Disaster Recovery Journal - Summer 2001 Issue- Brief Results of the Pepperdine University Ethical Misconduct Disaster Recovery Preparedness Survey

DISASTER RECOVERY
JOURNAL

Return to the Spring 2001
Index

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276
Fax: (314) 894-7474
Internet www.drj.com
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

EDITOR
Michelle Saab
michelle@drj.com

COPY EDITORS
Edward H. Pearce, CBCP
drj@drj.com
Richard Sandhofer
richards@drj.com

INTERNET /
ADVERTISING
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
ww.drms.com.br

Click Here for a Printable Version

Brief Results of the Pepperdine University Ethical Misconduct Disaster Recovery Preparedness Survey
Conducted at DRJ Spring World 2001

– by Robert C. Chandler, Ph.D. & J. D. Wallace, Ph.D.

Management and employee Ethical Misconduct Disasters (EMD) can be as or even more devastating than natural disasters or technological disruptions. These unexpected crisis contingencies can disrupt routine operations, cost work time, waste resources, lose organizational reputation, and result in fines and criminal charges against management. During the DRJ Spring World 2001 conference and exposition in San Diego, California we measured participants’ perceptions about the state of readiness and perceived threats of the EMD. The annual DRJ Spring World conference is the oldest and largest gathering of disaster recovery planners, business continuity experts, and crisis/contingency planners across a wide variety of industries and fields. We classified those who volunteered to return our survey as beginning, intermediate, and advanced industry leaders and subject matter experts in the field of disaster recovery planning. Their opinions are very important to those of us who conduct research in this area. This brief summary reports the preliminary results of that survey.
We were encouraged to find that 85% of DRJ Spring World 2001 conference attendees’ report that their companies have a Disaster Recovery or Business Continuity plan. Of those companies that have a plan, 72% of those plans specifically address management and recovery from EMD. However, approximately one-third of all companies and organizations represented at the DRJ Spring World 2001 did not as of this date have a written plan that specifically addresses EMD. (See figure 1)
Only 21% of DRJ Spring World 2001 conference attendees’ companies have on-going assessment, testing of EMD management and recovery plans. Over half (58%) of all companies and organizations represented at the DRJ Spring World 2001 do not have on-going assessment and testing EMD management and recovery plans. Further, only 13% of DRJ Spring World 2001 conference attendees’ companies use interactive simulations/exercises for EMD readiness training. Fully 67% of all companies and organizations represented at the DRJ Spring World 2001 do not utilize interactive simulations/exercises for EMD readiness training. Very few (15%) of DRJ Spring World 2001 conference attendees’ companies utilize expert consultants to review their EMD response readiness.
Some 57% of DRJ Spring World 2001 conference attendees’ reports that their companies have regular assessment of worker ethical conduct compliance while 25% have little or no on-going worker conduct or ethical compliance assessment whatsoever. It is a noteworthy finding that one quarter of representative organizations apparently have little or no on-going assessment of employee conduct.
Some 31% of DRJ Spring World 2001 conference attendees’ report that their companies that have used an Ethical Conduct Audit. However approximately 40% report that they do not use such an audit. Approximately one quarter of all respondents stated that they do not know if their company uses an Ethical Conduct Audit. (See figure 2 on previous page)
Attendees were also invited to rate their companies proactive strategies for promoting conduct of integrity. Seventy-one percent of DRJ Spring World 2001 conference attendees rated the effectiveness of their companies written Code of Ethics/Values/Behavioral Conduct as Excellent/Good while only 24% rated it as Fair/Poor. One half of conference attendees rated the effectiveness of their on-going training/reinforcement for employees Excellent/Good while slightly less than one half (42 %) rated the effectiveness of their on-going training/reinforcement as only Poor/Fair. Forty-six percent of DRJ Spring World 2001 conference attendees rated as Excellent/Good the effectiveness of their organizational transformation activities to promote integrity in workers decisions & behaviors. However, an almost equal number (43%) rated the effectiveness of their organizational transformation activities to promote integrity in workers decisions & behaviors as only Poor/Fair.
The survey also asked participants to give their Perceptions of EMD Threat/Risk/Probability for eleven possible EMD scenarios. Here are the responses for the ratings of High threat, Moderate threat, low threat, or no threat. (See figures 3 (on previous page), 4, 5 and 6 (below))

