Newsletter Sign-up

By MIKE KEATING, director at Navigant Consulting

Business continuity management has never been more important than it is today. Product liability and recall and their potential to disable a business and cause permanent damage are ever-present dangers. New standards of care surrounding acceptable preparedness for business interruptions are emerging, and the expectations of customers and business partners are higher than ever. Risk managers now have more people to answer to as a result.

Quoting a standard is a great way to divert the issue from "is our program good enough?" to "what kind of program should we have?" The first question leaves the BCM program officer constantly on the defensive, but the second question is provocative enough to allow senior management and the board to arrive at a conclusion that will match their expectations with the mission, mandate and the money necessary to implement their wishes.

Although many risk managers and others responsible for business continuity might not realize it, there is no shortage of business continuity standards available to assist in creating or amending business continuity policy and governance. BS 25999 is the first ever standard available that can result in a whole program being certified. NPFA 1600 was endorsed by American National Standards Institute and the Department of Homeland Security as the National Preparedness Standard and has been adopted with revisions in Canada.

The American Society for Industrial Security has recently petitioned ANSI to create another standard for business continuity programs. In all, there are dozens of BCM standards targeting various industries, regulatory bodies and disciplines of the preparedness process.

Because it is not yet known which standard will rise above the others or if one will become pre-eminent at all, risk managers and BCM program officers should build their programs to a composite of all the major standards. While that could seem like a lot of work, the Alfred P. Sloan Foundation commissioned a study (titled "Framework for Voluntary Preparedness") that reviewed several major standards and summarized their areas of commonality in its Appendix C.

The document is an excellent tool to evaluate how one's current BCM program compares to the 42 bullet points found in each of the key BCM standards.

RESILIENCE EQUALS REVENUE

Someone once said there are two kinds of lawyers--the ones who provide all the reasons you can't do what you want and the ones who explain how you can do the things you want without getting into trouble. Risk professionals can be the same way; we often are so keen to detect the risks in our operating model that we fail to see the opportunities those risks bring.

Effective BCM programs are those that understand the new risk world their enterprise faces and can identify how continuity strategies allow the company to capitalize on doing business in places or ways the competition fears. Less competition can mean less pressure on price and better margins, all the while serving customers who otherwise would have to do without your industry's product or service.

How does this work? Take the instance of a professional or financial services company. Success there has less to do with capital equipment than relationships formed and cultivated. During a strategic planning meeting, the sales leader mentions she believes there are major opportunities in a certain part of the world that outsiders believe is risky. After a significant amount of debate, the company remains split because it does not want to put its people in harms way. Perhaps the team settles on a trial attempt, if it is possible.

Risk managers might approach this situation as though the business were already there but interrupted because of a traditional disaster and in need of a temporary continuity solution. How would one deliver that product or service in an alternate environment? Are there business partners that should be recruited to augment staff and, if so, how would one protect intellectual property?

Could the company transfer staff in on a part time basis to minimize their exposure--remaining in the region only for those tasks requiring a physical presence and perform the remainder of the work remotely? Are there parts of the operations that could be done without or done elsewhere, even at higher cost, because an on-site continuity strategy is not practical?

Using the type of approach one would normally use for creating continuity strategies can be an effective way to bridge the gap between risk and reward and add tremendous value to the organization.

INTEGRATING RECALLS

Recent high-profile product recalls from Barbie to dog food have highlighted how important BCM is for actual events, ones that can bring a company to its knees as much as fires, floods and terrorism can.

In many of these recall cases, companies have gone completely out of business or suffered worse long-term harm than had a fire broken out in a major facility.

Business continuity practitioners can serve their organizations well by learning everything they can about the product recall process, the products most at risk for a recall and how the BCM program can improve the organization's ability to mitigate the exposure.

In many cases, those responsible for product recall can be so preoccupied with the tactical efforts to retrieve product from the marketplace and ensure its proper safekeeping or destruction that larger strategic issues can go unnoticed.

The business continuity program officer is in a perfect position to work with senior executives and the product recall team to answer these strategic questions. Some issues to consider include:

--Will customers want this product ever again?

--Are the product risks such that a marketplace retreat would be superior than a recall? If so, how would one manage the potential perception that they were just being cheap?

--Can one still use the facilities and equipment involved with the recall or would retiring them provide more long-term benefit?

--Is the product in question part of the strategic product mix? If not, should production simply be terminated?

--What supply chain issues will a recall create (both production and demand side) and how will they be managed?

--Can terms be negotiated with business partners to maintain shelf space or other externally controlled assets with replacement product either temporarily or permanently?

CASE STUDY OPTIONS

Let's use a fictitious example to illustrate. Imagine running the Hamburg Widget Co. and receiving a phone call that perhaps one of the machined parts it manufactures is out of specification. It comes to light that there are probably 150,000 parts in the marketplace at risk, most of them in washing machines and other household appliances.

If the BCM program is well integrated in advance of the product recall threat, the risk manager or BCM manager could, accurately and in detailed fashion, based on her business impact analysis, advise company executives of the economic and operational risks of shutting down the production line while it is repaired.

The manager could also give input on other ways to ramp up production at a sister facility to make up the temporary outage on the affected line. And she could even share insights on the risk of permanent loss of business from the company's OEM customer base that had to endure 150,000 calls from irritated hockey moms and the retailers that sold the products.

With a detailed plan in place, the company can even offer to help guide the OEMs through a crisis management process of their own as they field calls so they do not simply blame Hamburg Widget for the failures.

These are only some of the indications that BCM is becoming mainstream, and the discipline is evolving continuously. Senior management, board member and customer expectations for BCM have never been higher than they are today. Effective BCM programs will not only embrace these changes, they will thrive in them, providing more enterprise value in the process.

October 15, 2008

Copyright 2008© LRP Publications