Justifying business continuity to the business

Business continuity management makes sound business sense. Without it you run the risk of a damaged reputation, loss of revenue and market share, cashflow problems and a plummeting share price. What’s more, if it’s seen as poor corporate governance, directors may be personally liable for failing to make business continuity provision.

In order to implement business continuity management (BCM) you need an executive sponsor; someone who will be responsible to the Board and shareholders for ensuring business continuity. He or she needs to be able to justify their actions and the business continuity budget.

A Business Impact Analysis will enable you to understand how any break in the flow of information through your organisation will affect it. The degree to which it is affected (risk) will depend upon the nature of your business and the extent of the interruption. Typical risks are seen as:

Brand damage

In today’s business climate when brands can be given a monetary value on the balance sheet, it is more vital than ever before to protect brand image. Consumers will subjectively buy a brand they trust. However, with so much choice in the market they will not hesitate to switch brands that fail to deliver. It can take ten years to build a reputation yet just ten minutes to destroy it.

Loss of market share

The cost of rebuilding market share after an interruption can be considerable. In many markets the advertising costs associated with increasing market share by even 1% can run into millions of pounds, yet in highly competitive markets several percentage points can be lost in only a few days outage.

Impact on share price

This is a relatively recent phenomenon most clearly demonstrated by the example of eBay. The online auction house suffered a 22 hour outage, which cost it $5 million in lost revenue and a 26% drop in its share value.

Loss of revenue

Any disruption to the business will affect revenues and, in turn, profit. This can be compounded by the effect on share values and the cost of borrowing.

Conversely, having a business continuity plan in place can increase revenues. Outsource providers, for example, charge an additional fee for business continuity to be in place.

Critical suppliers

Lean manufacturing and just in time procurement has increased dependency on suppliers; if they fail, the impact on the organisation can be devastating.

Corporate Exposure

The profits and share values of corporations are tied into the performance of subsidiaries. Failure or losses in a small subsidiary can have effects out of all proportion within parent corporations.

Cashflow

Managing cashflow is essential. If the accounts department is unable to work, because they have been barred from the office, or there is an interruption to the invoicing application, which disrupts a company’s invoicing schedule, the effect on cashflow could be catastrophic. Equally, the inability to make payments could affect the supply of a vital component, bringing the manufacturing process to a grinding halt.

Contractual liability

The effects of outages are now well known. Consequently, many service organisations competing in tendering processes are forced to have business continuity in place in order to compete. This trend will accelerate as the adoption of BS 25999 leads to greater focus on the supply chain.

Once contracts are signed companies are contractually liable for any business interruptions that materially affect the service they are providing.

Legislation

While there is as yet no blanket legislation requiring businesses to have a business continuity plan in place, directors do have a statutory obligation to “exercise reasonable care in the performance of their work” (source: Institute of Directors) and act in the best interests of the organisation’s stakeholders.

Furthermore, there are a variety of measures specific to certain elements of the business, such as Control 22 of the Data Protection Act, and to certain industries – particularly those in the financial sector.

Audit and financial control

In the light of high profile business failures, shareholders now demand that their investment is adequately protected. Business continuity management has become such a crucial aspect of good corporate governance that failure to take it into consideration could be viewed as a dereliction of duty and opens up board directors to personal liability and the possibility of civil and criminal action.

Rigorous audits will highlight any deficiencies with a spate of new control measures such as ‘Internal Control – Guidance for Directors on the Combined Code for Corporate Governance’ and Sarbanes Oxley, which affects UK subsidiaries of US corporations and UK firms listed on the US stock exchange.

Other business continuity drivers

All the risks outlined above have a direct financial implication to the business and the growth in business continuity is in part due to a greater awareness of these risks. However there is another key market driver – namely the impact of incidents themselves on Board awareness. We are frequently contacted by companies interested in implementing business continuity after high profile incidents with major press coverage or when they are being affected by a disaster themselves. Boards should be made aware of the fact that disasters do happen regularly, though the vast majority of these do not gain mass media attention.

Balancing the risks

Once the risks have been identified and quantified, it is possible to apply a probability against each risk. The risk, multiplied by the probability should help determine the budget that should be allocated to mitigating those risks, and their relative priority.

		Risk Likelihood
		Low (2)	Medium (3)	High (4)	Very High (5)
Business Impact	Very High (4)	8	12	16	20
	High (3)	6	9	12	15
	Medium (2)	4	6	8	10