by grewjac » Wed Jul 11, 2012 12:52 pm
Ryan:
I must admit, in all the years I've been following this dicussion board, I've never hear a question quite like yours. That said, let me start by rephrasing what I think you're trying to find. For an organization to have "a plan," is to say they have:
- evaluated risks to their operations and put mitigating measures in place for those they feel must have them
- determined the adverse impact to the enterprise that disrupts each operation/process in the copany and put recovery plans in place for them
- exercised each plan at least annually to ensure they will meet the operational RTOs and RPOs
- Maintained the plans as needed to be current and fully executable.
So, a "plan" is actually many plans, ideally with a "Recovery Management Plan"
at the top of the heirarchy that has the executives leading the overall recovery effort and dispatching damage assessment and business unit recovery teams accordingly. Getting to this point can take a few years, but the result is the probability of a disruptive event causing the company to go bankrupt or become a wholly-owned subsidiary of a competitor will have been significantly reduced.
As for statistics by industry, there are all kinds of numbers thrown around, but the most meaningful item I've ever seen in 17 years in this profession is a done many years ago - "The Impact of Catastrophes on Shareholder Value" by Rory F. Knight & Deborah J. Pretty; A Research Report Sponsored by Sedgwick Group - the main finding was this: of major companies in a variety of industries suffering a disaster (the Exxon Valdez and the Union Caarbide disaster in India are two that were included), firms who had plans inplace saw in initial drop in shareholder (stock) value, followed by a steady growth pattern. Those without plans had the same initial drop, but then continued to slowly decline over seveal more years.
Hope this helps.