Many business continuity practitioners approach business impact analysis (BIA) and business continuity planning (BCP) from the perspective of business cessation. They define the cessation only based on the failure of the information technology (IT) systems. When approached in this manner, the BCP becomes very narrow with the sole focus on recovering the IT system. However, even the best IT system without people, processes, and infrastructure may not be enough to sustain business. There has been much written recently about the need for the expansion of the BIA and BCP to include people and infrastructure. However, while no one would argue these are not necessary for a complete BCP, one could make the argument they are not sufficient. They may be insufficient on two counts: organizations ongoing operations are dependent on four factors not three and the organization may incur significant financial loss or business cessation based on the interruption of any one of the four factors: people, processes, technology, and infrastructure.
Traditional practitioners are addressing only technology; early adopter practitioners are addressing people, technology, and infrastructure, but few if any are playing the role of innovator and addressing BCP from the “process” perspective. The oil price spike and the banking crises, the two most recent mini-disasters, demonstrate the need for taking a more comprehensive approach when developing a BIA and BCP, a process view with attention given to mini-disasters.
Webster defines a disaster as “a sudden calamitous event bringing great damage, loss, or destruction.” Frequently in BIA and BCP the “great damage, loss, or destruction” is defined as potential business cessation.
Some of the commonly addressed disasters might include: hurricanes, pandemics, earthquakes, fire, terrorist attacks, etc. A mini-disaster may be defined as a sudden calamitous event bringing great damage, loss, or destruction where the “great damage, loss or destruction” is something less than business cessation, but has a potential crippling impact either financially, operationally, or both. Some potential mini-disasters might include significant economic spikes, significant natural resource spikes, supply chain interruptions, acts of terror against a specific organization, infrastructure interruptions, white collar crime, etc.
Most organizations fail incrementally due to mini-disasters not instantaneously from a disaster. The probability of one or more mini-disasters striking an organization and immobilizing it is far greater than the probability of a major disaster striking the organization and causing business failure. Therefore, the more BIA/BCP practitioners can do to minimize the exposure to mini-disasters and mitigate the impact of mini-disasters, in addition to disaster analysis and planning, the higher the probability of sustaining the life of the organization.
One way to execute the mini-disaster approach is to become more comprehensive in the implementation of BIA and BCP; move from the organizational level of implementation to the process level. One highly accepted business model includes six processes that make up the value chain and an additional six supporting processes. The value chain processes are causally linked and therefore an interruption in any given process may impact as many as five other processes and lead to business cessation. The six value chain processes are defined as: define markets/customers, develop vision/strategy, develop products/services, market/sell, produce/deliver and invoice/service customers.
These value chain processes are supported by six additional processes: develop/manage human capital resources, manage information, manage financial and physical resources, execute operating culture management program, manage external relationships, and manage improvement/change. These six processes form the foundation for the value chain and thus a significant interruption of one of these processes may severely weaken that foundation and lead to value chain failure.
Interruption from a disaster or mini-disaster of any one of these twelve processes may result in a negative financial impact on the organization. Depending on the severity of the disaster or mini-disaster the impact may be short-term or long-term, insignificant or critical.
One example of a feasible mini-disaster with the potential to impact the financial health and operation of an organization is the simultaneous loss of the entire sales force. Assume all members of the sales force are killed in an earthquake in California while attending a sales meeting, or a terrorist attacks the hotel where they are meeting in Kansas City. Depending on the complexity of the products or services the organization sells, this business interruption, from interruption of the “market/sell” process, could have a life span that extends from weeks to months to years. Regardless of the life span of the interruption, the financial impact could be significant.
Another situation might involve a government organization that controls 100 percent of the distribution of some product, e.g. alcohol in a Canadian Province, and their only land route for suppliers’ deliveries is cut off due to a landslide or terrorist bomb blowing up the sole bridge providing access to the area. Depending on the timing and the severity of the damage the loss from the interruption of the “Produce/Deliver” process may have a significant financial impact beyond the government.
If the interruption occurred during a World Fair, the revenue of many businesses would be impacted. If this were the case, the government is financially impacted twice by the same interruption; first they loose the revenue of the sales of the alcohol and then they loose any taxation revenue from the businesses that would have offered alcohol for sale to the public.
For a significant number of organizations, both public and private, the support process of “manage financial and physical resources” is a key factor relative to sustaining the life of the organization. Included in this management process, for many organizations, is the ability to take out short-term loans. When this process is interrupted by a mini-disaster, such as a banking crisis, the ability of the organization to continue to function is at risk. They may not be able to pay employees or vendors, and production may come to a halt. The degree of the impact will vary depending on the severity of the banking crisis, and the time line of the crises, both from the perspective of when as well tenure of the crises.
