by Gary T. DuVall, FMP — February 2016 — Organizations face many challenges each day. In an effort to face these challenges, sustainable businesses strive to manage risks related to finances, people, and the environment, often referred to as the triple bottom line. It can be argued that business continuity is essential to two areas of the triple bottom line, people and finance. The emergency preparedness aspects of business continuity affect people directly and many times is the most visible positive change during business continuity planning. From the finance side of the triple bottom line, we want to shift our focus from the short term to the long term and look at total cost of ownership. Smart long term planning includes business continuity and disruptive events can have a direct impact on profit if not planned for. Many times, organizations only consider these risks on a monetary basis. What they miss is the relationship between the severity of risk and time of recovery. Truly sustainable businesses can survive during times of crisis because they have taken steps toward long-term resilience.
The pursuit of certification in Business Continuity is a major decision within any organization; one that many have never considered. Business Continuity, simply put, is an organization’s ability to continue provision of service during and following an event that would otherwise cause a disruption. By predetermining acceptable levels of delivery and creating a structured response, an organization places itself in a position to remain functional during times of adversity, regardless of the nature of the event. Development of a Business Continuity Management Plan defines the strategy, resources, activities and procedures required to continue delivery of prioritized services if normal operations are disrupted. Certification by a third-party acknowledges that an organization has taken the necessary steps toward an ability to demonstrate sustainability of business during times of crisis.
We would all like to think that we could face any situation head-on and come out on the other side unharmed. The reality is that any event unprepared for is an event that could cause irreparable damage. Although the probability of a major disruption may be low, the impact of disruptions, even minor, can be significant. Careful business continuity planning can mitigate the impacts of the disruption and allow an organization to continue to function or to return to normal faster. Effective business continuity planning will have a positive financial impact as it decreases the negative financial impact that a disruptive event can have. In addition, business continuity planning doesn’t have to cost a lot. Much of the cost incurred is related to time associated with personnel or consultants. Major expenditures are typically not required.
An organization must first assess risks and evaluate the potential impact that each may have. Risks can be natural or man-made; from weather events that create travel challenges to police activity that challenges the human spirit. Analyzing the impact to business associated with each of these identified risks is a key component in the ability to keep business moving forward. These components are realized by performing a Business Impact Analysis (BIA) and a Risk Assessment (RA). The BIA involves interviewing people across all key departments such as human resources, finance, and information technology. The goal of the BIA is to identify the key inputs and outputs of each department. Once these inputs and outputs are determined, the BIA process allows an organization to look even closer at these processes and determine what aspects are critical to continuing business. The next step in the process is to take the outputs of the BIA, the key processes and impacts, and perform a risk assessment to determine the threats to those processes. The primary threats to consider begin with loss of facility, loss of personnel, loss of telecommunications, and loss of utilities. Performing the risk assessment calculates an organization’s risk and risk vulnerability. This allows an organization to consider each threat and determine the level of each; high, medium, or low. Calculating the risk enables an organization to prioritize the mitigation strategies and minimize expenditures. By taking a microscope to your organization’s processes, you will be surprised how much you learn about your processes and your personnel. There are likely risk mitigations strategies already in place, even if they have not been defined as such. By performing a Business Impact Analysis and a Risk Assessment, strategies may be identified, such as a process for backing up data. This is a risk mitigation strategy for loss of data.
As a Facility Manager, I had never understood the level of responsibility that I have as it relates to our organization. During the early days of this journey, I came to understand the tremendous obligation that I have to our business and the people who contribute to its success. Each day our employees, from top management to general staff, have a reasonable expectation that a place has been established where they will be able to perform their daily responsibilities. At the same time, the organization has a reasonable expectation that these employees will perform these assignments efficiently and effectively. It is the responsibility of the Facility Manager to ensure that the office space provides an avenue to do just that. As part of our organization’s overall business continuity planning, a safety manual was developed. The manual provides detailed emergency instructions for employees who work within the office and helps to ensure employee and visitor safety. The written plan communicates policies and procedures for employees to follow in an emergency situation. Beyond that, we designated teams and allocated individual responsibilities so that in the event of an emergency each person knows what to do. We then practiced these procedures. Development of this manual also provided an opportunity to expand relationships with local community and government agencies. We involved property management, as well as local police and fire officials throughout the process. With the weather becoming more difficult to predict and storms becoming stronger and more frequent, organizations face a greater increase in business disruption. Threats to information technology are also becoming more frequent and intense. Business continuity planning also allows for coordination of contacts for clean-up, additional space or other items needed to continue business. Thus, in the time of a crisis, an organization can have contacts, and in many cases contracts, already in place that will enable them to act immediately.
What if today is not just like every other day? What if today requires different actions? Everyone, regardless of their position within the organization, will need to know a few basic things beginning with where to go during times of uncertainty. They will also need to know their individual responsibilities and when they should initiate these activities. Establishing and practicing these scenarios prior to an actual event will enable a smooth transition from crisis to recovery.
Business continuity planning provides guidance for ensuring the ability of your personnel to respond, resume, and restore to a pre-determined level of operation following a disruption. Keeping in mind that business continuity planning costs are most often related to personnel or consulting resources rather than infrastructure investment, the return on investment can be positive. If you consider the potential financial impact of damage to your reputation, the return on investment in business continuity planning is almost immediate. Business continuity planning makes financial sense and should be incorporated into every business, regardless of size or operation. Although the threats may have a low probability, through business continuity planning efforts, an organization can identify what the impacts of those threats are and put a plan in place to reduce those impacts. Thus, ensuring the sustainability of their business and impacting the triple bottom line.
Gary DuVall is a Project Manager with Facility Engineering Associates, P.C., and is the Facility Manager at FEA’s Corporate Headquarters in Fairfax, Virginia. Facility Engineering Associates offers assistance to organizations pursuing certification in Business Continuity.