But these arguments can be difficult to make. For one, it is very difficult to quantify risks. There is a human tendency to overstate risks that have a strong psychological impact. Many people fear terrorism above more mundane risks such as crime, even though crime is a far greater threat to most people than terrorism. Also, statistical generalizations of risk often do not apply well to a particular organization’s situation, which may dictate a very different order of risks.

Measuring the impact of events can be even more difficult. Many business continuity systems advise asking different people within an organization to rank the importance of different functions to determine criticality, but these judgments are highly subjective. A book seller that takes in $5 million in orders a day through its Web site may assume that having the Web site down for a day will cost it $5 million in business, but who is to say that many of those potential customers will not come back the next day? If they shop at the online site because it is more convenient than driving to the store, it is probably more convenient the next day as well.

But maybe there is a different way to justify business continuity. Perhaps business continuity is a moral imperative of an organization. If so, then the continuity professional will have a whole different justification in his or her arsenal, one that does not require appeal to the bottom line. I argue that a case to be made for the moral duty of business continuity management that goes beyond benefits to the organization.

Moral Arguments
We first have to understand that there are two general ways to justify a moral position. One is consequentialist, which is the view that an act is right if the balance of good consequences it produces outweighs the bad consequences. I might argue that my town should spend its tax surplus on education rather than park improvements, because there will be more overall benefit to the town from better education than better parks. I am making a consequentialist argument, because I claim that putting the money toward education will produce the best aggregate outcome for all involved.

The traditional justification for business continuity is essentially consequentialist, because it tries to show that the benefits of spending money on continuity programs outweigh the costs; in other words, the money produces the best possible outcome for the organization. But the traditional justification faces the problem endemic to consequentialist arguments, that the consequences of an action are notoriously difficult to predict with any accuracy. It’s hard to say how likely the server is to crash, and the likely costs of that crash, in order to prove that the back-up server will pay for itself in the long run. The data is just not that available.

But there is another type of moral argument, one that does not appeal to consequences. A deontological argument appeals to something other than consequences, such as duties. For instance, I might prefer to live in a warmer climate over the long Vermont winters (which I would), but I have a son from my first marriage that I would not think of leaving. I believe that I have a moral duty to take care of my son regardless of the benefits that I might receive by living somewhere else. A moral duty is not derived from balancing benefits and costs. It comes from another source – such as my position as a father – and trumps consequences. My duty to take care of my son was given to me by my choice to have a son, and is independent of consequentialist considerations.

The Duty to Business Continuity
In recent years business ethicists have challenged the traditional view that a business’ decisions should be driven solely by the bottom line. They have turned away from this consequentialist thinking by claiming that businesses have moral duties to a variety of constituencies, such as customers, workers, and the community. Whereas a business might decide to reduce pollution out of fear of lawsuits, or the hope that reducing pollution improves its image, more and more businesses are coming to see these kinds of choices as resulting from a duty to be a good corporate citizen of the community.

There are a number of reasons to believe that business continuity is also a corporate duty. One comes from the legitimate expectations of others. For instance, as a teacher, my students have a legitimate expectation that I will grade them without bias. If I fudge up a student’s grade because she is the daughter of a colleague, the other students can rightfully complain that I have treated them unfairly.

Similarly, customers often sign on to a service in the expectation that a business has continuity programs to reduce the likelihood of disruptions in service. If my cable reception goes out due to a storm, I assume that my provider has sent a crew to try to restore service. If I call my provider after a couple of days without service and am told they have no interest in fixing the problem because they decided that they did not want to serve my neighborhood anymore, I would argue that they betrayed my trust when I signed up with them. It may not have explicitly stated in our agreement, but it was tacitly implied that they would make reasonable efforts to provide continuity of service when I signed up. Just as my duty to unbiased grading does not need to be spelled out in a contract, the customer’s legitimate expectation of continuity of service does not need to be spelled out, it is often implied.

 The business continuity community normally couches its work in terms of the importance of continuity of service to customers, but it forgets that by doing so it also serves the organization’s workers by helping to preserve their jobs through a business disruption. This is not just a secondary benefit of continuity practices, but a duty of the corporation. Just as businesses assume that they have a duty to generate profits for shareholders on grounds that the shareholders have invested in the business, they have a duty to workers that have also invested in the corporation. These investments come in a variety of forms. At the very least, by choosing to accept a position a worker forgoes positions at other companies. They may have also planted roots in the community by purchasing a home and sending their children to local schools. These investments are lost if a company goes under.

Finally, businesses have a duty to the community to make efforts to protect its investment in the organization. The community provides roads needed for supplies and police and fire protection. The community has also benefited the business by providing the infrastructure needed to allow employees to move in to the area and to keep employees around. The community also relies on the tax revenue from the business to provide services like police protection and education. It might have built a new school under the assumption that the revenue would continue. The fact that my son relies on me due is part of what creates my obligations to him, and this reliance creates a duty to preserving business operations on the part of the company.

Continuity professionals have always justified their work in terms of the enlightened self-interest of the organization. But their work is more important than the corporate bottom line. Business continuity is not just good business, but a moral imperative of the organization. A business sits at the nexus of a web of dependencies that result in a moral duty for the business to reduce the likelihood that it cannot serve those dependencies.

John Orlando, Ph.D., is the program director for the Norwich University Master of Science in Business Continuity Management.
 

Comments (0)