Business continuity: creating a framework for success

Business continuity management has suffered in the past from poor planning across the organization, placing ownership of the process in the wrong hands, and an inability to clearly delineate responsibilities throughout the governance structure. A new Management Accounting Guideline, jointly produced by CMA Canada and the AICPA, sets out to address these deficiencies.

By Eric Krell

The critical nature of business continuity management (BCM) capabilities has played out here in North America and around the world numerous times in the past year. The Indian Ocean tsunami, the terrorist attacks on London’s subway system, and the recent hurricanes on the U.S. Gulf Coast have demonstrated that both public and private BCM capabilities have a long way to go before they are sufficient.

A soon-to-be-released CMA Canada Management Accounting Guideline on business continuity management, jointly produced with the American Institute of Certified Public Accountants (AICPA), points out that the frequency of manmade and natural disasters has increased in recent years. More importantly, the impacts of disasters on companies have greatly increased and intensified thanks to technological advances, progressing globalization and the extension of the supply chain. Companies of all sizes are ‘connected’ to their suppliers and customers to a much greater degree today than ever before.

Thus far, however, efforts by corporations to up their BCM capabilities have remained negligible. A recent study notes that 93% of companies that lose critical systems for more than 10 days quickly file for bankruptcy. Without a business continuity plan, a company cannot survive.

CMA Canada and the AICPA have not created this new guideline to fear monger; the guideline is simply presented to give guidance on the most effective and cost-efficient investments businesses can make to improve their BCM capabilities.

The guideline sets out to define BCM as a corporate capability, and identifies its essential components and processes. It defines the roles and responsibilities that corporate managers and boards fulfill in the development of effective BCM practices. It also presents a step-by-step framework for developing and maintaining effective BCM processes, and an overview of the software applications available to support BCM planning and execution processes. This should offer essential guidance to finance and accounting managers, other senior-level executives, functional and operational managers and corporate boards.

Disaster recovery to continuity planning

Although the discipline still has a long way to go, organizational business continuity management has evolved significantly over the past two decades. In the past, what was known as “disaster recovery” usually focused on data processing or information technology (IT) departments. These early implementations primarily focused on getting hardware, software and data up and running again after a power outage. Today, however, it is generally recognized that business continuity planning efforts require a cross-company perspective and can’t be owned by solely by the IT department. Yet many effective continuity tactics have emerged from disaster recovery efforts in the IT function during the past decade. For example, many of the same principles that apply to data and systems backup also apply to facilities management and backup.

Disaster recovery has grown to encompass business continuity planning process. The phrase “business continuity planning” was used to suggest the expansion of continuity efforts beyond the confines of the IT department. Most recently, the use of terms like “business continuity management” and “business resiliency” have increased, emphasizing the need for more proactive continuity efforts.

A business continuity plan, as Figure 1 illustrates, begins with executive-level assessments of an organization’s continuity objectives. That assessment is followed by the identification of the organization’s most important business processes. Then, finance managers and other business managers analyze the critical components of those processes: people, facilities, technology systems and the data the systems contain. The analysis should also take into account how an unexpected business interruption could affect suppliers and customers.

The ensuing response processes ensure that all of the components that enable a critical business process are restored within a prudent amount of time. Defining what is prudent demands input from the finance and accounting function because it requires a deep understanding of each process’s value to the business, and the cost of restoring the process within a given amount of time.

The resulting plan should then be monitored, tested, and, when necessary, adjusted or improved. The new Management Accounting Guideline explains, in detail, each step of the business continuity planning process.

BCM and risk management

Business continuity management is a subset of enterprise risk management (a topic addressed in the Management Accounting Guideline “Identifying, Measuring, and Managing Organizational Risks for Improved Performance.” For more on this subject, read “Measuring the payoffs of strategic risk management,” by Melanie McGee, in the November 2005 issue of CMA Management.).

BCM’s rising importance and IT-based history have created internal debates about who owns the BCM function and how BCM relates to a company’s existing risk management efforts. Again, business continuity management is a subset of a larger risk management strategy. The most significant difference between risk management and business continuity management relates to the output of each process. Risk management strategies (either risk avoidance or risk mitigation — through risk reduction, risk sharing or transfer of the risk) are formulated before an event, or risk, occurs. Most BCM strategies and tactics focus on the processes that occur after an event, or disaster, occurs; the objectives of those processes are to restore the business to normal operations as efficiently and effectively as possible. 

