GRAND RAPIDS — Defense Secretary Donald Rumsfeld makes a pretty good case for planning for the unexpected. At a 2002 press conference, he unleashed the following cryptic quote: “Reports that say that something hasn’t happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns — the ones we don’t know we don’t know.”
For every business, it’s the “unknown unknowns” that keep CEOs up at night. What if an asteroid falls on the manufacturing plant? What if al Qaida attacks Grand Rapids? What if there’s an outbreak of mad cow disease? What if I die? Who’s going to take care of the company?
Planning to deal with those often unlikely eventualities has become a cottage industry for attorneys, consultants and insurers. The field is called “business continuity planning,” or BCP for short. According to those who make their living designing the plans, businesses can’t afford not to have one.
According to John Reinartz, risk management practice leader for Varnum Consulting, 85 percent of companies that don’t have an emergency recovery plan fail shortly after a catastrophic event.
But isn’t that what liability insurance is for?
“A business disaster is not necessarily a direct, physical loss to your facilities,” Reinartz said. “People really don’t think about that. Business continuity planning in the traditional thought process is: We’re going to have a disaster. We’re going to have a fire. We’re going to have a flood. (Traditionally) it’s a plan on how to manage that — to make sure the cleanup is done properly.”
But business continuity planning — also known as disaster recovery — isn’t all about freak accidents and natural disasters. What happens when a manufacturing business’s main supplier unexpectedly goes out of business? What happens when an employee steals millions of dollars from the company? What happens when the power goes out?
“Most decision-makers envision a catastrophic event when they consider the need for a disaster recovery plan,” Robert J. Alcorn, chief operating officer of an Indianapolis tech company, wrote in a 2004 article in DM Direct, a continuity-planning industry newsletter. “However, the reality is that most business ‘disasters’ are less than extreme; they are typically inconvenient interruptions that cause companies to shut down — sometimes for hours, sometimes for days and weeks. Rather than focus on recovery, it is more important to plan for ongoing resiliency — even in the face of an interruption. That’s why the term ‘business continuity planning’ may be more appropriate than ‘disaster recovery.’”
One of the weightier issues in business continuity planning is leadership succession. Many small businesses rely heavily on one individual to do various critical tasks. Many times no one else in the organization can duplicate that key figure’s skills or knowledge. So if that person disappears from the scene — through death, illness, or simply by pursuing other employment — it can be very difficult for the company to recover.
“Is the corporation properly protected with items such as key-man life insurance? Is the business capable, then, of — on that key individual’s death — receiving a significant amount of cash infusion so they can hire talent to replace that key individual?” Reinartz said.
Sometimes preventive measures are the answer. For example, when executives from Spartan Stores Inc. go on their annual “world tour,” visiting all of the company’s retail stores, they don’t save money by carpooling or chartering a bus.
“We have to caravan,” said Spartan CEO Craig Sturken. Otherwise, one accident could take out the company’s entire leadership team. “We couldn’t all be in the same vehicle, just from a corporate governance standpoint.”
Reinartz said that he is aware of several businesses that have failed as a result of losing a key leader to an accidental death. He also mentioned a business that spent millions of dollars on research, only to have the researcher die in an accident before his work was complete. That business survived, but it had to take a loss on the research project and the funds it had invested in it. These incidents illustrate the need not only for succession planning but also to get important data out of executives’ heads and onto paper. Reinartz suggested regular debriefing sessions — something he does with his own staff.
Getting through losses and business interruptions is possible — it just takes planning, money and insurance.
The process of creating a BCP looks at all of those needs. Reinartz said that his firm, like all organizations in the business of building continuity plans, starts with a thorough risk analysis. Looking at a company’s risks and its insurance coverage often turns up a chance to save money. Reinartz said most businesses pay for a great deal of coverage they don’t need, but miss some important coverage areas that could cost them dearly in the event of an emergency.
For example, when Reinartz joined Varnum Consulting, he took a close look at the insurance coverage for the company’s partner law firm Varnum, Riddering, Schmidt & Howlett. What he found was a lack of flood protection.
Anyone familiar with the firm’s Grand Rapids office might say, “So what?” Varnum Riddering is located on the top floor of one of the city’s tallest buildings. Despite its proximity to the Grand River, it would take a flood of Biblical proportions to moisten a single legal pad in the firm’s high-rise office. But, as Reinartz pointed out, it wouldn’t take that much of a flood to affect the ground floor, closing off access to the building. Although Varnum Riddering would be sitting high and dry, the firm could be shut out of its offices because of structural damage to the building. The firm’s business interruption insurance would provide no help.
“It would be massive for us to have our attorneys not be able to come into this facility,” Reinartz said. “So we would have a massive cost. We would have to duplicate the facility somewhere else. We’d have to have the partners work from home. (We’d be) using the resources of other law firms as far as law libraries.”
So, they set about adjusting the insurance coverage and making a back-up plan for how the firm would carry out business should such an event arise.
Once the business continuity plan is in place, there is one more step: testing. Reinartz said it is very important for companies to make sure their plans work before an actual disaster occurs.
One of his clients made the mistake of not testing its data back-up system. It backed up the system and stored the data off-site. However, when an actual meltdown occurred, company personnel popped in the back-up disk to restore the system only to discover they had suffered a software error. The disk was blank.
That kind of interruption could cause untold financial damage to a small business. Reinartz said that complete business continuity plans start at around $5,000. Testing is included.