Newsletter Sign-up

Business Impact Analysis Prepares College Campuses for Times of Crisis

Risk managers attest to its effectiveness

FM Global, and Brian Hunt, Senior Business Risk Consultant, FM Global

After a natural disaster or major fire strikes a university campus, what's more important--getting the power back on in the President's office; finding a place for your students to sleep and eat; or ensuring a significant research project is protected?

Often, the answers derive from the school's business continuity plan. However, many such plans are developed without solid financial analysis, which can lead to oversights and inadequate planning. Or, disaster recovery efforts happen on the fly.

The time of crisis is not the time to decide where to allocate scarce resources, money, people and time.

At Southern Methodist University (SMU) in Dallas, Texas, USA, the risk manager and university planners understood the challenges in continuity planning and wanted help setting priorities. For assistance, they commissioned an independent business impact analysis (BIA) to identify and quantify SMU's ability to withstand a significant event with minimal interruption to its core mission--educating students and conducting research.

A BIA is a forensic tool to measure financial and market-related impact to an organization in the event of a major disruption that is either property-related or has consequence for another exposure (e.g. prolonged service interruption). In higher education, a BIA looks at how a school's business model (delivery of academics, research, housing, dining, and even sports) will be affected by a disaster. When a BIA combines an evaluation of an organization's property risks, its business model and an analysis of where the money flows, it can reveal where the most significant risks exist and where to efficiently deploy resources to either eliminate or reduce such exposures.

According to Anita C. Ingram, executive director of risk management at SMU, the school's goals for its first BIA in 2005 were clear: determine the critical functions of the university; estimate the maximum downtime those functions might experience following a property-related disaster and evaluate what resources would be needed to maintain regular services while recovering.

SMU participated in a financial analysis of critical functions and operations by looking at financial data, loss prevention and engineering reports on each of its buildings. Dozens of staff members were interviewed in the process.

The key findings showed that almost all the school's telecommunications needs were run on a single system; with the hub housed in a facility that connected all phones internally and externally. And, like many other schools, SMU has a centralized facility that fully supplies the campus' HVAC via multiple chillers and steam-based boilers. What would happen if those facilities went down? Add to the mix the fact that the power supply from the local power provider is delivered to the campus via overhead wires that drop to the ground at the main entrance.

The findings led university leaders to make strategic decisions to provide for redundancies in the telecommunications system, including back-up generators and a mutual aid agreement with a nearby school. As a result of the BIA, senior management approved capital expenditures for a new electrical substation that mitigates the campus exposure.

"The BIA was very affirming for us, we thought we knew where to place our priorities, but having outside experts validate those thoughts was extremely helpful," said Ingram. "Additionally, it helped us to garner support from the top administration and Board of Trustees."

Five years later, SMU conducted another BIA focused on its information technology. "That's really the river that runs through the entire infrastructure," Ingram said.

"We looked at what happened in New Orleans following Katrina and wondered how it would impact us at SMU. The bottom line is that if you can get your IT systems back up and running to deal with financial aid, enrollment and critical internal, financial and instructional components, and you understand what's supporting your operations from a technology standpoint, you can recover much faster after a disaster."

Ingram said, "the BIA helped us address the question of 'what if' we had a failure in our single data center, and now we have three different data centers backing each other up, and we've strategically invested more than US$2-million in renovations to the main data center."

At Pennsylvania State University in University Park, Pa. Insurance Manager David C. Snowe said, "we believed a BIA fit clearly into our ERM program, and the risk management department was looking to identify the critical paths that led to both solutions in the event of a disaster and what the bottlenecks to those solutions were, as well as to focus and prioritize our business continuity exposures."

In particular, the BIA helped to identify alternate classroom space to ensure there would be limited impact to students if a large lecture hall went off line.

Three years after Penn State completed its BIA, a major fire hit the main dining hall on the school's Erie campus. Due to the BIA, said Snowe, the administration was able to quickly set up temporary kitchens and dining facilities in a gymnasium and keep students on campus.

A student told the student newspaper, The Daily Collegian, "We're not going hungry up here. It's been a crazy day, but the administration has been amazing. They have really taken care of the students."

Snowe gives high marks for the BIA process: "It helped us identify the choke points in our institution based on our priorities, which has led to identifying solutions based on solid financial analysis that is critical to maintaining our operations."

Much can be learned from SMU's and Penn State's experiences. Successful organizations that overcome disaster and stay in business have at least two things in common. First, continuity planning support that begins at the top. If planning isn't a priority, it's doomed to fail. Secondly, those that are successful constantly review their disaster plans, and update them based on current events. As former President Dwight D. Eisenhower said, while Supreme Allied Commander during World War II, "Plans are nothing. Planning is everything."

September 12, 2011

Copyright 2011© LRP Publications