We need to factor these costs into our Strategic Risk/ Threat Analysis. They can impact on an Annual Loss Exposure by our lack of or possibility of doing something. The Strategic Plan provides us with a map of what we will be trying to do. So, the plan is the best place to estimate the strategic ALE.
On the other side of the SWOT are the company's Strengths and Weaknesses. These are both internal to an organization. This is also the Business Impact Analysis portion of the Strategic Plan.
A business's weaknesses are what we most think about in BIA's. We ask questions about time and resources when it comes to a business unit or information system. How long can the business go without a unit or system or resource? Where is the weak link? We are looking for the weakness to find critical systems. If it is weak, we want to eliminate or instigate. We build plans to take care of the business' weaknesses.
Although it does not seem that we look at our strengths sometimes, we must and we do. When we look at personnel and property that we can use in our recovery, we are looking for strengths. The talents of people and the special practices we use to make the company run are strengths we somewhat overlook when we are concerned with CPR training and hardware configuration. They are all strengths that should be considered essential in our strategic process.
When we combine the strengths and weaknesses of the company and our business impact analysis on a strategic level we get a strategic impact analysis. The SIA includes all the familiar questions of time and resource impacts, but on a higher level. The analysis should be on the impact of losing a strength or gaining a weakness. If the business is strong in one area or market, what would be the impact of losing the market to a disaster? Also, if the company were to have a disaster, how long would the market wait for the company to come back? If there is a weak product, do we decide to recover it after a disaster or divest it?
We can then look at the strategies that the SWOT/SRTA-SBIA would allow. Below is a breakdown of these strategies. With high opportunities and high internal strengths, the company would need an aggressive continuity strategy. What this means is that the product is mission-critical and high-priority in the recovery process.
On the other hand, if we have a product with great internal strengths and major threats, we must be in a defensive or diversifying recovery strategy. If the product is one we need, then there must be a defensive strategy. The line would be considered mission-critical and would be one of the first systems to get back on line.
If the system or product is a line that can be diversified for external strength, then a more level approach to this recovery is needed. The diversification would need to be planned. Then, the continuity issues could be mapped out.
There are strong turnaround opportunities when there are strong environmental opportunities but a weakness within the company. The company will usually jump at a chance to improve a market by improving a perceived weakness. We can take that system/product and try to mitigate and eliminate risks due to these internal weaknesses. If the company can gain in this sector, then this product might turn into a mission-critical system.
Finally, there is the sector where the company is weak and the threats are great for a particular system or product. The two approaches here are both defend the product and try to move it to another sector or divest. If there is more to gain with little loss (once again risk analysis), the company may be justified in defending its market. However, if a risk analysis shows it is better to let the product go or be sold, then the implications to Continuity Planning are clear. A product to be divested will not ever show up on a list of the mission-critical.
When we speak of strategic level analysis (STRA/SBIA), there are several tools that are used in determining market standing and strategy. Many are highly complex and not easily interpreted. Some are simple, yet elegant. Boston Consulting Group created one of these tools. It is a simple two-dimensional graphic representation of market standing and strategic analysis.
The BCG model is a more graphic presentation than the SWOT is. Many times the SWOT information (such as market size, market share, strengths and weaknesses) is quantified to create the BCG model. As seen below, the model is very simple. There are four sectors bound by Market Growth Rate (High or Low) versus Relative Competitive Position of market share (High or Low). Market Growth is a percentage rate of market growth. Relative Competitive Position is a number between -1 and 1 (Low to High, respectively). The closer to 1 the company is, the more competitive (stronger) in that market is that product or process. The reverse is true going towards the -1. The circles indicate the company's products or processes. The size of the circle indicates the market share for that product or process. The larger the circle, the larger the market share.
BCG even named the sectors. Stars are in high growth markets in which the company has high competitive position. The company can be very aggressive in this position and the opportunity is long term for this process. Most stars are start- ups and require heavy investment. This can lead to early losses to make the long-term gains. They are the company's future. These are definitely mission-critical processes.
On the opposite end of competitive position (Low) are the Question marks. They beg the question 'What do we do with this process?" They usually take great investment and generate only small returns. If the competitive position can be enhanced, by gaining more market share through acquisitions pricing, differentiation of product, etc., these products could become stars. Otherwise, they may go the opposite way and become dogs. From their position, they may be considered for recovery in the strategic continuity plan, but only after all critical systems and processes as analyzed above and below.
Dogs are what they sound like. Being in the low market share and low competitive position they are a drain on investments and add little or nothing in return. The best bet for a dog is to let it go. Divesting it to a company that can add it to a question mark is the best way to get a win-win situation. The other company could gain enough market share to make one of their product's a star and our company would get rid of a drain. Needless to say, it would be silly to make a dog part of the Continuity Plan. If it should be divested and the company had a disaster, why spend time, resources, and money on recovery of these processes.
