Business Continuity Management Is a Luxury in Times of Recession - Essay Example

?BUSINESS CONTINUITY MANAGEMENT: A LUXURY IN TIMES OF RECESSION INTRODUCTION Business Continuity Management is defined by the Business Continuity Institute as: "...the process of anticipating incidents which will affect critical functions and activities of the organisation, and ensuring response to any such incident in a planned and rehearsed manner" (Institute of Management Services, 2002). It is relevant to any types of organizations that operate in a very high risk environment, such industries like telecommunications, finance and transportations. In a survey conducted by Patrick Woodman (2007) about BCM, there's a 73% of managers report that establishing this kind of program is helpful for the whole organisation; thus 94% agreed that disruption in their business operations had been reduced. Matthys (2009) lists some disruptive or unexpected events which may occur to an organization that may bring harm and other major impacts to the organization and community. Example of events are broken equipments; computer viruses and other IT fraud; phone, internet, power and gas failure; natural calamities; terrorist attacks and all forms of pandemics; and other events that hinder the flow of operations of the business. 2. RECESSION VS. BUSINESS CONTINUITY MANAGEMENT When recession strikes, it is the period when the Gross Domestic Product (GDP) growth is negative. GDP is the total value of the annual output of goods and services produced within a nation's borders. It excludes the foreign output of domestic firms and includes the domestic output of foreign firms (Mankiw, 2008). Because of low GDP, companies' level of output they produce annually has been reduced. One common mistake of some companies during recession is when there is less money to go around, they will cut off their budgets. When this happens, it is inevitable to lay off key employees to reduce their expenses. When there's a decrease of employment rate in the economy, people will be earning lower incomes that will result to a decrease of consumer spending. Businesses then will be forced to lower the prices of their goods that will eventually cause a deflation (KCLAU, n.d.). The 9/11 World Trade Center (WTC) terrorist attack is an example in which local and national economies were pushed into recession. The Fiscal Policy Institute (2001) categorized the three types of direct effects of the WTC fall. First were the businesses that comprise the WTC area. Most of them are securities, insurance carrier, real estate operations and data processing services. Thousands of people working at the hotels, restaurants, banks and other establishments near the WTC lost their jobs, hence Lower Manhattan experienced decline of sales. Furthermore, other industries in New York were also greatly affected in the attack. Example is the air transport industry which comprises 54,000 jobs was shut down for few days not just because of the attack but also most people were already scared to travel by air. This resulted to the decline of tourism. Lastly, the household spending in New York was reportedly made a huge impact during the attack and its aftermath. New York's annual consumption spending is over $200 billion. A 10% one month reduction in consumer spending was assumed by FPI resulting to 9600 job loss. Before the 9/11 attack, it was stated in the Info Security News Magazine of 2000 that 90% of losses will be reduced if an organisation had established beforehand an effective BCP in case of any unwanted event. After the attack, a study conducted that about 81% of CEOs had said that their company plans wouldn't be able to survive with that kind of incident (Naef, 2003). 3. OBJECTIVE CATEGORIES 3.1 STRATEGIC To fully understand the whole coverage of Business Continuity Management, an organization must begin first in the development of the business continuity strategies. These are courses of actions used in the development and implementation of business continuity plan which are approved, documented and funded by the management of the organization. The results of the business impact analysis will be supported by the business continuity strategies (Kildow, 2011). Some of the emergency situations that can be covered by the continuity strategies are denial of access, failure of infrastructures and personnel or key resources loss (Burtles, 2007). The BCM strategy covers the general issues that ensure the protection of an organization's capabilities to provide ways in continuing its business activities. At the level of corporate strategy in this new economy, the board has to be clear what paths that the company should follow (Elliot, Swartz, & Herbane, 2002). When exposed to certain risks, it is very important to assess, monitor and manage the health of the organization, whether it is capable in tolerating it. In this manner, business continuity managers can determine the appropriate solutions to offset the risk. With the business impact analysis and risk analysis, one may be able to understand what are the critical activities, assets and people along with their capabilities within the business. Cash and non-cash potential loss can also be determined and if there are losses the recovery time of transactions and data can also be put into consideration. Most importantly, the ability of the organization to tolerate risk can be better understood. 