Dhiraj Lal: Expect the unexpected

GUEST COLUMN

Do you remember the time you were late for an appointment because had a flat tyre? When your fuel tank went dry in the blazing sun? When you ran out of cooking gas at home just before the big dinner? When you were locked out of home and the spare key wasn't where it was supposed to be?

And do you recall your feelings? Despair? Frustration? Anger? Could you have kicked yourself for allowing it to happen? You knew it could happen, but you had the mistaken notion that it wouldn't.

Now consider a business situation. Imagine the unthinkable "" your organisation is struck by disaster. Sure, it's never happened, and it won't happen to you. I've heard that before. But humour me for a moment.

Have you considered what might happen if you had a fire in your warehouse, your data centre or your factory? You're covered by insurance, of course (whenever that claim gets settled!). But is that all you need?

Let's ignore the damaged assets that will take you months to procure. Let's ignore the shock and trauma of your employees, even any loss of life. Ignore the loss of data and raw materials that you can't even begin to quantify.

What about the huge effort and waste of time that would go into this totally avoidable exercise? What about the embarrassment of telling your customers that you can only supply 30 per cent of the order you promised them next week? Will you ever regain their trust and confidence again, or will they always treat you as an unreliable, back-up supplier?

Will you ever regain the lost market share and shelf space from the retail trade? Will your best employees really be back when you are ready to re-start operations, or will they lose faith in you and move on?

Will your investors want to back a management that is incapable of prudently managing key business risks? Will your bankers lose their nerve and freeze your limits?

And if your customers do desert you, maybe that's not unreasonable. Put yourself in your customer's shoes. Would you bank with a bank whose ATMs are frequently out of cash? Where customer service can't solve your query because computers are down?

Would you buy a flat on the 10th floor of a building unless you had 24-hour power for the elevator and a well-lit fire escape? Would you stick with your company if it was habitually unable to pay your salary on time? Would you deal with a telecom provider who was unable to provide you reliable connections?

Well, maybe in the past, but not in today's environment of multiple options. In fact, that's what happened in the aftermath of September 11. There were over 930 companies in the two World Trade Centre towers when they were destroyed. A survey 18 months later showed that over 550 of those companies had failed.

Typically, these were companies that did not have well-rehearsed and comprehensive business continuity plans (BCPs) in place. They were unable to resume critical operations in a reasonable period of time, never regained the confidence of their stakeholders and went bankrupt. In fact, according to an Accenture study, 70 per cent of businesses experiencing a disaster eventually go out of business.

The reality is that the world is today a more risky place than it was even a year ago. The biggest threats to most organisations today are from fire, theft, fraud (both from employees and from outsiders), vandalism, Internet viruses, telecom and power outages, data loss and hardware failure.

Organisations are vulnerable to demonstrations by consumer groups (remember Cargill?) or simply to product quality issues (such as the contaminated water issue faced by Coke). And all premises and employees are at risk (though the probability is low), from falling aircraft, chemical/nuclear pollution and disease (such as AIDS or SARS).

If the incident is large enough, it can completely disrupt business operations for a long period of time, often resulting in bankruptcy.

Also, disasters can strike any organisation, large or small. A single-product business with six employees needs to evaluate its BCP needs in the same way as a diversified group with thousands of employees. The solutions vary greatly, but the process is identical.

The only difference is that if you're a large corporate, the stakes are higher, you have much more to lose. On the flip side, if you're a small company, you probably have limited resources, and even a small disaster could wipe you out.

Whether the business recovers or not and whether it is still operating 12 months later depends on how comprehensive and well-tested your BCPs are.

The logical steps to go through to implement a BCP Plan are:

Analyse all potential risks "" what could go wrong?

Conduct a business impact analysis to identify mission-critical activities.

Design a recovery strategy to minimise the impact of a disaster.

Develop a plan to implement the agreed action steps.

Ensure people who have to implement the plan are trained.

Ensure regular testing and exercising of the plan "" minimum once a quarter.

Maintain and update the plan for any significant changes.

It's not rocket science, but it's critical. Whether you are a large corporation, a small and medium enterprise, a public sector unit, a mom-and-pop shop or a small trader, you need a BCP.

In fact, even if you are an individual (or a family), you still need a BCP plan. What would your family do if you died without leaving a will? Without explaining the status of your finances, or the status of your business dealings? Who owes you what money? Without this information, your family could well soon go bankrupt.

Also, while some industries probably need BCP more than others (for instance, telecom, technology, banks and consumer lending, insurance, utilities, transportation and logistics, manufacturing and hospitals), just about all industries need it.

Wouldn't you want your child's school, or the company that runs his school bus, to have a BCP? In fact, even the Smithsonian Museum in Washington DC has a BCP that is continuously tested and refined. And the City of London has a plan, called London Resilience!

So if you care for the future of your business and your family, don't delay. Create a BCP, and keep updating it at regular intervals.

(Dhiraj Lal works as head of business continuity and global process integrity at the BPO operation of a large American financial services company. The views expressed here are personal. He can be contacted at dhiraj@dhiraj-lal.com)