It could be a natural disaster that closes cities for days at a time, or a power failure that knocks out corporate e-mail systems for a few hours. An endless variety of potential business disruptions confronts finance executives. And when crisis comes, or even if it doesn't, it's largely up to the vigilant CFO to make sure the company has a strong, workable business continuity plan.
Often, that involves hedging against problems foreseen or unforeseen - making an investment with a return nearly impossible to estimate. But the price of failure, too, can be incalculable.
"If we can't operate, we're out of business. So what's the ROI on that?" asked Bill Haacke, CFO of seven-branch, New Orleans-area Metairie Bank, which revised its continuity plan ‘on the fly’ during the 2005 summer of Katrina.
"When that storm hit everybody thought it was going to be the usual hurricane, and I'll be away from the bank for a day or two days," he says. "We had a disaster recovery plan before Katrina, but for nothing of that magnitude."
Ultimately, the weekend hurricane and subsequent flooding devastated the area, and government authorities closed the county where the bank operates for two weeks. Haacke had evacuated to the parking lot of the bank's off-site data centre, and started ‘banking’ there the next Monday. "I think our customers appreciated, from the day after the hurricane going forward, if they got through to me ... we would transfer funds to other banks," he says.
The bank now has a "comprehensive contingency plan that covers everything from pandemics to hurricanes," according to Haacke, and all bank employees know their role in the 200-page plan. Developing the plan, he adds, required the perspective of every department.
"You can't have a plan unless everybody has an input," the CFO says. "You can open a branch, but if your IT department can't get the computers working, then you're going to be operating offline with customers. That is going to involve accounting because accounting is going to say how you are balancing your work. Everything is connected."
Emphasising customer service and involving yourself with continuity planning can lead a CFO to create a better outcome in contingencies, said Brian Kinman, a partner in the governance, risk and compliance practice at professional services firm PricewaterhouseCoopers.
"If I look at all my stakeholders and customers aren't getting satisfied, then they'll find another way to be satisfied that may not include me after the crisis," he explains.
Previously, corporate continuity planning meant mostly focusing on securing technology systems and, as a result, how the company recovers as a whole was not fully understood, Kinman says.
This mentality changed as business grew more complex, with finance and operations increasingly becoming intertwined. Then, he says, companies gradually realised that a complete plan started with a dialogue between all executives to understand how the entire organisation functions.
"The point of views of the CFOs in the decisions that need to be made are incredibly important," Kinman says. "The CIO plays [a] very important role, but when you look at business continuity planning, it is how do my people, processes and systems recover?"
Hard costs to be saved
Continuity preparations also often pay dividends in the reduction of insurance rates, a savings sometimes overlooked. Defining recovery objectives allows a firm to determine if the coverage matches the overall company goals, and insurance companies offer offsets to reflect their lower exposure. "If your objectives are a matter of days, why do you have 12 months' worth of coverage?" Kinman asks. "There is a huge question that someone ought to evaluate, instead of paying the premium. There are some hard costs to be saved."
Seamus Hennessy, CFO of US-based wi-fi networking company Ruckus Wireless, understands the principle of recovery across the entire business and sees business continuity planning as part of a greater effort to always remain productive and profitable.
"If there is a fire in-building, or earthquake, or the offices are down, the key thing is how fast can we get up," he says. "Everything we do and look at it is business continuity across the world and how can we get everybody productive." Hindered employee productivity means "the company's either not developing products or not making money”, he adds.
Hennessy sees bolstering a company against unforeseen incidents as directly tied to business growth. "You can't put a price on business continuity," he says. "The key thing is you need to focus on business productivity and building a growing company. It may cost resources and dollars to do the right thing and spend the dollars and make the investments up front. It's an insurance policy that you've just got to pay."
Ruckus, which has employees in 22 countries, adopted cloud computing over the past few years to minimise the chances of one incident jeopardising the entire company's ability to function. The decision to move e-mail to the cloud paid off last year when employees were able to access e-mail after a six-hour power outage in the San Francisco area left Ruckus' Sunnyvale, California, headquarters dark.
"We want to make sure if there is a localised power outage, or localised earthquake, or local disaster here, it doesn't take down the rest of the world," says Hennessy.
Business continuity planning also means determining what parts of the company to prioritise when determining how to spend money. Hennessy followed his heart to figure where to invest.
"It’s not an easy task but you have to tackle those that give you the heartache first and you just work through them," he says. "E-mail was the first one we worked through. Keeping customers happy is number two."
CFOs to the rescue
Reviewing business operations to determine what functions are truly critical is the CFO's duty and key to developing a sound plan, says Suzie Ray, a principal at Ernst & Young and leader of the firm's business-continuity disaster recovery practice for the US.
"If you just talk to a person in a business area [and] they say, 'I'm important and I need it now,' [then] there's got to be some vetting out from a strategic view," she says. "You take all of a business' processes, and you put them in a critical path based on recovery times."
After the path is defined, CFOs can then determine "if the organisation is investing in the appropriate recovery strategies that meet the needs of the business," she adds. "There is a dollar associated with protecting that path."
At Testa Produce, the money spent on shoring up the Chicago company's key infrastructure also helps the produce and dairy distributor retain customers.
From a return-on-investment perspective, business continuity "calculations do not work” says CFO Len Moskowitz. But "in the long term, we gain the customer loyalty, and the payback is further down the road".
Testa developed a business continuity plan over a decade ago, when auditors suggested it. Eventually, customers started asking for this information. The company's plan evolved from planning for small incidents like a relatively minor power outage to greater problems, like the long-term, product-threatening loss of refrigeration. "We look at each process we do on a day-to-day basis," he says. "You go through each one and you find the alternative."
Starting small is a perfectly valid strategy, says E&Y's Ray, adding that some companies build out their plans over a period of years after first securing the firm's essential components. And in the planning stages, she says, a CFO should "provide education awareness," a role that requires the executive to take a pulse on the current capabilities of the business. Grasping how a firm runs allows executives to determine its core functions, and invest more in them.
Testa reviews its plan once a year or when the company undergoes a major change, Moskowitz says, such as adding a cooler to its facility.
Companies should always ask, "Have we thought about our plan that reflects business the way it is today?" says PwC's Kinman. This means periodically re-evaluating the plan, since new technology, staff and business objectives mean a company is always changing and exposed to new risks.
Moskowitz also sees value in having stakeholders work together on a plan. Management can sometimes focus on an operation's minutiae, causing people in operations to view management as overbearing.
"There's always a fine line between the day-to-day operational issues and this planning process," he says. "An important thing in senior management's role is, it has to be a living, breathing plan that everybody compromises enough on to feel that it is reasonable."
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.