Can Your Business Survive the Unexpected
Business continuity plans can help an enterprise stay afloat through any adversity--and bounce back more quickly after setbacks. Hurricane George ... an ice storm ... a strike ... a bomb ... Web site failure ... a network problem ... communication cables catch fire and disable your data center for days. An unsuspecting company could experience any of these. Many already have. As a result, "business continuity planning" (BCP)--a high-profile, mission-critical task that attracts the attention of the CEO, the CFO, and the board of directors--has supplanted what used to be called "disaster recovery planning" and fell under the umbrella of building security or human resources. BCP is, at heart, a form of risk management. CPAs have the skills to take it on and might do well to get involved with BCP projects within their companies or for their clients. CPAs and other financial executives involved in BCP from all parts of the country were interviewed for this article. "After the Oklahoma City bombing, 40 square blocks were barricaded off for weeks," says Mary Carrido, president of Irvine, California-based continuity planning consultant MLC & Associates and national chairwoman of the 1,800 member Association of Contingency Planners (ACP; www.acp-international.com). "This devastated 4,000 businesses; 210 are not in existence anymore." Insurance industry statistics show the number of man-made and natural disasters has increased. With the news media flashing disaster reports, regulators demanding that companies take preventive measures against the millennium bug and the reliability questions introduced by electric utility deregulation, more executives are realizing, "This could happen to me. And it could hurt." Gauging the damage that disasters or other disruptions may cause to plant and equipment is only one aspect of preparedness. Other costly problems could follow: Relocation, repairs, regenerating lost data and replacing lost business income all take time, money and other resources. Intangible assets may be impaired as well. A business interruption can cause a company to lose market share, image and credibility; reduce customer satisfaction or brand value; damage research data; or strain relationships with suppliers or alliance partners. One-time events may also divert management and employees from normal core business pursuits, altering routines in ways that reduce efficiency or allow less dramatic problems to fester. "Professional service companies are starting to appreciate and protect the intellectual capital of a business," explains Pat McAnally, director of marketing at SunGard Planning Solutions in Wayne, Pennsylvania. The year 2000 computer issue--a specialized kind of foreseeable disaster--has caused managers to think more about risk mitigation. Y2K issues have raised contingency planning awareness by government agencies such as the SEC, too. Corporate responsibilities to stockholders, employees, customers and the communities the company operates in have been on managers' minds. The ever-present threat of expensive shareholder lawsuits has added weight to management concerns. A company without a continuity plan, or with an ineffective one, may not be meeting its statutory obligations; corporate managers or directors may be legally responsible for overseeing BCP. For example, the Foreign Corrupt Practices Act of 1977, while primarily directed at preventing bribery, also requires that company assets, including business records, be maintained and protected. "Lifeline" providers, such as hospitals, utilities, financial service firms, public works and airports, operate under regulatory mandates requiring BCP, as auditors know. Bankers are familiar with rules at the Federal Financial Institutions Examination Council and the Federal Deposit Insurance Corp. "Contingency plans are also a regular part of requirements by the office of the comptroller of the currency," says SunGard's McAnally. …