The Business of Staying in Business

Lisa Benini is one of the few people in Canada who secretly hopes for a small-scale disaster or two. Benini, senior advisor, Business Continuity Management Program for the BC Ministry of Finance’s Risk Management Branch and Government Security Office, is an expert on how organizations can recover from crises and severe events. Her experience has demonstrated that most firms take business continuity planning seriously only after a serious wake-up call.

“Successful organizations that have really good plans are usually the ones who have already been through a disaster,” Benini notes. “Then business continuity has senior management’s attention and gets the budget to do it properly. We always pray for these little disasters to happen.”

In Canada, these “little” disasters have come in the form of recent flooding in Alberta and Ontario, the SARS crisis in Toronto and the power blackout in northeastern Canada and the United States in August 2003. While none triggered the wholesale loss of infrastructure or lives equivalent to Hurricane Katrina or 9/11, several observers say these events have sharpened awareness of business continuity planning (BCP) in the risk management community and insurance industry.

“BCP is becoming very prevalent in terms of the level of focus in the insurance industry,” according to Ken Lloyd, senior project manager, Crawford Adjusters Canada, who has spearheaded a major company-wide disaster recovery and business continuity plan for the last two years. “The state of preparedness across the industry has been raised.”

Mike Wallace, Royal & SunAlliance Canada’s vice-president of risk underwriting and reinsurance, says BCP is “very much on the minds” of business partners such as brokers and vendors. “They want us to have a strong business continuity plan from the perspective of being able to service their clients,” he says.

“I think it is becoming more mainstream,” Peter Neumann, Aon Reed Stenhouse Inc.’s senior vice president and national risk control director, agrees. “One of the things we are clearly finding when we respond to requests for quotations for business is a line item that says: ‘Tell us a bit about your BCP.'”

PROVING AND TESTING

Last fall, KPMG conducted a poll among 254 senior executives involved in Canadian business or IT management and discovered that 83% of respondents had a business continuity plan in place. The results led KPMG to conclude in a report called Building a Continuity Culture that “the awareness of the need for effective business continuity planning is well entrenched in Canadian companies.”

One of the authors of the report, Graeme Booth, a partner with KPMG LLP, says BCP has evolved in recent years. “It is only in the last couple of years that we have started to see the direct connection with the strategic imperatives of the organization coming right to the surface in BCP,” he says. “If you flip back even 10 years ago, it really started with disaster recovery planning, and that was focused almost exclusively on the IT environment.”

It is easy to say you have a business continuity plan, but more difficult to demonstrate it is proven and tested. Business continuity experts say that an effective plan should include a comprehensive business impact analysis (BIA) and ongoing testing by means of risk assessment. Another survey released in June by Hewlett Packard (HP) showed that only 26% of companies regularly review and test their plans. HP polled more than 340 chief information officers and IT managers of major companies worldwide.

Questions linger as to how well Canadian corporations and organizations of all sizes could handle a major disaster on the scale of a Hurricane Katrina or Northridge earthquake – not to mention an avian flu pandemic or coordinated terrorist attack.

“Corporate awareness is growing, but there is a difference between awareness and actually being ready for a major disaster,” notes Glen Frederick, director of client services for the B.C. government.

“From my own experience, people don’t even want to think about The Big One,” says Benini, whose work with the B.C. government includes using a business continuity ‘scorecard’ that rates various ministries on their level of preparedness. “I usually try to get them to talk about a catastrophe within their building or region, where there is some level of infrastructure in place. That was the shock with Hurricane Katrina; there was virtually no infrastructure left in key areas.”

Benini says most companies expect to have employees and systems in place, but Katrina showed how a large-scale disaster might have devastating effects on communications. Telephone lines, cell phone and Internet connections were not working for several days (or weeks), and buildings were inaccessible due to the flooding. Many companies had no way of contacting their employees and vice versa.

Organizations that had a business continuity plan fared far better than the others – especially if their plans had such features as mass notification systems, “mirror” or redundant Web sites, fully outsourced data recovery and/or call centre services, clear lines of managerial accountability, call-tree lists and employee safety procedures.

Canada’s property and casualty insurance industry has to work from two sides of the coin on the increasingly topical issue of BCP. First, it has to ensure that its own operations, particularly adjusting and claims services, can still function in the wake of any type of disaster. Second, it must be aware of the business continuity plans of its corporate clients from an underwriting and risk perspective, especially for business interruption claims.

“It is obviously to the benefit of the insurance companies to take a hold of this area,” Neumann says. “If the business continuity planning is properly done and the risks are mitigated, then obviously the losses are reduced, which benefits them on the bottom line.”

NEED FOR COMMUNICATION

Regarding the first side of the coin, there is strong evidence the insurance industry is taking business continuity planning seriously. Royal & SunAlliance has a business continuity team in place that uses the good practice guidelines of the Business Continuity Institute and Disaster Recovery Institute International. These organizations provide courses, certification and a base of common knowledge.

Wallace says his company has experienced both domestic and international disasters, which have served as test cases for the strength of the BC plan. “You have to be prepared to be dynamic: every single type of disaster, whether natural, man-made or hybrid, is going to stretch the organization differently,” he says. “Every time we have a disaster, we learn something.”

Wallace cites the example of the SARS crisis in Toronto as particularly instructive of how “disasters” can be unique. “The biggest lesson we learned through SARS was the need to have clear, concise communication both internally and externally,” Wallace notes. “Even though the government said the voluntary quarantine had been lifted, that was when the second phase of cases came in. It is important to make sure we are diligent looking at it not just from what the government is telling us, but what our own sources are saying.”

