Valuing Business Continuity

Consultants can also help clients assign the probability of various incidents occurring. “In Minneapolis, the big concerns are weather and fire,” Thompson says. “You don’t have earthquakes, and you have a low risk for terrorism. In general, you have a low risk for environmental disasters.”

Experts then analyze risk factors in as much detail as possible, even looking at historical records within a metro area. “Certain corridors are noted for power outages and spikes,” Agar says.

The business impact analysis also should gauge—or at least attempt to gauge—the bottom-line impact of various scenarios. “You need to get CEOs to understand the impact to the company if it were offline, to provide a justification to spend the money needed for a backup plan,” Thompson says.

Some clients may assign a dollar value to potential occurrences based on the revenues they would lose or other measurable factors. O’Brien-Wilms points to an advertising agency that operates Web sites for its clients and backs that offering up with service-level agreements that require the agency to pay clients for every hour of downtime.

But because many risk factors cannot be measured in dollars, Technology Management’s clients often prefer to work with a scale that ranks incidents from

1 to 10 in terms of how serious each incident would be for each touch point. For example, a health care organization might be able to estimate the cost of lawsuits if lives were lost due to outages, O’Brien-Wilms says. But more likely, she says, the organization would simply rank that sort of risk as a 10.

Even the advertising agency concerned about service-level agreements opted to use rankings rather than dollar values because it determined that its greatest risk was loss of credibility. When it comes to operating client Web sites, O’Brien-Wilms explains, “If you lose credibility, you’re history.”

3pL and Fallon also shied away from assigning dollar values to potential incidents. Executives preferred to make judgments about business continuity investments based on what those investments guard against. McGeheran notes that he has had no difficulty getting approvals for critical backup infrastructure, such as redundant data links or a redundant riser closet—where communications links between different floors of a building are connected—“because this is a business based on relationships. Decision makers understood immediately the repercussions,” he says.