Business Continuity Planning

Each year potential hazards threaten the business community worldwide. Earthquakes, hurricanes, floods, fires, and other disruptive events represent a continuous problem throughout the business community. Many of these threats result in significant exposure to large and small businesses. When business operations are disrupted, companies suffer both tangible and intangible losses.

Reducing business loss, an important element of business planning, is a continuous program whereby businesses prepare, respond, and recover from various business disruptions. These disruptions appear in many forms, levels of severity, and durations.

While businesses are extremely sensitive to area-wide geographic hazards such as hurricanes, research and history have clearly established that the 'lesser' local disruptions such as fire, power failure, water damage, and telephone outage occur more frequently and result in more business loss than the media saturated catastrophic event.

While businesses have taken measures over the years to mitigate major hazards, many have neglected the smaller, more exposed 'lesser' vulnerabilities which, if exploited, can result in an impact to critical business operations. These vulnerabilities include: lack of or inadequate fire protection, improper or nonexistent off-site backup of critical files and electronic media, reliance on a single piece of critical equipment, death or disability of key personnel, insufficient or non-maintained air conditioning, and electric utility support, or improper personnel security precautions.

Business impact or loss, resulting from disruption is experienced in various forms, most noticeably financial losses such as lost revenues, increased expenses, penalties, and costly repairs. However, in many instances, a business disruption leads to significant intangible losses such as reduced customer satisfaction and confidence, public embarrassment to the company, or loss of competitive edge. History has clearly demonstrated that in the 'customer service' era of the '90s, customers who are lost due to a degradation of service levels generally never return.

The solution designed to prevent and/or reduce impact to business disruptions is known as Business Continuity Planning (BCP). This is the process whereby companies apply business planning and common sense solutions towards ensuring the continued operation of their most critical activities. While few companies would operate without some form of insurance BCP is not perceived or, more often, not understood to be of major benefit towards reducing business losses or, ensuring business survival.

The BCP process does not, in the majority of cases, call solely for 'after-the-event' restoration activities. Rather, the process of BCP is threefold as each element of the process reduces the overall risk to the business and aids in the abatement of potential losses.

• Pre-disruption planning. Prior to any event, companies are able to assess their 'risk and threat environment' and mitigate various hazards and weaknesses associated with their processing environment.
• Disruption. The losses a business may suffer are a direct correlation to the specific emergency activities taken by the business as the disruption is unfolding. This step includes the prior planning and preparation of activities, which again can be performed in advance of any event, and which will aid in the methodical, rational and coordinated approach towards dealing with various hazard disruptions.
• Post-disruption recovery. A major assumption inherent to operating a business is that every 'risk' can be eliminated. While the previous two steps are designed to reduce or mitigate risk, the recovery step is designed to expedite the rebuilding and restoration process. One of the most misunderstood concepts of BCP is that this process is conceived solely for computer technology. Many businesses assert a strong dependence on central and distributed computer resources. Historically, BCP has been initiated within this arena. Prior to any event, companies are able to assess their 'risk and threat environment' and mitigate various hazards and weaknesses associated with their processing environment. The losses a business may suffer are a direct correlation to the specific emergency activities taken by the business as the disruption is unfolding. This step includes the prior planning and preparation of activities, which again can be performed in advance of any event, and which will aid in the methodical, rational and coordinated approach towards dealing with various hazard disruptions. A major assumption inherent to operating a business is that every 'risk' can be eliminated. While the previous two steps are designed to reduce or mitigate risk, the recovery step is designed to expedite the rebuilding and restoration process. One of the most misunderstood concepts of BCP is that this process is conceived solely for computer technology. Many businesses assert a strong dependence on central and distributed computer resources. Historically, BCP has been initiated within this arena.

However, the goal of BCP is not to provide continuity of computer operations alone, but rather to ensure the continuity of critical business operations-which may or may not be dependent upon computer technology. This 'business approach' ensures that all critical business functions continue with minimal impact, both computer and non-computer. Therefore, LGA strongly supports the 'business-oriented' approach, known as BCP, for planning, responding to, and recovering from business disruptions-large or small. BCP, allows for the continuous processing of critical business functions in the event of a company or area-wide disruption.

While a significant level of risk relating to business disruption events (e.g., property/casualty, business interruption, extra expense, etc.) can be transferred to insurance carriers, in many cases this is not enough to ensure the survivability, or long-term growth and profitability of a business attempting to respond and recover from a disruption. Therefore, BCP is an essential element of any business risk management program.

BCP is not a project whereby the business develops a 'plan' and moves on to the next assignment. Rather, BCP is a program by which management designs, develops, implements, and maintains a strong commitment towards business continuity at all levels of the organization. This concept applies to large, complex business entities as well as to five employee enterprises, for every business relies upon some critical functions and supporting tools to deliver its service or product. Without the use of these functions/tools, the business would likely be affected.

LGA believes that BCP should be considered as important as any other strategic planning element of the organization and that business should recognize the potential perilous business environment in which they operate, and prepare for the many disruptions that could occur.

IF YOU ANSWER 'NO' OR 'NOT SURE' TO ANY OF THESE QUESTIONS, YOUR ORGANIZATION MAY BE AT RISK DURING A MAJOR BUSINESS DISRUPTION.

• Has your organization identified and ranked the most critical business functions and/or computer applications which support these functions?
• Has your organization performed a risk and business impact analysis in the past three years?
• Does your current insurance provide adequate protection to senior management against litigation resulting from insufficient business continuity planning?
• Does your current EDP insurance include sufficient replacement costs, extra expense, business interruption, and media reconstruction protection?
• Does your organization possess a detailed BCP which addresses not only computer resources, but business units as well?
• Has your business continuity plan been tested during the past year?
• Is your business continuity plan in compliance with the Banking Circular 177 issued jointly by the FFEIC and the COC?