Neumann says the threat of a pandemic is an unusual twist to any business continuity plan. “It is interesting, in that it is completely opposite to the flood or fire or earthquake [scenario], which is: ‘Get the troops together and make it happen,'” he says. “One of the key components of the pandemic is social distancing and keeping people apart. The question then is: how do we get people to work and communicate from their homes?”

For business continuity plans in general, the idea of a 200-page document sitting on the shelf may be of comfort to a company, but it is not necessarily effective when disaster strikes, according to Neumann. “People tend to overdo them in many ways,” he says. “Before you know it, you have a binder three in
ches thick. When things don’t go right, it is not the time to pull out a binder and try to figure it out.”

Benini adds that in her view, many “organizations, including government, see (BCP) as just filling in a template, putting it on the shelf and it is done.

“We continue to tell people it is not just about the plan. It is testing it, keeping it up to date and really making it part of doing business.”

Neumann remembers the power failure of August 2003 and some of the lessons he drew from that event. “A number of things came out, such as the loss of cell phones and the closures of gas stations because there was no power,” he says. “Key persons who had to be on the forefront to solve some of these problems couldn’t get to the office. Those are the kinds of things where you need the experience of the event to kind of figure that out.”

An additional factor is the need for a company to gauge the reliability of major telecommunication and power providers when it comes to service outages. “We rely on a power grid for so many years that when it goes down, we wait for it to go up in one or two hours,” Neumann says. “At some point in a crisis or event, you have to pull the trigger and say: ‘As of now, here is where the BCP kicks in.'”

For Lloyd, Crawford Adjusters Canada’s business continuity project provided some eye-openers about the extent of the risk. “I think the business impact analysis resulted in a greater understanding of the complexities of our business,” he says. “You can’t just paint everything with one brush in terms of the requirements. Within any corporation, you have different functions – from the financial side to the operations side to the human resources side. They all have different systems and processes that require a different sense of urgency. Some business processes have to be back in service within four hours, others within 24 hours, and others are not as urgent.”

For example, a company’s claims call centre is clearly mission critical. Special arrangements, including a contact with an outsourced office site and facility provider, have been made to ensure that it can be up within two hours in any kind of disaster.

OFFERING RESOURCES

When it comes to risk management and insurance in Canada – the flip side of the coin – Neumann says insurance companies are paying attention to business continuity in at least a general sense. This applies especially to the larger risk management accounts.

“Companies assess their risks based on the hard and soft conditions that exist within the company and the property/assets they insure,” he says. “When they send around inspectors to do physical asset inspection, if they see line items such as ‘This specific risk also has a business continuity plan, which picks up a supply chain management,’ you see a positive response. It will be part of the overall assessment of the risk.”

Brokers, particularly larger firms like Aon, are offering advisory and consulting services on BCP. But some risk managers say more should be done. Frederick argues that business continuity planning could be a readily available source of expertise from insurers and brokers.

“I think brokers especially and insurers could be stronger in providing resources for business continuity planning,” he says. “I think they are missing the boat. I never hear of the larger or smaller brokers offering business continuity expertise. When we go looking for a market, it would be nice if our market could provide this service or at least point to areas of expertise.”

This phenomenon may be particularly acute in the mid-to-small market, where companies don’t have the resources for a business continuity department. In fact, many say the larger “risk management” insurance accounts tend to have advanced business continuity plans (and staffing), while the move to the mid-small market has been sluggish.

“If you are a major bank or telecommunications company, you are going to know more than an insurance company or broker about business continuity planning in your field,” Mark Baker, a former business continuity supervisor for State Farm Insurance Company, says. “But if you don’t know anything about business continuity, it is possible that a broker or insurer could offer that expertise to a mid-size or small company. There is a big gap for smaller to mid-size firms.”

A recent survey by The Conference Board found that larger companies are more likely than small companies to have a plan to deal with a possible avian influenza epidemic. Companies with sales of US$5-10 billion were the most likely to either have a plan or be developing one, whereas 35% of the companies with sales of less than US$100 million had no pandemic emergency plans at all.

“Most organizations don’t give resources to do the BCP work, so you find people who are doing this off the corner of their desk,” Benini says. “You get a piecemeal plan happening. Often people don’t set aside the resources, commit the time and get commitment from senior management. That has always been a problem.”

BCP IN THE FUTURE

Given the increasing importance of business continuity planning, regulators are already moving into the field. Lloyd says that as part of a U.S.-based company, Crawford Adjusters Canada was influenced by the Sarbanes-Oxley Act and its requirements for data retention and due diligence. In Canada, the Investment Dealers Association has a bylaw in place that requires all members to have a documented BCP implemented and tested by the end of July 2006. Benini points out that the Canadian Standards Association is also working on standards for emergency management and business continuity, expected to be published in February 2007.

Frederick suggests it could very well be shareholders of public companies who push even harder for effective business continuity plans. “Your investment is at risk if the corporation you invested in doesn’t have a plan that works,” he says.

Neumann thinks the full entrenchment of business continuity planning will likely take place in the next 10-15 years, becoming as much a part of corporate best practices as financial, environmental and safety audits. “This whole thing about BCP is really a cultural element that has to be ingrained into the minds of the corporation,” he concludes. “As we move forward, this is just another management requirement that will be instilled in the way we run companies.”