How to Take a Punch and Bounce Back

Ensure continuity of operations when the unexpected happens.

by Geoff Griffin

Business continuity. Business resiliency. Continuity of operations (COOP). Disaster recovery. All of the terms are different and can be found in a variety of places throughout the world, but for Michael Miora, they all boil down to answering the same question — Can you take a punch and keep fighting?

Miora, founder of ContingenZ Corporation (www.contingenz.com) says, “The terminology is, at the least, confusing; at the worst, downright contradictory, but it all is referring to keeping the business moving.”
What has come to be known as “business continuity” is the result of an evolving process over recent years that originally began with IT managers working in the private sector to find ways to make sure computer systems could continue after disruptions, while government officials worked on disaster recovery plans for cases such as floods or earthquakes. The two sectors gradually merged to form an umbrella under which businesses find ways to respond to a variety of problems such as dangers to a supply chain, acts of God, man-made disasters, revolutions in foreign countries, power outages or even the swine flu.

Preparing to deal with such problems and keep the business going can be accomplished in a variety of ways, including outsourcing to consultants, creating an in-house structure or using computer software. Here are some pointers from experts in the area on developing a business continuity plan.

What hurts most?

Miora advises, “Make a list of everything you do and who does it and then ask two questions: First, how long can I live without this? Second, once I’ve gone beyond that time period, what’s the level of pain? When you’re done, order them according to time and criticality.” Miora’s company produces a software application that guides businesses through such a process, which allows them to determine what is most important to them in terms of continuity.

Another way to look at it, according to Roberta Witty, research vice president for Gartner (www.gartner.com), a technology research firm with 1,200 analysts, is to conduct a business impact analysis that conceives of the “worst result” in each possible area, followed by asking the question, “Which ones will put me out of business right now?”

Beyond your business

Witty also suggests that companies “look at the complete life cycle” of the business, including assessing what could go wrong for suppliers a company works with. “You may want to work with suppliers to get them up to speed,” she says, including even putting provisions in contracts with vendors that require them to show they can still provide goods and services in times of crisis.

Witty predicts that such relationships between suppliers and businesses will become the norm in the future, due in part to the passage of U.S. Law 110-53. The law, passed in 2007, allows private companies to gain certification “demonstrating your ability to deliver in difficult circumstances,” as Witty puts it. Such certifications have also become commonplace in Europe. The regulations for the U.S. law are still being developed, and participation is completely voluntary, but Witty warns, “Few think it will remain voluntary.” That’s not because the federal government will begin making demands, but rather “because large companies will begin pushing it down the supply chain,” and demanding that the smaller companies they contract with have the certification. “Once it starts to roll out like that, it’s hard to say it remains voluntary,” she says, while noting that some large companies are already going through and checking on every single vendor they do business with to determine their resiliency capabilities.

Resiliency as a competitive advantage

While creating a business continuity plan may seem like something a company has to do to prepare for the worst of times, Marty Pfinsgraff, COO for iJET (www.ijet.com) notes, “Resiliency can be a competitive advantage. Companies that do it right and do it well will differentiate themselves in the same way they do marketing, production or any other area of business.”

One of the services Pfinsgraff’s company provides is supplying information to clients, who can call in to a 24/7 center that monitors various situations throughout the world. Such information can end up being valuable in ways beyond simple protection, and can even help companies “find gaps in market intelligence,” Pfinsgraff says. He cites the example of an iJET client that was worried about doing business in a particular country. After a SWOT analysis was conducted, the data indicated that the country was actually much safer than the company had thought, and could allow the business to operate at a much lower cost than another country it was considering. The company would have ended up going the costlier route if it had not had the information.
In looking at the history and development of the area of business continuity, Pfinsgraff says, “Today it’s about resiliency. It’s intelligence driven. It’s about early warnings and clear thought processes. You can use it to your advantage.”

Who to hire?

As the area of business continuity has expanded, so have the various certification programs for consultants, and some business schools are even offering classes and degrees in business continuity (see related story). The experts interviewed for this article suggested Disaster Recovery Institute International (DRII, www.drii.org) and the British organization Business Continuity Institute (BCI, www.thebcicertificate.org) as the two leading entities in the area of certification.

However, regardless of what acronym a consultant is able to put after their name, Pfinsgraff suggests looking for someone with “more experience than degrees. Make certain they have specific broad-based experience in your industry. You want somebody who knows the issues of your company and your industry. The cookie-cutter approach probably isn’t going to work.”

“You want to find someone who has worked in your industry,” Witty says. “So much of disaster recovery is about knowing the business.”

When you can least afford it

Of course, thinking about a long-term business continuity plan can be a difficult thing to do when faced with just trying to ensure day-to-day survival during this recession, but Miora notes, “This is a time when people can least afford to do a plan, but they can’t afford to be without it either.” He cites a statistic from the Small Business Administration that two of every five small companies that go through a disaster without having a plan in place will never reopen. “If you lose a few days of revenue, that turns off the tap. You might never come back,” he warns. “You have to ask yourself, can you survive if you lose revenue for a week?”

Miora stresses that having a business continuity plan doesn’t mean being ready to respond to every last situation with the fullest extent of preparation and resources, but rather knowing what you need to do to keep your business going when faced with a difficult situation. He suggests conducting the prioritizing analysis outlined above, and then, “Look at your budget and go down the list and stop when you run out of money.”

Pfinsgraff notes that economic downturns lead to risk factors throughout the world, such as unrest, crime and workplace violence. On the other side of the equation, “Profit is usually your first line of defense to absorb risk. Now there is less of a buffer. So now there are higher risks and fewer buffers.”

The current recession has also meant a tightening of the credit markets, which can affect business viability. Witty points out, “Any kind of outage could have a bigger impact than normal if you can’t go get credit.”

Ready for the world

Ultimately, the benefits of our global economy also come with an increased need for business continuity planning, because, as Pfinsgraff puts it, “You have to do business in certain parts of the world.” And those parts of the world can provide their own challenges. “The scope of business continuity is changing,” Witty says, “There are a lot more things that can go wrong now.”

COOP in College

Among the latest business degree offerings.

As the concept of business continuity has grown and expanded, it has found its way into academia. A number of colleges, universities and other institutions of higher learning are now offering courses and certification programs in business continuity or related areas, and there is even the occasional class offered in MBA programs. One school, Norwich University of Vermont, (www.norwich.edu), has even started a program where students can earn a Master of Science in Business Continuity, or MSBC degree.

“Ours is the first master’s program focused on business continuity,” says John Orlando, program director for Norwich. The first class for the 18-month program started in December 2008 with over 30 students.

Orlando says the advantage of a master’s program is that students can develop “a broader understanding of all aspects of the business continuity world” than they could when just taking a couple of classes here and there on the topic while pursuing a more general business degree.

While the concept of business continuity has expanded beyond its IT roots to the point where, “In the last few years people have begun to integrate it more into the business world itself,” according to Orlando, “It has not yet really been the case that business school professors have embraced it.” Nevertheless, he notes that as a result of the recession, “Big business schools have been taking some blame for not teaching risk management. They are now integrating that into their curriculum.”

For more information on colleges and universities offering courses in disaster recovery or business continuity, visit www.training.fema.gov/emiweb/edu/collegelist