Mini-disasters, including natural resource spikes such as the recent oil price spike, should not be taken lightly relative to business impact. While a mini-disaster of this type indirectly impacts almost every organization, those organizations involved in the sale of products that require transportation to get the product to market are impacted to the greatest degree.
For this scenario one can look at a convenience store operation in North Carolina during the latest gas spike. This mini-disaster was the result of a disaster in another state, a hurricane which disrupted the “produce/deliver” process of gas from the oil companies to the service station. This, in turn, interrupted the “market/sell” and the “produce/deliver” processes of the vendors responsible for the convenience store inventories. In addition, it interrupted the “invoice/service customer” process for both the convenience store and the associated vendors. The result for the convenience store was a loss of revenue from gasoline sales, due to a supply shortage and evidenced by motorists running out of gas on the freeways, and a loss of revenue from convenience store products. In addition, many of the stations may have lost customer loyalty because of the manner in which they handled the crisis; they either did not have a BCP for this type of mini-disaster or they did not have a good BCP that was process driven and customer centric.
While the impact from the gas price spike was only felt for a couple of months in North Carolina, it had significant inter-business financial impacts. Had the price of gas continued to rise during this mini-crisis or had the pipelines been more severely damaged, the impact would have been much greater. Any time there is a mini-disaster that impacts the price of goods and services, one must give consideration to the potential economic consequences that may have financial repercussions of a higher magnitude than just the temporary loss of revenue.
If the spikes are of such magnitude and time span that they permanently impact price, customers may be lost. This is based on the economic theory that as prices increase, there is some price at which the consumer will be unwilling to purchase the same quantity of the product or service. Depending on the percentage of the organization’s revenue, this product accounts for the financial impacts could lead to significant financial losses or in some cases business cessation. The key to avoiding any significant negative impacts from mini-disasters is for the BCP to have good alternative operating processes for the 12 key business processes.
Another aspect of the mini-crises, as those illustrated above, to be considered by the practitioner, is the probability of the mini-disaster escalating to a disaster, much like a tropical depression escalates to a hurricane. In the banking example above, one could easily see a probability of a banking crisis being the catalyst for a stock market crash. The crash, particularly if in the United States or another major market, would have world wide implications and therefore impact both national and multi-national companies that may or may not be domiciled in the country in which the market is domiciled. The crash could then expand to a depression either nationally or worldwide. History has shown the financial impact of this type of disaster to be significantly serious for all types of organizations. A comprehensive BIA/BCP gives organizations a plan of action for these types of events.
To facilitate addressing BIA and BCP from the process perspective, one can use a methodology that has been used successfully by total quality management, process improvement, lean, and Six-Sigma practitioners called “causal process flow charting” – developing a process flow chart for each process from its beginning to its end.
In addition to the process view of BIA and BCP, one should consider applying more comprehensive thinking about probabilities of mini-disasters and disasters and the probability of a mini-disaster escalating to disaster level. In becoming more comprehensive in probability thinking, one begins to consider probabilities of mini-disasters occurring and impacting the organization. For some industries and some businesses both the recent oil crisis and the recent financial crisis were just such mini-disasters. One or more mini-disasters impacting an organization in a short period could have the same financial impact as a major disaster. Once all potential disasters and mini-disasters have been defined the probability of occurrence needs to be assessed.
Why is probability of occurrence important? When properly executed, one may look at a BCP as an insurance policy. As with any insurance policy, there are three factors that determine whether or not there is a need. The three factors are: the impact on the organization given the event occurring, the probability the event will effect the organization and finally, the risk averseness of the organization.
Once the decision is made that a BCP is necessary, or more specifically an alternative plan for delivery of a given process is necessary, there is another decision to make. Is the cost of the cure in line with the cost of the interruption? The complexity and cost limits of the plan must be determined.
This decision is based, as are all insurance decisions, on the exposure the organization faces, given a particular process interruption. Exposure is defined as the probability of the events’ occurrence times the impact of the event, given its occurrence. It is not prudent business to build a plan where the costs of the plan exceed the exposure to the organization, the cure is more expensive than the interruption. This then leads to another need, the need to monetize both the exposure and the proposed solution sets; however, this is a topic unto itself and will not be discussed here.
