|
by Andrew Hiles,
FBCI
Business impact analysis (BIA) is the identification
of the effect on the organization of the risks to it, should they occur.
How much could a disaster cost you? If you know that, you can justify
spend on Business Continuity and risk reduction.
We can use the BIA process to achieve a number
of objectives at the same time:
- Identifying the financial and non-financial
costs
- Establishing the time window in which recovery
has to take place
- Identifying the Recovery Point Objective (the time to which transactions or data has to be recovered)
- Identifying the organization’s Risk Appetite
- Identifying vital materials and records necessary
for recovery or continuance
- Making a preliminary assessment of resources
required for recovery
or continuance
- Providing input to the Risk Assessment on business
risks that may not otherwise be identified
- To raise awareness of Business Continuity and
to begin to focus individuals
on their potential responsibilities, possible solutions and costs.
Grounds
for Justification of Protection Spending
The BIA examines risks and assesses the impact of
their occurrence. The creation of a Business Continuity Plan can typically
be justified on one or more of the grounds of:
- Life and Safety
- Political / Marketing
- Financial
- Compliance / Legal Requirement
- Quality
The lines between these are far from clear cut
(for instance marketing impact could involve loss of market share and
hence loss of profit - a financial impact). Wherever possible the impact
should be quantified in financial terms and care should be taken to avoid
double counting.
How
much is your annual advertising budget? What increased market share does
it buy you? Typically an organization may spend three or more times its
normal annual marketing budget in the aftermath of a disaster to retain
customer confidence and to retain and regain market share.
The
traditional Business Impact Analysis too frequently fails to quantify
longer term costs (e.g. lifetime value of customers; cost to regain market
share and image).
|
Brand value needs to be protected. Figure 1 shows the world s top
ten brands and their value brand from a recent survey by Interbrand
in association with Citibank. A recent report claimed that 80% of
most companies value was not reflected in their balance sheet. Figure
1: The World's Top Ten Brands
|
No |
Brand |
Country |
Industry |
Brand Value $m |
|
| 1 |
Coca Cola |
US |
Beverages |
83,845 |
| 2 |
Microsoft |
US |
Software |
56,654 |
| 3 |
IBM |
US |
Computers |
43,781 |
| 4 |
GE |
US |
Diversified |
39,602 |
| 5 |
Ford |
US |
Automobiles |
33,197 |
| 6 |
Disney |
US |
Entertainment |
32,275 |
| 7 |
Intel |
US |
Computers |
30,021 |
| 8 |
McDonald's |
US |
Food |
28,231 |
| 9 |
AT&T |
US |
Telecomm |
24,161 |
| 10 |
Marlboro |
US |
Tobacco |
21,046 |
 |
|
|
|
|
Another and perhaps even more significant financial
impact can be the effect of a disaster on share values. Rory F Knight
and Deborah J. Pretty recently produced a research report, sponsored by
Sedgwick Group, The Impact of Catastrophes on Shareholder Value. The report
examined fifteen catastrophes that had happened
to publicly quoted companies since 1980, with total financial losses of
around
$19 billion.
Typically the share price of a corporation
suffering a disaster falls by around 5% to 8% within the first few days
after a disaster. Recovery of the share price then depends on how well
the recovery is effected. The "winners" regain the confidence of the financial
analysts by demonstrating leadership and management ability by rapidly
taking control and re-establishing their operational capability. Their
share price not only recovers the initial loss, but may increase within
around 100 days by between ten and fifteen per cent compared to the pre-disaster
share price. The "losers" drift at the lower share price, possibly rallying
a little around 75 days following the disaster before settling at a price
around 15% below the pre-disaster share price.
The cost of disaster, and the causes
of cost, are summarized in Figure 2 below. Figure
2: Cost of Disaster - Causes of Loss
- Brand image recovery
- Loss of share value
- Loss of interest on overnight balances; cost
of interest on lost cash flow
- Delays in customer accounting, accounts receivable
and billing/invoicing
- Loss of control over debtors
- Loss of credit control and increased bad debt.
- Delayed achievement of benefits of profits from
new projects or products
- Loss of revenue for service contracts from failure
to provide service or
meet service levels
- Lost ability to respond to contract opportunities
- Penalties from failure to produce annual accounts
or produce timely
tax payments
- Where company share value underpins loan facilities,
share prices could
drop and loans be called in or be re-rated at higher interest levels.
- Cost of replacement of buildings and plant
- Cost of replacing equipment
- Cost of replacing software
- Salaries paid to staff unable to undertake billable
work
- Salaries paid to staff to recover work backlog
and maintain deadlines
- Cost of re-creation and recovery of lost data
- Loss of cash flow
- Interest value on deferred billings
- Penalty clauses invoked for late delivery and
failure to meet Service Levels
- Loss of customers (lifetime value of each) and
market share
- Loss of profits
- Additional cost of credit through reduced credit
rating
- Recruitment costs for new staff on staff turnover
- Training / retraining costs for staff
- Fines and penalties for non-compliance
- Liability claims
- Additional cost of advertising, PR and marketing
to reassure customers
and prospects to retain market share
- Additional cost of working; administrative costs;
travel and subsistence etc.
Some of these costs may be insured but experience
shows that only around 40% of actual loss is covered by insurance.
Time
Window for Recovery
An effective BIA will assess the impact of disaster
over time. Typically, there is a breathing space before the impact begins
to bite. The length of time depends in part on the process and in part
on the industry. In real time financial operations, the time window may
be minutes. For other organizations, it may be days or even weeks. After
all, many organizations close down for weekends and public holidays. The
impact analysis has to identify what this time window is by which recovery
has to be in place.
This
time window is commonly known as the Maximum Acceptable Outage (MAO).
Resource
Requirements
Most people underestimate resource requirements
for recovery. It is usually assumed that less capacity is required following
a disaster than for normal production operations. In reality, greater
capacity may be required in terms of operational equipment, computing
capacity and telephony.
Summary
A BIA is invaluable for identifying what is at
stake following a disaster and for justifying spending on protection and
recovery capability. Nobody but you will mind your own business.
Andrew Hiles, FBCI, is a director of Kingswell International, a global risk management consultancy,
and author of several books and software tools on business continuity
and service level agreements (available at www.DisasterRecoveryBooks.com
or www.ServiceLevelBooks.com), including:
- The Complete Guide to IT Service Level Agreements:
Matching Service
Quality to Business Needs
- Business Continuity: Best Practices
- Enterprise Risk management - Best Practices
- Creating A Customer-Focused Help Desk: How to
Win and
Keep Your Customers
- Service Level Agreements: Winning a Competitive
Edge for
Support & Supply Services
- The Definitive Handbook of Business Continuity
Managemen
Copyright (c)1997-2006, Rothstein Associates Inc. All
Rights Reserved.
|