3.1.1 RISK ASSESSMENT In every disaster or unexpected event, it should not be the physical damage that must be put to greater consideration but the impact of business operations itself. There are many types of business impacts that could affect the entire operation. It could be a loss of information or a distortion of infrastructure elements or resources. Organizations must put a lot of attention once there will be a loss of information because information have different classifications, like folders, binders, contracts and property deeds which are usually paper-type documents that are very vital if it is destroyed. Unlike computer generated files they are likely to be recoverable. After the 9/11 disaster, newer IT approaches were introduced to recover any data loss in a faster manner. Such technology advancement was the RAID or Rapid Array of Independent Disks which is used to copy data simultaneously to many disk files location (Moeller, 2004). Futhermore, other operations or activities in all other departments can also be interrupted during unexpected events. Every business activity has to deal with this event to fully recover what has been interrupted or lost. When an organization was able to cope up with the recovery process, there are still long-term impacts that must be considered. Loss of customers, weakened financial condition that goes along with more liabilities, loss of investor confidence and declining market share are just examples of it. The amount of impacts of the organization depends only on the strength of its business continuity plan (Hiles, 2007). In risk analysis, it identifies threats and its related vulnerabilities that will lead to a better understanding of how it could affect the entire business. The nature of the business is identified first. It is very important that during business continuity, the organizational structures, levels of entities and objectives of organization are well defined with the stakeholders. This is so vital because these stakeholders influence the operations which measure success for the organization. This would then allow to focus and protect the organization's assets before, during and after crisis (Goh, 2008). According to Jonathan Reuvid (2005), there are several types of risk in the BMC programme that must be considered during the risk assessment and these are: market risk in which it assesses the loss of customers after an organization is exposed to risks caused by any changes in financial prices like equity and commodity prices, as well as interest rates and foreign exchange rates; credit risk which happens when there are risks arising from credit events like default, upgrade or downgrade of a counterparty; liquidity risk which happens when an organization lacks of market activity in which buying and selling of assets at its prevailing market rate seems unlikely to occur; strategic risk when an organization cannot provide any evidence of good risk and continuity management plan; operational risk which does not cover only operations in terms of financial matters, but also the organization's assets, processes and personnel which inevitably fails; and hazard risk which an organization will be at risk to loss of any key employees and properties. 3.1.2 BUSINESS IMPACT ANALYSIS (BIA) After performing the risk assessment, an organization would like to know what will be the impact of those risks to all critical business functions. Business Impact Analysis is the process of developing methods to determine what are financial impacts and operational impacts of an organization if its business offices or data center facilities will not be available for an extended time. The objective of BIA will identify business functions, identify methods and resources to restore what has been lost, and assign a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each business unit and associated processes during the restoration period (Kildow, 2011). RTO is the maximum length of time, in hours or days that can elapse before any loss of business functions, while RPO is the point in time, that is acceptable to the organization, that measures how much data has been lost, also in hours or days (Matthys, 2009). 