Frequently management is concerned that it is either impossible to come up with probabilities or that the expense to do so is too great. Typically these are not well founded concerns. There are statistical methods available to arrive at almost any probability needed or, in many cases, subject matter expert estimates will suffice. Many times managements lack of past experience in determining probabilities gives rise to a lack of comfort in determining probabilities for a BIA.
However, if one were to ask management for a sales projection for the next year or three years, generally they would have no problem providing that estimate. The reason is there is a comfort level based on past sales experience. The same business acumen that allows for sales estimates allows for many probability estimates. Whether one decides to use probability estimates, use statistical methods, or some combination is based on a benefit/cost ratio.
Once it has been agreed upon that probabilities of occurrence can be developed, the next step is to define which mini-disasters and disasters might occur and which process or processes they might impact. The process maps that were developed earlier facilitate this task. One should, with the process maps in view, review each process with its many sub-processes and list where disaster and mini-disaster interruptions might occur. An easy way of tracking and memorializing this is to use “Fault-Tree Analysis” (FTA). This analysis process was initially introduced to study the probability of system failure where failure was not an option, e.g. space flight or nuclear reactors. The system we are concerned with here is the entire organization made up of the combination of all 12 business processes.
(FTA), for use in BIA/BCP, is a failure analysis in which an undesired state (potential cessation) of a system’s processes and sub-processes are analyzed, for the most part using and/or logic to combine a series of lower-level events. This analysis of these undesired events, mini-disasters and disasters, is mapped using symbols in a manner similar to process mapping. However, an undesired state is taken as the root (“top event”) of a fault-tree. There should be only one top event and all potential interruptions must tree down from it. The top event in every case would be either a process or sub-process failure.
These fault-trees may be as complex or as simple as is culturally acceptable. Once the mapping is completed, the probability of the occurrence of the top event is calculated by assigning probabilities of the occurrence of each of the basic events and then either summing or multiplying these probabilities using the basic rules of probability. Generally if it is an “or” gate the probabilities are summed, and if it is an “and” gate the probabilities are multiplied.
This can become somewhat more complex if one’s model includes situations where mutual exclusivity has to be considered. Mutually exclusive simply means two events cannot possibly occur simultaneously within the same time frame. If one is dealing with an “or” gate the math formula for mutually exclusive basic-events A and B is P(A or B) = P(A) + P(B). P stands for probability. If events A and B are not mutually exclusive the formula becomes P(A or B) = P(A) + P(B) – P(A & B). This simply requires one to calculate or estimate one more probability, the probability of both events occurring at the same time – e.g. an earthquake and a fire.
When an “and” gate is used one must then compute the probability of a basic event occurring given that another basic event has occurred. This is called conditional probability. This is not an extremely complex or difficult calculation, however, it is beyond the scope of this article.
The probabilities for the case above are estimated a .05 for road access interrupted, .001 for terrorist attacks, and .07 for fire at vendor’s facility. These are assumed to be mutually exclusive events, and therefore the probability of the sub-process of “receive inventory from vendor” being interrupted is .05+.001+.07 = .121 or about 12 percent.
Once all the process charts and fault-tree diagrams are completed, and the probabilities calculated, the BIA/BCP practitioner can calculate the “exposure” to the organization for each potential mini-disaster or disaster. Based on this calculation management can determine which processes and/or sub-processes warrant the effort to develop alternative process flows to mitigate any business interruption.
Once the potential mitigation processes have been developed the BIA/BCP practitioner estimates the total cost of implementing the process. Management can now compare the cost of implementation of the various mitigation processes to one another and to the cost of loss of the process, through a cost/benefit analysis, and determine if a mitigation process is financially viable and if so which process should be implemented.
While comprehensive BIA and BCP may seem daunting at first, by following the simple recipe above it can be accomplished by any competent practitioner with minimal effort. The key to success in assuring complete and accurate process flow charts, fault-tree diagrams and probability calculations/estimates are achieved is frequent use of subject matter experts (SME) during the processes of BIA and BCP. Beginning with the 12 key business processes assures there are SMEs within the organization that have in-depth understanding of the processes and sub-processes and the dangers of interruption that are associated with each.
In addition, an SME is likely to have a good feel for the probability of occurrence of any given interruption. Giving consideration to mini-disasters as well as disasters will greatly increase the probability of sustaining an organization over the long-run through all circumstances and in various environments faced over the long-run.
J. Lehr McKenzie, Ph.D., is co-owner of J&B Pinnacle Business Concepts Inc., an organization specializing in comprehensive business continuity planning. Lehr has more than 20 years of consulting experience with mid-size to Fortune 100 companies.
"Appeared in DRJ's Spring 2009 Issue"
