1

The Value-Driver Approach to Business Continuity A Cost-Effective Variation

Tamara Nolan, Senior Associate

New York, NYMarch 18, 2009

2

Traditional BCM ApproachTraditional BCM Approach

Adopts a bottom-up, comprehensive perspective to evaluate functions and processes

Systematically examines all of the organization’s business processes and then determines criticality

“Cold” data gathering involves multiple meetings to get the answers

Often a complex “one size fits all” methodology that does not easily incorporate dynamic changes to the business environment

Scenario-based planning

Can exhaust program resources by lasting 8- to 12-months

Adopts a bottom-up, comprehensive perspective to evaluate functions and processes

Systematically examines all of the organization’s business processes and then determines criticality

“Cold” data gathering involves multiple meetings to get the answers

Often a complex “one size fits all” methodology that does not easily incorporate dynamic changes to the business environment

Scenario-based planning

Can exhaust program resources by lasting 8- to 12-months

Value Driver ApproachValue Driver Approach

Adopts a top-down, strategic perspective to evaluate sources of value and generate buy-in

Examines only those business processes that leadership sees as critical to:

Revenue/Operations Brand Reputation

Hypothesis-driven data gathering with limited demands on executive time

Customizable and flexible approach based on organization’s specific value chain

Effects-based planning

Generates savings in development costs based on 8- to 12-weeks timeline

Adopts a top-down, strategic perspective to evaluate sources of value and generate buy-in

Examines only those business processes that leadership sees as critical to:

Revenue/Operations Brand Reputation

Hypothesis-driven data gathering with limited demands on executive time

Customizable and flexible approach based on organization’s specific value chain

Effects-based planning

Generates savings in development costs based on 8- to 12-weeks timeline

A cost-effective, swift way to build business continuity management capability begins with embracing leadership’s view of critical value drivers

3

Ind

irec

t Im

pac

t

Business ConsequencesBusiness Consequences

Deteriorating operating performance

Decreased revenue due to loss of customers – Reliability issues– Lack of visibility – Slow recovery – Brand/Reputation

damage– Lack of contingency

planning Increased costs (e.g. over-

time payments to reduce backlog or penalty payments to customers)

Legal exposure Declining confidence of

citizens and public officials Adverse employee relations

Deteriorating operating performance

Decreased revenue due to loss of customers – Reliability issues– Lack of visibility – Slow recovery – Brand/Reputation

damage– Lack of contingency

planning Increased costs (e.g. over-

time payments to reduce backlog or penalty payments to customers)

Legal exposure Declining confidence of

citizens and public officials Adverse employee relations

Financial Crisis

TerroristAttacks

Natural Disasters

Pandemic

Recent experience demonstrates that complex risks and massive impacts have heightened the need for resilient businesses

Dir

ect

Imp

act

Large Employee Absence

Equipment Damage

Network Intrusion

Change in Customer Demand

Public Infrastructure

Disruption

AdverseMedia

Exposure

Tightened Credit Markets

Inability to Pay

SuppliersIntellectual

Property Theft

Facility Disruption

Distribution channels

4

With the adverse effects that poor planning can have, robust BCM capabilities make sound business sense

Poor planning can lead to a wide range of problems, from human casualties deemed the result of management negligence to loss of market share due to unsafe products

Strong planning, on the other hand, is a vital standard of strong corporate governance because it has

– Major immediate impact on shareholder value

– Long term impact on reputation/brand and therefore market share

The Impact on Shareholder Value

Cu

mu

lat i

ve A

bn

orm

al R

etu

rns

(%

)

Source: “The Impact of Catastrophes on Shareholder Value,” Rory F. Knight & Deborah J. Pretty, Templeton College, University of Oxford, p. 3.

Trading Days After the Event25 50 75 100 125 150 175 200 225 250

Effective Crisis Response

Ineffective Crisis Responses

After initial reflex (10 days),market begins to assesscompany’s response.

The Impact on Shareholder Value

Cu

mu

lat i

ve A

bn

orm

al R

etu

rns

(%

)

Source: “The Impact of Catastrophes on Shareholder Value,” Rory F. Knight & Deborah J. Pretty, Templeton College, University of Oxford, p. 3.

Trading Days After the Event25 50 75 100 125 150 175 200 225 250

Effective Crisis Response

Ineffective Crisis Responses

Effective Crisis Response

Ineffective Crisis Responses

After initial reflex (10 days),market begins to assesscompany’s response.

After initial reflex (10 days),market begins to assesscompany’s response.

