DRJ's Spring 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Spring Journal

Volume 32, Issue 1

Full Contents Now Available!

DRJ Blogs

DRJ | The premiere resource for business continuity and disaster recovery

Business continuity and return on investment

ROI

One of the best ways to attain senior management buy-in, for any project, is a return on investment (ROI) analysis. The same is true for any business continuity management program implementation. Just one problem. With the exception of financial institutions, it is very difficult to show ROI in financial terms (which executives like). With financial institutions, you can come up with a formula for lost interest on loans over time, loss of fees over time and loss of new business over time. Most other companies don’t have such hard and fast methods to determine financial loss. Sometimes, it comes down to ‘best guesstimates’. Picture managers looking towards the heavens as they try to compute unknown numbers, “Let’s see... there’s the cost of temporary workers (how many? I don’t know), potential overtime hours (how many? I don’t know), the cost of vendors picking up our processes (the Business Impact Analysis can help – but the vendors want to make a profit too), cost of Alternate Work Space (how long are we going to be there?), are there any penalties we have to account for, etc. etc. etc.” Sometimes, you just can’t put a dollar figure to it.

A former colleague once said to me, “business continuity requires you to think outside the box, because the box has been blown away.” Because so much of what we do seems to be art, as opposed to cut and dry mathematics, looking at ROI strictly in the financial sense won’t give a complete picture. As Robin Williams' character – Mr. Keaton – said in ‘Dead Poets Society’, "This isn't like laying pipe." Yes, we have standards and processes, tried and true. However, there are just too many unknowables to give a dollar figure saved (or made) for a BCM program. Sure, we can probably do it based on a Business Unit / Critical Process basis. But for an overall program? In some instances, there can be a return on investment but I would think it would be virtually impossible to calculate. As noted earlier, I think it will usually come down to a best guesstimate.

So, the question becomes, ‘Can we afford not to do it?’ In my opinion, there actually is a ROI in having and maintaining a robust business continuity program. Perhaps not in a financial sense though. Will we attract future business if we implement a business continuity program? My estimation? Looking at a couple anecdotal events, I would say yes.

When I worked in banking, I once was involved in a situation where an ice storm shut down a medium-sized town due to power outage that was estimated to last about a week. This happened on a Friday at the end of the month. For those not in the States, the end of the month / first of the month is when Government checks / Direct Deposits are delivered and/ or credited to accounts. With the branch closed, could our customers go without hard currency for that long? Maybe… probably. But why should they? We found and moved a generator to our facility, got it up and running by the next day. As soon as power was restored via the generator, the phone lines lit up with people asking if the branch was open. Yes, we were the only bank in town that was open. The branch stayed open with extended hours to accommodate customers (and potential customers) who were having trouble getting around in the severe conditions. How much more business did we attract because of our actions? Impossible to tell, but I'd be willing to bet we probably did get some return on investment. How much is anybody's guess.

Another situation. I went to a branch location to run a test / exercise on their procedures in case their systems went down. While there, a customer came in wanting to open an account for his newborn daughter. I asked if it was all right if he would allow us to use him as an example of how the processes would be accomplished off line. He was agreeable and the exercise was undertaken and completed. Afterwards, the customer thanked us, even shaking my hand when all I did was stand there and watch. It was important to him that even though we may be having problems, we could still service the customer and make sure he could do whatever he wanted us to do. Did we save or make money? Hard to tell. Did he tell his family and friends that his bank was ready to help him no matter what? I’d be willing to bet he did.

One more example. My company took such care and diligence to address all aspects of a Business Continuity Program that the regulators sent a bank struggling with the process to us to see what we did and how we did it. This elevated respect by the regulators had to spill over in their view of the bank. Ensuring a robust business continuity program directly illustrates the care and fiduciary responsibility we maintained for our customers and stockholders.

Another way to establish ROI is to bring them into the equation. Personalize it. In my presentations, I ask the questions: "Who here has a fire extinguisher in their house?" Hands go up. Then, "Who here has a spare tire in their car?" Almost everyone’s hand goes up (there’s always that one person). Finally, "Who here has Life Insurance." Again, almost everyone’s hand goes up. Then I ask, "why, what good will it do you? You're dead." Invariably answers come back, "To take care of my family in case something happens to me." I point at the ROI question, "If you do that to make sure your family unit can go on in the event of a disaster, why don't you want to take the steps that may ensure your company's continued future?"

Finally, you can also use Business Impact Analysis – but not in a strictly financial sense. When I perform a BIA I ask:

  1. What would be the impact to the company if you were unable to perform this process? How will it affect the company financially (expense, loss of business, loss of future business etc.)?
  2. Will it affect our ability to provide services to our customers?
  3. How would it affect us (other internal departments) operationally?
  4. How would it affect our image / brand?
  5. Are there any regulatory or legal ramifications?

For the final nail, having a robust business continuity program can save you money during an actual disruption. When a regional disruption occurs, your company will not be the only one clamoring for vendors to help you. In the aftermath of a tornado, hurricane or other widespread disaster it will be very difficult to line up vendors who can help you recover. How easy would it be to find carpenters and construction companies to fix your damaged facilities, waste service companies to haul away the debris etc.? Trust me, they will be in short supply, and very expensive. Supply and demand. However, with a robust BC program you will already have a relationship with a vendor who can help you, and won’t break the bank in costs. In the first example above, we already had a relationship with a generator vendor. They helped us locate a generator, ship it where we wanted it, and sent a technician to perform the wiring into the branch facility. If we didn’t already have that relationship would we have been able to get all that accomplished? Doubtful. Would it have cost more than what we paid? Definitely. A robust business continuity program ensures that relationship already exists.

When you break it down, a severe disruption could adversely affect our bottom line in a number of ways, not just the loss of money. To paraphrase another colleague, “What is the return on non-investment? It could be very expensive - maybe your business.”

Miles Coburn MBCI

The justification for business continuity
Resilience for NoSQL - Meet Datos IO