It could be a natural disaster that closes cities for days at a time, or a power failure that knocks out corporate e-mail systems for a few hours. An endless variety of potential business disruptions confronts finance executives. And when crisis comes, or even if it doesn’t, it’s largely up to the vigilant CFO to make sure the company has a strong, workable business continuity plan.
Often, that involves hedging against problems foreseen or unforeseen — making an investment with a return nearly impossible to estimate. But the price of failure, too, can be incalculable.
“If we can’t operate, we’re out of business. So what’s the ROI on that?” asked Bill Haacke, CFO of seven-branch, New Orleans-area Metairie Bank, which revised its continuity plan “on the fly” during the 2005 summer of Katrina.
“When that storm hit everybody thought it was going to be the usual hurricane, and I’ll be away from the bank for a day or two days,” he said. “We had a disaster recovery plan before Katrina, but for nothing of that magnitude.”
Ultimately, the weekend hurricane and subsequent flooding devastated the area, and government authorities closed the county where the bank operates for two weeks. Haacke had evacuated to the parking lot of the bank’s offsite data center, and “started banking” there the next Monday. “I think our customers appreciated, from the day after the hurricane going forward, if they got through to me … we would transfer funds to other banks,” he said.
The bank now has a “comprehensive contingency plan that covers everything from pandemics to hurricanes,” according to Haacke, and all bank employees know their role in the 200-page-long plan. Developing the plan, he adds, required the perspective of every department.
“You can’t have a plan unless everybody has an input,” the CFO said. “You can open a branch, but if your IT department can’t get the computers working, then you’re going to be operating offline with customers. That is going to involve accounting because accounting is going to say how are you balancing your work. Everything is connected.”
Emphasizing customer service and involving yourself with continuity planning can lead a CFO to create a better outcome in contingencies, said Brian Kinman, a partner in the governance, risk and compliance practice at professional services firm PricewaterhouseCoopers.
“If I look at all my stakeholders and customers aren’t getting satisfied, then they’ll find another way to be satisfied that may not include me after the crisis,” he explained.
Previously, corporate continuity planning meant mostly focusing on securing technology systems and, as a result, how the company recovers as a whole was not fully understood, Kinman said.
This mentality changed as business grew more complex, with finance and operations increasingly becoming intertwined. Then, he said, companies gradually realized that a complete plan started with a dialogue between all executives to understand how the entire organization functions.
“The point of views of the CFOs in the decisions that need to be made are incredibly important,” Kinman said. “The CIO plays [a] very important role, but when you look at business continuity planning, it is how do my people, processes and systems recover?”
Continuity preparations also often pay dividends in the reduction of insurance rates, a savings “sometimes overlooked.” Defining recovery objectives allows a firm to determine if the coverage matches the overall company goals, and insurance companies offer offsets to reflect their lower exposure. “If your objectives are a matter of days, why do you have 12 months’ worth of coverage?” Kinman asked. “There is a huge question that someone ought to evaluate, instead of paying the premium. There are some hard costs to be saved.”
Seamus Hennessy, CFO of Wi-Fi networking company Ruckus Wireless, understands the principle of recovery across the entire business and sees business continuity planning as part of a greater effort to always remain productive and profitable.
“If there is a fire in-building, or earthquake, or the offices are down, the key thing is how fast can we get up,” he said. “Everything we do and look at it is business continuity across the world and how can we get everybody productive.”
Hindered employee productivity means “the company’s either not developing products or not making money,” he added.
Hennessy sees bolstering a company against unforeseen incidents as directly tied to business growth.
“You can’t put a price on business continuity,” he said. “The key thing is you need to focus on business productivity and building a growing company. It may cost resources and dollars to do the right thing and spend the dollars and make the investments up front. It’s an insurance policy that you’ve just got to pay.”
Ruckus, which has employees in 22 countries, adopted cloud computing over the past few years to minimize the chances of one incident jeopardizing the entire company’s ability to function. The decision to move e-mail to the cloud paid off last year when employees were able to access e-mail after a six-hour power outage in the San Francisco area left Ruckus’ Sunnyvale, California, headquarters dark.
“We want to make sure if there is a localized power outage, or localized earthquake, or local disaster here, it doesn’t take down the rest of the world,” said Hennessy.
Business continuity planning also means determining what parts of the company to prioritize when determining how to spend money. Hennessy followed his heart to figure where to invest.
“Its not an easy task but you have to tackle those that give you the heartache first and you just work through them,” he said. “E-mail was the first one we worked through. Keeping customers happy is number two.”
Reviewing business operations to determine what functions are truly critical is the CFO’s duty and key to developing a sound plan, said Suzie Ray, a principal at Ernst & Young and leader of the firm’s business-continuity disaster recovery practice for America.
“If you just talk to a person in a business area [and] they say, ‘I’m important and I need it now,’ [then] there’s got to be some vetting out from a strategic view,” she said. “You take all of a business’ processes, and you put them in a critical path based on recovery times.”
After the path is defined, CFOs can then determine “if the organization is investing in the appropriate recovery strategies that meet the needs of the business,” she added. “There is a dollar associated with protecting that path.”
At Testa Produce, the money spent on shoring up the Chicago company’s key infrastructure also helps the produce and dairy distributor retain customers.
From a return-on-investment perspective, business continuity “calculations do not work,” said CFO Len Moskowitz. But “in the long term we gain the customer loyalty, and the payback is further down the road.”
Testa developed a business continuity plan over a decade ago, when auditors suggested it. Eventually, customers started asking for this information.
The company’s plan evolved from planning for small incidents — like a relatively minor power outage — to greater problems, like the long-term, product-threatening loss of refrigeration. “We look at each process we do on a day-to-day basis,” he said. “You go through each one and you find the alternative.”
Starting small is a perfectly valid strategy, said Ernst & Young’s Ray, adding that some companies build out their plans over a period of years, after first securing the firm’s essential components. And in the planning stages, she said, a CFO should “provide education awareness,” a role that requires the executive to take a pulse on the current capabilities of the business. Grasping how a firm runs allows executives to determine its core functions, and invest more in them.
Testa reviews its plan once a year or when the company undergoes a major change, Moskowitz said, such as adding a cooler to its facility.
Companies should always ask, “Have we thought about our plan that reflects business the way it is today?” said PwC’s Kinman. This means periodically re-evaluating the plan, since new technology, staff and business objectives mean a company is always changing and exposed to new risks.
Moskowitz also sees value in having key stakeholders work together on a plan. Management can sometimes focus on an operation’s minutiae, causing people in operations to view management as overbearing.
“There’s always a fine line between the day-to-day operational issues and this planning process,” he said. “An important thing in senior management’s role is, it has to be a living, breathing plan that everybody compromises enough on to feel that it is reasonable.”