3.2 OPERATIONS To be able to determine whether an organization has the capacity to respond to any disaster and to resume its critical business functions, a business continuity plan is developed. All of its arrangements, resources, and procedures are usually approved by senior managements or board of directors because they are the ones who are responsible in safeguarding all of the organization’s assets. To ensure that the entity's operations still maintained at a reasonable level, BCP should focus the key processes of the business necessary for its survival in case the organization encounters any interruption during the restoration process (Isaca, 2010). 3.3 REPORTING During the business continuity process, it is very important that all details of information must be accurately recorded to support any future internal review, government or civil audits or insurance and liability claims. Any reports presented which are poorly documented can cause issues between the company and external users of the report (Blyth, 2009). The internal auditors play an important role in the continuity plan: building, testing and evaluating. They can be part of the team in which they are allowed to give comments and advice about the progress on the entire process (Moeller, 2004). In addition, these auditors are obliged to follow certain standards, codes of practice and established models and frameworks in the BCP process (von Roessing, 2002). 3.4 COMPLIANCE In this category, the company must ensure that they have addressed some requirements specified by the law, statutes or other regulations for business continuity management. Baum, Noakes-Fry, and Runyon (2005) categorized some laws and regulations that influence BC according to its industry sector: a. Healthcare sector Health Insurance Portability and Accountability Act of 1996 Food and Drug Administration Code of Federal Regulations of 1999 (Title XXI). b. Government Sector Federal Information Security Act of 2002, The E-Government Act of 2002 (Title III) Executive Order on Critical Infrastructure Protection in the Information Age National Institute of Standards and Technology (NIST) Special Publication (SP) Planning Guide for Information Technology Systems NIST 800-53, Recommended Security Controls for Federal Information Systems c. Finance Sector Federal Financial Institutions Examination Council (FFIEC) Handbook, 2003-2004 (Chapter 10) Basel II, Basel Committee on Banking Supervision, Sound Practices for Management and Supervision, 2003 Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, 2003 Expedited Funds Availability (EFA) Act, 1989 d. Utilities Sector Governmental Accounting Standards Board (GASB) Statement No. 34, June 1999 Electric Reliability Council (NERC) 1200 (1216.1), 2003 Federal Energy Regulatory Commission (FERC) RM01-12-00 (Appendix G), 2003 Telecommunications Act of 1996, Section 256, Coordination for Interconnectivity NERC Security Guidelines for the Electricity Sector, June 2001 Other examples of areas of law, statutes or regulations that are defined as a requirement for business continuity are Risk Reduction Statutes which define risk management areas in reducing effects of disaster; and Security Statutes that define the security against all computer fraud (Fulmer, 2005). Based on what industry an organization is mainly engaged, federal regulatory agencies, as well as state and local bureaus can be identified. One of the best reasons behind these regulations to be implemented can be justified during the World Trade Center terrorist attack on September 11, 2001. Many companies and financial institutions lost many employees and infrastructures in which they relied so much on their businesses. With the adoption of business continuity management by several companies, their business integrity remained intact and US was able to rise again in the world market. For example, the finance sector specifies the use of information systems within companies. This regulatory procedure contributed access in a timely basis of information of an organization. 4. GENERAL PRINCIPLES 4.1 PEOPLE RESPONSIBLE FOR BCM The implementation of BCM programme lies initially from a Board-level decision. These are the senior managers or the bosses who accepted the importance of this programme. In the business continuity planning process, the first stage will be the formation of a BCP team (Billsberry, 2004). They are groups of people representing key organizational areas that work together and follow documented responsibilities for the design, development, and implementation of a BCP. An overall coordinator will be assigned for the entire programme who has a broad range of knowledge about business (Talking Business Continuity, n.d.). A recovery team will be established during the recovery process. This involves a project manager who handles the entire activities like budgeting, managing the timelines and most importantly leading all members of the team. A corporate recovery team focuses in the restoration of the whole environment, especially in the technical environment, so that it will become productive again. The people behind these teams can give advice about the overall status of the company which can affect the decision-making process. Other support teams can also be established like crisis management team, administrative support team, damage assessment team, recovery coordination team, corporate communications team, and human resources support team (Hiles, 2011). 