By Alan Lund
April 15, 2010
I’m an old western buff. One of my favorite lines comes from a 1948 movie titled, “The Treasure of the Sierra Madre” where Humphrey Bogart is cornered by Mexican bandits and asks to see their Federales badges. The response from Gold Hat, the bandit leader is classic. “Badges? We ain’t got no badges. We don’t need no badges. I don’t have to show you any stinking badges!”
I heard a very similar line just the other day when I suggested to a company that it would be a value-added business step for them to implement a business continuity plan. The response was, “We don’t need no business continuity plan! We’ve been in business 30 years and we never had a disaster.”
What was obviously missing here is an understanding of the business benefits of establishing and maintaining a business continuity plan. I believe the issue arises from the approach; business continuity seems to be tied to a defensive or protective strategy that is in turn linked to a disaster. None of this feels like a compelling reason to develop a plan. It feels like a real downer! Just like I believe that the Federales needed badges, companies both large and small, product or service-based, regional or global, need a business continuity plan (BCP). Here’s why:
Let’s begin with a definition of business continuity planning and the resulting “plan.” According to BusinessDictionary.com, a business continuity plan is a “Set of documents, instructions, and procedures which enable a business to respond to accidents, disasters, emergencies, and/or threats without any stoppage or hindrance in its key operations. Also called business resumption plan, disaster recovery plan, or recovery plan.”
Now comes the key question; what disasters are we prepared to handle and is our company adequately prepared to “weather the storm?” Think Haiti, Chili, Toyota, the Christmas Underwear Bomber . . .enough said. It should be noted that the industry’s approach to business continuity planning is based primarily on Information Technology (IT) systems and data. I broaden the scope and say: what good is data if my management team, my facilities, my business partner, my critical supplier, etc. are no longer here? I suggest a business continuity plan that looks at the risks in each critical part of your company.
My case for recommending that every company create, implement, test and maintain a business continuity plan is quite simple; it makes good business sense for your company and it’s value-added for both your company and your customers. It separates you from your competition and provides potential new customers with an added layer of assurance that your business is here to serve and to stay. With this in mind, let’s look at just two reasons why a business continuity plan is value-added:
1. Stability:
A recent Touche Ross study reported that the survival rate for companies that encounter a disaster without a business continuity plan is less than 10 percent. According to research by the University of Texas, only 6 percent of companies suffering from a catastrophic loss survive, while 43 percent never reopen and 51 percent close within two years (https://iosafe.com/industry-stats).
Going through the process of developing a business continuity plan will identify where your organization, people and processes are weak and where you lack protection. Your business continuity plan can address these areas and will add value.
2. Financial:
International Data Corp. estimates that companies lose an average of $84,000 for every hour of downtime (https://iosafe.com/industry-stats). Iron Mountain has calculated the cost at $40,500 per hour (www.ironmountain.com/…/The-Business-Case-for-Disaster-Recovery-Planning–Calculating-the-Cost-of-Downtime.pdf).
Therefore, anything you can do to reduce or eliminate downtime saves money. A question that one needs to pose is what’s the cost of protecting against an identified risk or threat? Since it’s a good bet that a business continuity plan has the potential to reduce the severity and probability of failure resulting from a business disaster, there should be some method of calculating the value of a business continuity program and resulting plan. In fact, there is! It’s called Annualized Loss Expectancy (ALE) and it’s determined by multiplying the Annual Rate of Occurrence (ARO) by the Single Loss Expectancy (SLE). More detail regarding calculating the Annualized Loss Expectancy can be found at http://www.riskythinking.com/articles/article24.php
In closing, we know that the bandits were not the good guys and that they were not going to add any value to the situation Humphrey Bogart faced. We also know that Humphrey had a useful weapon at his disposal. Instead of a Winchester Model ’94, I recommend that your company have a Business Continuity Plan. Oh – one other thought: corporate insurance is expensive. A business continuity plan can help your company reduce the cost of insurance and pump up the bottom line. Check it out with your agent.
Alan Lund is a consulting principal at UHY Advisors MI, Inc. based in Southfield, Mich. He holds a BS degree in mechanical engineering from Iowa State University and can be reached at [email protected].