The Business Continuity Institute’s “Good Practice Guidelines (2005)” present a partial, but useful, comparison of the two disciplines; a portion of this comparison appears in Figure 2 (for more information visit www.thebci.org).

Most companies now operate in a more connected business climate. Numerous organizations of all sizes are virtually tethered to a growing number of customers, suppliers and distributors through an extended web of technology systems and processes. Thus, although the technology side of the business continuity issue remains very important, that connectivity exacerbates the negative impact of a prolonged business interruption on every other part of the business as well.

For instance, not only did large automobile companies lose millions of dollars to production delays when the U.S.-Canadian border was closed and just-in-time inventories dried up in the wake of the Sept. 11, 2001, terrorist attacks, their suppliers and their suppliers’ suppliers also suffered financial setbacks.

Government response

A growing number of new industry guidelines, organizational rules and government regulations on business continuity management also represent, in most cases, a positive development.

On April 7, 2004, the U.S. Securities and Exchange Commission (SEC) approved New York Stock Exchange (NYSE) Rule 446, “Business Continuity and Contingency Plans.” The new rule illustrates the degree to which new laws, rules and guidelines are driving the need for stronger business continuity management capabilities at a growing number of North American companies.

NYSE Rule 446 requires NYSE members and member organizations to establish and maintain business continuity plans. Those plans must “be reasonably designed to enable [the member organization] to meet its existing obligations to customers, and address the existing relationships with other broker-dealers.” The plans must be reviewed at least annually and “updated whenever there is a material change in a firm’s operation, structure, business, or location that affects the information set forth in the BCP.”

Although the Sarbanes-Oxley Act does not mandate public companies to establish and maintain business continuity plans, many of the law’s principal objectives point to the need for effective business continuity management capabilities. Indeed, some external auditors are reviewing their clients’ business continuity processes in the new SOX era.

Benefits and stumbling blocks

Companies are not only implementing business continuity plans because they have to; some are doing so because there are business benefits. According to the BCI:

• BCM can be used by companies to differentiate their service-delivery or product-delivery resilience to potential customers;
• Thorough business impact analyses as well as ongoing business continuity monitoring can expose business inefficiencies;
• Retaining customers following a disaster is less expensive than acquiring new customers; and
• Successful crisis management experiences can boost morale among the workforce and help prevent employee turnover following a disaster.

The appearance of Category 5 hurricanes and costly Internet viruses and worms often stimulate BCM questions: Who’s in charge of our continuity planning? Where is the actual plan?

This raises an important concern; BCM commitment is difficult to sustain over time due to several obstacles that prevent companies from installing, maintaining, monitoring and upgrading business continuity capabilities, including:

Vividness bias: “Vividness bias” (Bazerman and Watkins, 2004)i prevents most individuals from thinking about troubling matters and major risks unless those issues play out, intensely and repeatedly, before their eyes.

Competing priorities: Many areas of an organization resist continuity planning processes when more immediate and visible demands — such as quarterly financial performance targets, production quotas and quality objectives — occupy them.

Lack of standards: BCM and disaster recovery are relatively new disciplines that have undergone dramatic evolutions in recent years, but established standards are only beginning to emerge, thanks to BCI and some industry organizations. For example, the Automotive Industry Action Group (AIAG) recently published a guideline titled “Crisis Management for the Automotive Supply Chain.”

A sound BCM plan defines the roles and responsibilities of all corporate functions and of senior leadership so that none of these concerns should get in an organization’s way. A BCM strategy demands broad involvement of the board of directors, senior executive team, the corporate finance and accounting function, and other corporate functions and business units. The new guideline outlines these responsibilities in detail.

There is growing sentiment that corporate finance is the place to house BCM. The location of the BCM function sends a clear message to the organization about the importance of the initiative. Preparing your finance team is the first step, and the new Management Accounting Guideline will help you do so.

More information about the guideline will be available shortly on CMA Canada’s Web site at www.cma-canada.org. 

Eric Krell is a freelance writer who specializes in corporate finance, corporate governance, HR and risk management. He appears in several U.S. business publications, including Consulting Magazine, Business Finance, HR Magazine and 1 to 1 Magazine.

i Bazerman, Max H., and Watkins, Michael D. 2004. Predictable Surprises: The Disasters You Should Have Seen Coming and How to Prevent Them. Boston: Harvard Business School Press.

Top