4.2 CHALLENGES OF BCM Stuart Hotchkiss (2010) identified several reasons why a business continuity plan often fails. Over-analysis of the business can be a reason. Someone has to decide what is the real importance about the business, since not all parts of the business fall in the same level. Depending too much in IT is another reason. Even though it helps a lot, it may sometimes result to an unsolved problem; same result can also lead when over-analyzing on impacts and risks. Financing BCM is another issue. Success in BCM will likely to occur only when it is planned well and improves business efficiencies in a reasonable timeframe. Another reason also is that companies implement the program to get certified on a standard, in which sometimes it doesn’t tell concrete things in a level of details which is reasonable. Lastly, most companies have this "it won't happen to us" attitude. Even if crisis had already occured to them once, they're completely confident that it won't happen again, but it will; there's no economic stability assurance and organizations in every industry will surely be affected. Likewise, most companies also have this kind of idea that business continuity will only be needed once disaster events occur. 4.2 DRIVERS FOR BCM There are several drivers of business continuity management. Corporate governance remained to be the common driver. This is because it covers all measures and systems in controlling and managing the organization for the protection of all stakeholders. Customer demand comes next. It has demonstrated an increase of interest to adopt business continuity plan in every company. The government is also a significant driver because it covers the adoption of BCM throughout the public sector. The insurance companies also drive the businesses to have a BCM because most of them nowadays are imposing strict rules to all businesses that before they will engage any contract, a business must adhere first the implementation of BCM, otherwise the insurance companies will calculate their fees based on the risk and degree of predefinition of incident procedures. Other drivers are the auditors, regulators, prospects, legislation, investors and suppliers (Matthys, 2009). 5. 7. CONCLUSION AND RECOMMENDATION Some companies misjudged the importance of BCM because it could be another drain on resources which requires heavy labour intensive operation for the business to run. What they didn’t realize is that the cost of having a BCM programme is lesser compared to what the company could potentially lost in an unwanted event. In contrast, some companies perceived it as a helpful and necessary tool for the continuance of the business operations even if unwanted events will occur. Business continuity management is indeed a luxury in times of recession. Given the World Trade Center attack as an example, New York economy and other industries were able to cope up after the disaster. Despite the damages and lost to all businesses in the WTC attack, they were able to recover again what has been lost to them and eventually restart their operations. They had business continuity plans with them as their back up (Jackson, n.d.). To justify the importance of BCM during recession especially in the private sector, organizations can help their cash flows get back on normal track by making sure that systems in invoicing and debt collection as well as customer credit rates are working well during a disaster. Earning profits for a particular year can be possible if the company will reduce it costs by using alternative equipments that are less expensive than using technology that could spend a lot of time to manage, thus making it more expensive to purchase and maintain. Increasing profitable market share can be possible by using improved reliable systems that have the capacity to continue the company's sales channels and customer service. Lastly, BCM programme can help in adding share value by considering risk related contract duration. The idea is when the contract is on a longer term, the company's 'drop-dead value’ and share value becomes greater (Continuity Central, n.d.). Senior managements of all types of organizations must consider the benefits that this programme offers to become fully aware and prepared on any unexpected events and disasters. It is recommended that organisations should start implementing the BCP already. To those companies that currently have BCPs must further extend the overall scope covered by the programme through regular rehearsals, internal and external communication, and evaluation. It is a way to enhance more the effectiveness of their BCPs. References Baum, C. H., Noakes-Fry, K., & Runyon, B., 2005. Laws influence business continuity and disaster recovery planning