Discussion of the Preliminary Findings

One significant finding in this survey is disaster recovery, business continuity, and crisis management planners are rather evenly divided over the relative importance and urgency of EMD management & recovery planning. Forty-five percent of respondents rated the importance and urgency for planning in this area as “high or moderate”. While 43% of respondents rated the importance and urgency for planning in this area as “low or none”. Given the historic frequency of these contingencies across industries, geographic regions, and sizes of companies the issue of EMD management and recovery planning needs to be further explored and discussed.
Based on the sample at the DRJ Spring World 2001, one out of every eight companies still does not have a formal Disaster Recovery, Business Continuity, or Crisis Management plan. We suspect that many such attendees were participating in the DRJ Spring World conference and exposition in order to respond to the needs that ready them to create their plans. While the majority of companies (71%) do in fact recognize EMD in their Disaster Recovery, Business Continuity, or Crisis Management plans, well over half of those same companies do not appear to actively and regularly assess and test the readiness of those plans. Three quarters of these companies report that they do not conduct simulation or mock exercises in their EMD training programs. Only one in seven companies have consulted with an expert in this area to review their EMD readiness.
DRJ Spring World 2001 conference attendees who rated highly the relative urgency and importance of planning for employee ethical misconduct also significantly perceived the risk of ethical misconduct disasters as more probable or likely to occur. Further, conference attendees who rated highly the relative urgency and importance of planning for employee ethical misconduct also reported that their companies were more highly prepared to respond, manage, and recover from disasters of this nature.
One finding that did emerge was the types of EMD that are perceived as the most likely threats. The EMD perceived as most likely to impact companies are simple acts of unethical behaviors. Further analysis and data collection may be necessary to more fully understand this threat. The second EMD threat perceived as most likely to occur were instances of ethnic and sexual harassment. Given the disastrous financial, legal, and public relations impact that the EEOC and private lawsuits have had on companies such as Mitsubishi Motors North America in the past decade, this is a serious threat that many organizations may indeed need to assess & minimize their vulnerability as well as their readiness to respond and recovery. The risk of employee criminal misconduct was rated as the third highest probability of disastrously impacting a company or agency closely followed with the danger of disclosure of the falsification of records/documents. All of these threats were rated as significant high risks when compared to the risks of other EMD.
There was some confidence in companies’ readiness to response and recovery from EMD. In all cases, except for the EMD of instances of Bribery & Inappropriate Influence (48%), the ratings suggest that over half of the respondents perceived readiness and preparedness to respond and recover from EMD as high or moderate. We take this as a positive indication that there is confidence in the state of readiness to respond to these disasters.
However, the ratings of “Low to No” preparedness or readiness for some of the scenarios are noteworthy. In each of the scenario cases more than one third of respondents (and as high as 45% or nearly one half) rated their organizations readiness to respond, manage, and recover as low to none. In particular, at least one third of the companies were rated for their response readiness at low to none for all categories of EMD. The EMD scenarios that almost one-half of the companies were least prepared to minimize, manage and respond included acts of falsifying records, criminal charges, deception of customers, public relations disasters, and instances of bribery. (See figure 7)
There was little or no relationship between how DRJ Spring World 2001 participants rated the relative urgency and importance of planning for employee ethical misconduct disasters and whether their company 1) had a written disaster recovery plan, 2) had on-going assessment, planning, & testing of their misconduct disaster plan, and 3) used expert consultants to review ethical readiness and misconduct recovery plans.
DRJ Spring World 2001 conference attendees whose companies do not have a Disaster Recovery or Business Continuity plan are significantly less likely to assess employee conduct, less likely to have an effective Code of Ethics or Corporate Values statement, less likely to have on-going training and ethnical conduct reinforcement, less likely to have activities to promote integrity in employee decisions and behaviors. Participants whose companies do not have a Disaster Recovery or Business Continuity plan are least likely to believe themselves prepared to respond to ethical misconduct disasters, occurrences of criminal conduct, ethnic or sexual harassment, unlawful discrimination, fraud, bribery, deceptive practices with customers or clients, and regulatory violations.
DRJ Spring World 2001 conference attendees whose companies Disaster Recovery or Business Continuity Plans do not specifically address ethical misconduct disaster scenarios also report that the effectiveness of their Code of Ethics or Corporate Values statements are only poor to fair. Further those DRJ Spring World 2001 conference attendees whose companies’ plans do not specifically address misconduct disasters are significantly less likely to perceive the importance and urgency of such planning.
We anticipate subsequent analysis of these results to reveal further implications and conclusions about Ethical Misconduct Disasters and response/management.

Dr. Robert Chandler is a Professor of Communication at Pepperdine University specializing in organizational communication, management communication, and crisis management training and assessment.
Dr. J.D. Wallace is an Assistant Professor in the Pepperdine University Communication Division. His most recent research has been in the areas of ethics and coordination in computer mediated environments.