By Cox, Jack E.; Barber, Robert L.
Risk Management , Vol. 43, No. 3
Because growing dependency on a global economy and information technology pose businesses to a wide spectrum of disaster, it is becoming increasingly important to develop realistic contingency plans. Risk managers can make valuable contributions by providing leadership in developing innovative and practical disaster response programs.
Worrying about possible disasters can cause many sleepless nights for senior executives and board members and the creation of comprehensive contingency plans to help ease those worries. It is important, however, to maintain a delicate balance between over-planning r events that may never happen and being adequately prepared to respond if disaster does strike.
According to business consultant Kenneth N. Myers, "if economics is the `dismal science,' then contingency planning is the `abysmal science.' No one likes to look into the abyss." In fact, it is estimated by various sources that fewer than 25 percent of all businesses have a workable contingency plan. Perhaps the greatest challenge for organizations and risk managers is to avoid falling into the abyss of excessive contingency planning and to keep the recovery plan focused, cost-effective and practical. A risk manager can help his or her organization tremendously by making sure it avoids the temptation to create such a detailed response program that the plan has little chance for success.
Instead of complicated instructions, it is usually more effective to develop emergency operating guidelines that focus on critical operations and processes. It is important to avoid worrying about extensive preparations for an endless list of potential crises, but instead to concentrate on the immediate consequences of a disaster, such as the loss of key property, resources or information.
Preparing a focused and practical contingency plan requires drawing upon the expertise of managers and employees throughout the organization to identify the operations and business processes that are essential to long-term survival. These will likely include maintaining cash flow, core customer services, market share, investor equity and employee support.
Without a clear strategy linked directly to the organization's basic objectives, contingency planning can become a frustrating and expensive effort. Because disasters come in many forms with different business interruption challenges, the number of possible loss scenarios can often seem endless. Many companies feel that an immediate recovery is required. The planning effort can then become expensive and overwhelming when a less complex effort will actually suffice.
Complacency can also hinder contingency planning. The low probability of disaster often makes it easy to retain, rather than protect against, the risk. Preparing a response plan may not be considered a high priority because the chance of a disaster can seem remote. if an organization has disaster recovery plans that focus on vulnerable information systems, but don't address equally critical operations, the existing plans can provide a false sense of security.
Internal politics can also complicate recovery efforts. Differing opinions about what information is important and how to begin a business impact analysis can paralyze a company at the outset. Some departments will resist being classified as nonessential and will fight to be included in initial recovery efforts. Managers charged with the effective use of financial resources may find it difficult to quantify the return on contingency planning. The existence of inefficient procedures may also impede effective planning as organizations struggle to continue processes that may not be worth retaining in the first place.
Given these circumstances, it is not hard to see how the task can seem daunting and why planning advocates may encounter resistance. A key to creating effective contingency plans is to overcome this resistance and obtain the necessary support and resources to address these exposures properly. …