among industries. [Online] Available at: http://www.gartner.com/DisplayDocument?doc_cd=128123 [Accessed 7 March 2011]. Billsberry, B., 2004. Business continuity management What? Why? How? [Online] VEGA Group PLC. Available at: http://www.vegagroup.com/assets/documents/100005ADWhitePaper_BusinessContinuityManagement.pdf [Accessed 7 March 2011]. Blyth, M., 2009. Business continuity management: building an effective incident management plan. USA: John Wiley & Sons, Inc. Burtles, J., 2007. Principles and practice of business continuity: tools and techniques. Available at: http://books.google.com/books?id=XVVdqRq5dc4C&pg=PA36&dq=business+continuity+legislation&hl=en&ei=kQBuTcvMKYXprAfPw534Dg&sa=X&oi=book_result&ct=result&resnum=6&ved=0CFAQ6AEwBQ#v=onepage&q=business%20continuity%20legislation&f=false [Accessed 5 March 2011]. Continuity Central, n.d. Business continuity management in a recession: luxury or necessity? [Online] Available at: http://www.continuitycentral.com/feature0666.html [Accessed 7 March 2011]. Elliott, D., Swartz, E., & Herbane, B., 2002. Business continuity management: a crisis management approach. USA: Routledge. Fiscal Policy Institute, 2001. Economic impact of the September 11 World Trade Center Attack. [Online] Available at: http://www.fiscalpolicy.org/sep28WTCreport.pdf [Accessed 3 March 2011]. Fulmer, K. L., 2005. Business continuity planning: a step by step guide with planning forms on CD-ROM. [Online] Rothstein Associates Inc. Available at: http://books.google.com/books?id=iOP2K-dLNMMC&pg=PA14&dq=sample+company+strategic+risk+business+continuity&hl=en&ei=dPluTd35HYfrrQef8KjqDg&sa=X&oi=book_result&ct=result&resnum=7&ved=0CE4Q6AEwBg#v=onepage&q=sample%20company%20strategic%20risk%20business%20continuity&f=false [Accessed 7 March 2011]. Goh, M. H., 2008. Developing recovery strategy for your business continuity plan. USA: GHM Pte Ltd. Hiles, A., 2007. The definitive handbook of business continuity management. USA: John Wiley & Sons, Inc. Hiles, A., 2011. The definitive handbook of business continuity management. USA: John Wiley & Sons, Ltd. Hotchkiss, S., 2010. Why business continuity management plans fail and how to get them right. [Online] Computerworld UK. Available at: http://www.continuitycompliance.org/information/business-continuity-information/business-continuity-planning-challenges-and-opportunities/ [Accessed 7 March 2011]. Institute of Management Services, 2002. Business continuity and supply chain management. Isaca, 2010. CISA review manual 2011. [Online] Available at: http://books.google.com/books?id=kTzs_TUMH0QC&pg=PA121&dq=business+continuity+operations&hl=en&ei=UlN0TYfELsTsrQeOvMHXBQ&sa=X&oi=book_result&ct=result&resnum=10&ved=0CGAQ6AEwCQ#v=onepage&q=business%20continuity%20operations&f=false [Accessed 6 March 2011]. Jackson, P. M., n.d. Keeping your organization viable for the future. [Online] Nonprofit Risk Management Center. Available at: http://www.nonprofitrisk.org/library/articles/crisis11132002.shtml [Accessed 6 March 2011]. KCLAU, n.d. How recession happens? 8 tips to prepare for it! [Online] Wealth Management. Available at: http://kclau.com/wealth-management/how-recession-happens-8-tips-to-prepare-for-it/ [Accessed 7 March 2011]. Kildow, B. A., 2011. A supply chain management guide to business continuity. [Online] Available at: http://books.google.com/books?id=Op6zdxNw1KEC&pg=PA50&dq=business+continuity+strategies&hl=en&ei=KDd0TZPWGomzrAey87TSCg&sa=X&oi=book_result&ct=result&resnum=5&ved=0CEUQ6AEwBA#v=onepage&q=business%20continuity%20strategies&f=false [Accessed 4 March 2011]. Mankiw, N. G., 2008. Principles of Economics. USA: Cengage Learning. Matthys, E., 2009. Business continuity management. [Online] Benefolio. Available at: http://books.google.com/books?id=xE5BftXrHGQC&printsec=frontcover&dq=business+continuity+managers&hl=en&ei=7ll0TeTuEIvtrQeY9L3SCg&sa=X&oi=book_result&ct=result&resnum=5&ved=0CEIQ6AEwBA#v=onepage&q=business%20continuity%20managers&f=false [Accessed 7 March 2011]. Moeller, R. R., 2004. Sarbanes-Oxley and the new internal auditing Rules. USA: John Wiley & Sons, Inc,. Naef, W. E., 2003. Business continuity planning - a safety net for businesses. [Online] Available at: http://www.iwar.org.uk/infocon/business-continuity-planning.htm [Accessed 7 March 2011]. Reuvid, J., 2005. Managing business risk: a practical guide to protecting your business. USA: Library of Congress Cataloging-in-Publication Data. Talking Business Continuity, n.d. How do I start planning a business continuity management system? [Online] Available at: http://www.talkingbusinesscontinuity.com/starting.aspx [Accessed 7 March 2011]. Von Roessing, R., 2002. Auditing business continuity: global best practices. USA: Rothstein Associates Inc. Woodman, P., 2007. Business continuity management. [Online] Chartered Management Institute. Available at: http://www2.europeanmanagement.org/fileadmin/user_upload/Business_Continuity_2007.pdf [Accessed 7 March 2011]. Read More