Spring World 2018

Conference & Exhibit

Attend The #1 BC/DR Event!

Spring Journal

Volume 31, Issue 1

Full Contents Now Available!

Some years back, while in the defense industry, I met a fellow who mentioned that he once worked with a Hughes reliability engineer named Murphy, the very man responsible for “Murphy’s Law.” Reliability engineers are principally involved in analyzing why systems fail tests so they can determine changes to the materials, components and/or processes that will prevent a recurrence of the failure. This work tends to engender a lot of sarcastic commentary among its practitioners, so one can easily understand coming to conclusion that, “Anything that can go wrong, will go wrong.”

A few years later, I came across a corollary to Murphy’s Law that I have seen proven out many times: Marshall’s Generalized Iceberg Theorem: “Seven-eighths of everything can’t be seen.”

Man the Lookout Towers

Of course, those familiar with icebergs understand that the specific gravity (a measure of relative density) of ice is such that, in salt water, only about one-eighth is visible. This was, for example, why the HMS Titanic’s lookouts underestimated the possible shape and girth of the berg that tore into the hull.

In recent articles I’ve read, and in conversations with business continuity planners, I have begun to detect a similar phenomenon in the market for planning consultants: Companies are scrambling to address compliance with Sarbanes-Oxley and other new regulations in the aftermath of financial reporting scandals. But none of these measures contains clear mandates for assuring continuity of firms’ critical operations. They look at the language of the regulations and address it point by point, inevitably with a stern eye on minimizing their costs to comply. While that is understandable, even commendable, from a stockholder’s view, it reinforces a tendency to see only the one-eighth that’s clearly in view, missing the lurking threats beneath.

 

 The View From the Top
Executives in publicly-held companies have narrowly defined options, when it comes to managing the enterprise, mainly because there is a board of directors that oversees their performance for the protection of investors and creditors of the firm.

To be sure, this oversight has varied so widely among companies, that boards are now also the target of some of these new laws, themselves being made accountable for maintaining an arms-length relationship so as to avoid being so “cozy” with the executive staff that they overlook blatant mismanagement. But still, there is ambient motivation to “not do more than is absolutely required,” owing to the adverse impact additional operating overhead has on their bonuses (Horrors!).

This is where the icebergs of threat from unplanned interruptions to critical operations escape the lookout’s view. The things that can’t be seen “…just aren’t there,” in their view. Despite such calamities as the World Trade Center attacks, tornadoes in Oklahoma, earthquakes et cetera, there is a disconnect between the events and the perception of vulnerability for many executives. They just don’t believe they are at risk.

Unsinkable?

Simple physics suggests that the only way a ship is unsinkable is if it’s largely built with materials that float (think wood, styrofoam, etc.). But that’s not the only issue, from a business continuity perspective. Enterprises may be situated such that sinking doesn’t necessarily threaten the survival of the whole operation, perhaps because they’re in separated sites, like ships in a fleet, dispersed enough to avoid likely common threats, yet sufficiently proximate to maintain smooth operational flows. This is not the same approach as the Titanic, where all reliance was placed on the assumption that no more than two water-tight bulkheads would ever be likely to be breached. Likewise, hardening a company’s building structure may be effective in thwarting some events, like a bombing, but may not be as effective against severe natural disasters, such as ice or wind storms or earthquakes. Why? Because damage to the facility may not be the loss incurred. Rather, the workforce may not be able to report to work, either because they and/or their families are dead or injured, their homes are wrecked, or simply that roads are impassible. The building’s fine, it’s just empty. The mainframe, servers and network are humming along, but the users aren’t there. The ship’s afloat, the boilers are fired, but there’s no crew.

Mandatory Lifejackets

If you’ve ever gone fishing from a boat on a small lake or pond, odds are that there are either no life jackets on board, or they are used as seat cushions. Or, the seat cushion serves as a floatation device. It’s just that, “Hey, it’s a little lake, what’s the risk? More importantly, they’re uncomfortable and make casting difficult. Besides, the Coast Guard isn’t around to catch us….”

Discussions with fellow planners have focused on finding something like Sarbanes-Oxley or ISO17799 that mandates executives create viable business continuity programs. But after observing the corporate reactions to these regulations, including, sadly, few initiatives by BC consulting firms to capitalize on them, one may conclude that laws and standards are being treated like life jackets. If there’s no one there to catch you without it, or if you believe you’ll convince the game warden or Coast Guard to let you off with a warning, you may keep a few in the forward cabin, just in case, but wear them from castoff to mooring up, no way.

This leaves few alternatives, if the protection of stockholders’ and stakeholders’ interests in the enterprise is of any value. Namely, mandatory life jackets. Until corporate executives can face criminal contempt charges or civil litigation for failing to have a current, viable and regularly tested business continuity program plan, they will not do it. But in the face of such punitive outcomes, especially armed with the knowledge that their competitors must also spend the money to comply, objections to funding a sound BC program plan become moot.

Coping with the Discomfort

As noted above, life jackets are cumbersome, but that’s only until you’re forced to use it to stay alive. No one is more politically averse to government meddling in the affairs of commerce than this writer. But the stakes are positively too high for just “letting market pressures deal with it.” This was true of environmental protection mandates for coal-burning power plants. No amount of creative accounting could cost-justify erecting electrostatic precipitators that consume 25 percent of plant output, just to keep the air clean. They had to be compelled by force of law.

Given the continued lack of support for adequate BC programs by corporate executives, the time has come for Congress to act decisively. The millions of Americans whose livelihoods and future financial security is increasingly grounded in the long-term health of the enterprises, for whom they work and in which they invest, deserve it.


Gregg Jacobsen, CBCP, is a business continuity consultant in Westlake Village, Calif., currently “between, and actively seeking, engagements.” He holds an MBA in Organization Development from the Kent Graduate School of Management and is a Certified Business Continuity Professional.