The final sector is unique. Low market growth and high competitive position usually comes in mature market. This process is a Cash Cow. It needs little investment and returns most. The Cash Cow is usually a matured star and it many times is used to pay for star development. A good example of a cash cow is the original Coca-Cola. Very little goes into production, research and development of this cash-producing product. The proceeds are used to do research and development on other and new products. Given their description (generates cash to cover developing processes), it is easy to see why cash cows are the processes that should be top priority in the continuity plan. This is the company's best cash flow. Once restored, the cash can be used to restore star and question mark processes.
So, the BCG model relation to continuity planning is that cash cows are the first process to recover. Next come the stars. They could be the next cash cows. The question marks should be provided for next. They may be pushed into the star sector with proper planning. Finally, dogs should be divested before any continuity plan takes effect. If not, they should not be recovered.
On another level, strong opportunities from the SWOT model would be secondary in recovery as Stars in the BCG model. Company strengths would be first to recover as cash cows. Weak and threatened would never be recovered because they are dogs. Finally, those question marks that indicate weakness but opportunity will be recovered after all the others.
Together or apart, whichever way we look at the SWOT and BCG analyses, we can find mission-critical systems and their order of recovery.
We now have a Strategic Risk/Threat Analysis and Strategic Impact Analysis using the SWOT analysis. We also get strategic mission-critical processes and their order of recovery using the SWOT and BCG model. With the financial budgeting investment and return information in the strategic plan, we can get the monetary resource projections we need for our plans. Time period is already set according to the Strategic Plan's projected time-line of three to five years.
That leaves people and process resources. In the case of Strategic Continuity Planning we would be more concerned with position rather than person. Yes, it would be nice if the person who was CIO at the start of a strategic plan were the same all the way through, but we are talking three to five years. There are so many possibilities in this global economy today that position is stable, people are not. All that can be hoped for would be to fill the positions with someone of similar or better qualifications as soon as possible.
Process resources are harder to predict. Many items that may be needed for new processes may not have been invented yet. Do we use the famous "widget" in this case? The best approach here would be the "black box" or object model for future process resources. Placing a high level description of the object in the plan allows for future growth. This description would be as simple as what the inputs and outputs to the new process would be. As the process changes and the strategic plan changes, the Strategic Continuity Plan can change with greater detail for the process. Using this approach, by the time the process is ready to go online, the tasks, hardware, and software will be in the Continuity Plan. (Note: Object-oriented approaches will be a subject of future articles.)
A note from the author. | With that formula we could extrapolate the ROE to be: ROE = Net Earnings-RE/Total Assets. The Risk Exposure is being taken as a percentage of the Assets or Equity from the percentage that would be returned if there were no risk. These are very simplistic formulae as are the rest of the table. This article being an overview of Strategic Planning and Strategic Continuity Planning, I did not go into detail about the meanings of Risk Exposure (RE) or Annual Loss Exposure (ALE). Further articles can be more detailed with the fleshing out of these formulae and other measures extrapolated from risk exposure formulae. We needed the foundation first. |
We have now wrapped the Strategic Plan in a Strategic Continuity Plan. The SCP can be tested and changed in conjunction with the strategic plan. Both plans should be tested on an ongoing basis, usually two to four times a year, with adjustments made throughout the company as needed. Market standings and budgets should be checked on an ongoing basis. These factors and quick adjustments to changes could mean the difference between a continuous and terminal company.
Why should we even wrap the strategic plan in a Continuity Plan? The answer is the future. To take Continuity Planning to the future it will need to grow. That growth will be in two ways if we work on Strategic Continuity Planning.
The first way we grow is in taking Continuity Planning to a higher level. When we were working at the disaster recovery level, we took on a department and a task. With our passing to business resumption and business continuity planning, we looked at many tasks and departments. We planned for the worst and hoped for the best.
With strategic continuity planning, we would be looking at strengths and weaknesses, opportunities and threats. We can still plan for the worst, but we can see the best. We will be looking at the future.
The second way we grow is exposure. A Business Continuity Plan still does not ensure that the right people will recognize its importance and contribution. The strategic plan is in the executive realm. The level is at least VP/ CIO. Exposure at this level with the ability to trickle down to our present detail will help in our search for a sponsor.
We have been searching for a sponsor since our change from disaster recovery to continuity planning. We have wanted to raise our profession to the next level. We need to look at the future.
All of these searches, wants, and needs are covered by Strategic Continuity Planning. The sponsor would be upper management. It is their plan that we are protecting. The level would be strategic, not just business. It would be looking to the business' future as well as the present and past. The future, as well as the present, will be ours to protect and mitigate against risk.
We need to start now. The time is here for us to move into the spotlight. With Y2K, more companies are looking at long term continuity and the risks and threats that lie in the future. The future has always been in continuity planning. Now is the time to make the strategic future a partner of ours. That is where we belong and Strategic Continuity Planning puts us there.
Marc Reich is CBCP, CDP is a Disaster Recovery consultant for Inteliant Corporation. He has worked on disaster recovery planning in government, industry and small business for many years. His background includes over 20 years in data processing with 10 years in consulting.