5

However, BCM managers continue to have challenges building the business case for needed plans and capabilities …

Although BCM is a cornerstone of well-structured risk management programs, many companies struggle to initiate, develop, and maintain needed capability

Typically, this is not because of a lack of interest but a lack of resources, training, and buy-in from senior leadership

In today’s cost-constrained business environment, BCM leaders must take a take an actionable approach to protecting value drivers

The customary bottom-up BIA requires an intensive and time-consuming effort to identify the functions and processes that are truly critical

… as cost pressures and the need to demonstrate immediate results demand a new way of thinking about BCM Planning

6

Conduct tabletop exercise to validate plan content

Validate interdependencies

Keep it all aligned with the changing business

Document the BCM plans

Outline proactive initiatives the business can take to improve its resilience and to mitigate identified risks

Identify critical products, services, functions and work locations

Identify key dependencies and resources

Identify key risks

Set recovery objectives

Develop strategies to address risks for critical business functions & managed resources

Identify initiatives / actions to effect strategies

Validate strategies through a workshop

Business Analysis

BCM Strategy Development

BCM Plan Development

BCM Plan Exercise

BCM Program Maintenance

Keep it all aligned with the changing business

Conduct annual plan reviews / updates

Our value driver approach to BCM guides BCM capability development from initiation through exercise and maintenance

Develop options to de-risk the business through changes in three dimensions—process, operating model, or geographic dispersion

Identify a set of mitigation strategies

7

Illustrative High-Level Value Chain

The value chain allows us to get to the answer quicker by:

Identifying and prioritizing value drivers Identifying and mapping critical interdependencies Identifying and prioritizing vulnerabilities and gaps

Shared Services (Legal, IT)Shared Services (Legal, IT)

CommercialAdministration/

Traffic Operations

SalesProduction

ProductionDesign Distribution

Engineering (Logistics and Support)Operations (Logistics and Support)

Our approach employs proprietary techniques to help BCM leaders quickly gain traction and sustainable momentum by …

… focusing resources on protecting the organization’s value drivers

Business Analysis

8

The approach then examines each value driver based on the impact of a risk, not the cause

There are infinite disruption scenarios, but effective planning requires looking

at potential operational impacts

Impacts

Effects

Loss of Power

Injury or death

Unable toaccess building

Loss of keysupplies

NaturalDisasters

FinancialCrisis

Pandemic

Causes

Loss of Primary Facility

Loss of IT Operations

Reduction of Available Workforce

Loss of Key Business Partner

UtilityOutage

Source: BCG Analysis

BCM Strategy Development

9

The insights gained from the Value Driver Approach are then incorporated into strategies and aggregated into BCM plans

INTERNAL USE ONLYSTRICTLY CONFIDENTIAL

INTERNAL USE ONLYSTRICTLY CONFIDENTIAL

INTERNAL USE ONLYCONFIDENTIAL

Business Continuity Management

Analysis and BCM StrategiesAnalysis and BCM Strategies

Critical services and functions

Dependencies and resources

Key risks

Recovery objectives

Strategies to address risk

Initiatives/actions to effect strategies

Options to de- risk business

Strategies that drive change

Critical services and functions

Dependencies and resources

Key risks

Recovery objectives

Strategies to address risk

Mitigation initiatives

Options to de-risk business- Strategies that drive change

BCM Plan Development

10

The tabletop exercise is a key next step to validate plan content

In today’s cost-constrained environment, a tabletop exercise is also a low-cost way to energize the BCM program, identify areas of focus, and drive leadership awareness

The tabletop exercise is a discussion-based exercise based on a simulation of actual disruptions

Because plans are often developed in silos, tabletop exercises allow you to examine or validate interdependencies

They allow for the free exchange of ideas and provide participants an opportunity to identify conflicts or areas of confusion within plans, and examine plans and procedures in a simulated, low-stress environment

They also help to reinforce corporate memory

BCM Plan Exercise

11

The final step is developing a program maintenance strategy to ensure that the BCM capability remains current in a dynamic operating environment

Provides a roadmap for maintaining a viable BCM capability

Outlines exercising, maintaining, enhancing, and managing BCM capability

Identifies and documents BCM Program objectives, resource requirements, specific actions, and timelines

BS 25999-1:2006 & BS 25999-2:2007

BCM Program Maintenance

12

In summary, the Value Driver Approach offers reduced project costs, increased development speed, and demonstrated results

By quickly identifying the vulnerabilities associated with the value drivers and outlining disruption strategies to minimize losses, BCM leaders can focus on protecting the business

The value-driver approach includes the following key features:

– Maintaining a focus on key functions and processes that drive value

– Engaging senior leadership upfront to promote the BCM program

– Establishing a greater degree of buy-in at functional levels of the organization

– Promoting program efficiency throughout the BCM life cycle

– Generating tangible savings in overall development and maintenance costs

However, the value driver approach’s true value proposition is the ability to leverage leadership’s experience and insight to quickly identify the important business resilience issues along with potential solutions