nature can indeed happen to anyone; and
- To discuss the true value of business continuity in mitigating financial, personnel and reputational risks.
Slim Jim (ConAgra Foods)
On June 9, 2009, a natural gas leak caused an explosion that crippled a section of the primary Slim Jim production plant, causing parts of the roof to cave in. All employees were evacuated, some were sent to the hospital with severe burns and three died on the scene. The plant, owned and operated by ConAgra Foods, is the only one that handles the production and packaging of Slim Jim beef snacks. Due to the unexpected blast, not only were employees injured and killed, but the plant will most likely be unable to operate and produce product for almost two months. This tragedy provides a real example of an incident that was difficult or impossible to foresee and that caused very obvious and visible damages to Slim Jim’s people and facilities, and by extension, the production of finished goods. For more information, the full story from local news station WRAL is available at:
RackSpace HostingOn both June 29 and July 7, 2009, RackSpace Hosting experienced downtime in one of its nine data centers due to power failures. Because of these power outages, about 2,000 of the company’s customers experienced service interruptions, some lasting approximately forty minutes on June 29th and fifteen to twenty minutes on July 7th. While these outages may seem brief, RackSpace is prepared to offer refunds to impacted customers, totaling $2.5 to $3.5 million. Again, this is a real example of a disruptive event that could have been avoided, one which caused quantifiable financial impacts, as well as significant, potentially long-lasting reputational impacts. Simultaneously, this example demonstrates the value of business continuity planning for organizations that employ third party vendors, as their ability to continue business can be negatively affected through no direct fault of their own. For more information, read Network World’s full article about RackSpace’s power issues at:
The Value of Business Continuity Planning
When an organization invests in business continuity planning, management shouldn’t expect a direct ROI, at least not in the traditional, financial sense. Instead, it is more important to realize that the resources invested in business continuity strategies will potentially save significant direct and indirect costs by averting crises or recovering quickly from the damages. This “true value” of business continuity occurs when the organization performs activities encompassing both risk mitigation tactics and recovery initiatives. This means that the organization should take preventative measures to actually reduce the likelihood of a disruptive event occurring, while at the same time developing strategies and plans to limit the impacts by enabling efficient recovery should an unexpected event happen. As the examples above were intended to illustrate, something unexpected or unlikely can happen to any organization at anytime. A “that will never happen to me” attitude will never lead an organization to minimize financial, reputational and personnel impacts associated with a disaster. In the following sections, additional detail is provided regarding the types of impacts that an organization can avert by building a strong business continuity capability.
In most cases, the financial impacts of a business interruption are obvious and quantifiable. For a manufacturing firm, it can include the opportunity costs associated with idle capacity and lost or deferred revenue due to an inability to produce finished goods. For a distribution firm, it can be the cost involved in rerouting products normally handled by one distribution center through several others if the principal location is unavailable. For a service firm, it can mean lost profits due to the inability to perform the normal duties for which its professionals were contracted. Regardless of the business type, while business continuity planning may sometimes seem like an unnecessary, or perhaps “tier-two”, expenditure of time and money when compared to other initiatives, for many organizations, the financial impacts of a single major disaster will significantly outweigh the costs of developing, implementing and maintaining a strong business continuity program.
In the event of a disaster, organizations can lose more than just money – they can lose people. Mass absenteeism can be due to company-wide illness, a national public health event, a need to focus on family members affected by a natural disaster, or a company catastrophe that leads to injury or death. Regardless of cause, absences can leave an organization short of the skills necessary to operate. Unforeseen events can strike an organization at any time with a lack of staff and/or cross-trained personnel to fulfill identified critical roles, crippling an organization if unmitigated. No price can be placed on personnel losses, and panic in the face of an incident will only worsen the situation. Implementing and making employees aware of emergency communication methods, evacuation plans and accountability procedures will prove to be priceless when faced with an actual emergency.
Less quantifiable, yet often the most critical and long-lasting, is the impact that an incident can have on an organization’s reputation. While there may be immediate monetary costs required to address a loss and enable recovery, the reputational impacts are the scars that remain long after the short-term financial and personnel injuries have healed. Incidents that affect an organization’s reputation carry immense hidden costs that may turn into the root of both financial and personnel impacts, as it’s much more difficult to repair issues such as an employee’s fear of unsafe work conditions or a customer’s lack of confidence in the stability or viability of the organization. Business continuity planning can help the organization properly react to an incident to ensure the reputation is protected or maybe even enhanced due to the swift and effective way in which management handles a potentially overwhelming situation. Being able to affirm that the organization has these capabilities can also serve to expand a positive reputation before an incident occurs.
At first glance, some professionals may see formal business continuity planning as an unnecessary expenditure. It’s easy to let the tangible bill for creating a business continuity program overshadow the potential financial, personnel and reputational impacts associated with a disruptive event. It is even easier to assume that nothing serious will ever happen to an organization and that even if an incident did occur, management could just figure things out at that time. However, this reactive approach will not guarantee a successful recovery. Instead, the safest option is a proactive approach which can be looked at as a form of insurance. Just like the financial insurance purchased to mitigate other monetary or physical losses, management hopes to never have to use it, but when an incident does occur, they’ll be relieved that the business continuity program is there as a key component of the organization’s risk management program.
Let’s conclude with an experience demonstrating the importance of a proactive investment in business continuity planning. Management at Rockwell Collins, Inc., a leading aviation communications and electronics manufacturer, learned the value of business continuity planning first hand when the 2004 hurricanes hit the east coast of Florida. Rockwell Collins operates a manufacturing facility on the east coast and was hit by three hurricanes that season. The first two resulted in only minor impacts; however, the third was a near-direct hit, with high winds removing a portion of the facility’s roof, leading to considerable flooding and water damage inside of the building. Due to a robust business continuity program, processes were in place to not only prepare for the hurricane, but also communicate and support staff members and quickly enable manufacturing recovery. Preparation activities included safeguarding key equipment and materials, as well as finished product. Recovery planning included communications strategy development, coordination with corporate headquarters and the identification of vendors to assist in the cleanup and repair effort. Additionally, process and manufacturing efforts were prioritized based on criticality. Management attributes their success in the event to robust planning and to the depth of management validation and training that occurred during response and recovery strategy development efforts. Due to these success factors, Rockwell Collins was able to begin operations days after the hurricane passed, whereas most neighboring facilities were idle for weeks. It was due to the investment in business continuity planning that Rockwell Collins suffered minimal financial impact and protected its reputation in the eyes of its customers and other key stakeholders. That is the true value of business continuity.