Business continuity management:
An essential tool for an organization's survival

There is a saying that the business of business is to stay in business. This may be a basic expectation of all stakeholders, but is it an objective that all organizations are conscious of and responsive to by putting a mechanism in place to support business continuity? Not especially, if one looks at the results of a 2006 AT&T Corp. survey of the state of business continuity and disaster recover planning in the United States. This survey of more than 1,000 senior executives of U.S. companies with more than US$10 million in annual revenue indicated that:

• 28 percent of U.S.-based companies do not have adequate plans in place to cope with natural or other potential disasters.
• Of those companies with business continuity plans in place, 40 percent say that they have not tested their plans in the past 12 months. But is this something business leaders really need to worry about or is there a sense of paranoia about disasters? If disasters do occur, are they really a significant hurdle to overcome? The AT&T survey results shed more light:
• Nearly 30 percent of those surveyed said that their companies have suffered from a disaster.
• 9 percent of those companies hit with a disaster reported that repairs and business losses cost at least US$500,000 a day. If normal business operations cannot be restored, that translates to a loss of US$2.5 million a week.

A Gartner Group report found that two out of five organizations go out of business within five years after a disaster. It clearly reveals that business continuity planning is something requiring management attention.

The situation in Asia Pacific is no better, as indicated by KPMG’s 2003 Asia-Pacific Business Continuity Management Benchmarking Survey: less than one-third of the organizations surveyed have an organization-wide continuity plan in place.

What is business continuity management (BCM)?

So what does BCM really mean and who is responsible for it? Importantly, how does one go ahead putting a BCM process in place?

BCM is a holistic management process that identifies potential threats to an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.

Traditionally, business continuity has been associated with the recovery of information technology systems. Accordingly, it has been the domain of IT departments within organizations. However, there is a growing realization that BCM is far more strategic and wider in scope than just the protection and recovery of IT systems. Recent disasters such as 9/11, the Asian tsunami and the SARS epidemic coupled with explicit requirements for BCM mandated by standards and regulations such as HIPPA, Basel II and Sarbanes-Oxley have brought top management focus on these issues. Within ASEAN, the need for BCM is perceived as a fundamental necessity even by government organizations. In fact, one of the earliest initiatives in this field has been undertaken by the national standards body SPRING Singapore, which facilitated the development of a BCM framework referred as TR19:2005. The framework provides a good starting point for organizations to put a fundamental BCM process in place.

Benefits of implementing and certifying against a BCM framework

Clearly, BCM benefits all sorts of organizations: large and small, manufacturing and service-oriented, government and non-government alike. However, the scope and depth of BCM programs differ based on the size and complexity of an operation. When implemented — and certified by an independent, third-party expert — a BCM process has the potential to:

• Build confidence in an organization among customers and shareholders
• Enhance corporate governance
• Reduce economic loss
• Improve asset protection
• Assure business partners that goods and services will continue to be available
• Project a favorable corporate image as a "well-prepared" organization
• Facilitate globalization efforts

Conclusion

It is no longer enough to answer the hypothetical question of what happens if a disruption occurs to business. Today, business leaders need to ask what happens when a disruption occurs to business. That change in mindset distinguishes a resilient organization with BCM capable of bouncing back from a business that hopes to get a “second chance”. Today’s competitive landscape does not provide many “second chances” to organizations impacted by a disaster.

By JC Sekar, General Manager (Asia Pacific Middle East & Africa) of Management
Systems Registration Services of Underwriters Laboratories Inc. (UL).
For more information about UL’s service offerings on BCM, contact JC at JC.Sekar@sg.ul.com.