Case Study: Business Continuity Planning

If you employ an outside consulting firm, costs can range from tens of thousands to several hundred thousand dollars, de-pending on the size of your organization. Either way, make sure a process is created so that a loss of a physical plant, data, or personnel doesn't cause an outage. It's a straightforward process of understanding the impact of an outage, considering the tol-erable level for that impact, and then determining what can be done to recover operations under that limit. Consider implement-ing the following strategies.

OUTCOME: We learned that the risk profile for the new application had a lower potential severity (in injuries and dollars) and was less likely to occur. Product liability risks for our client (the material supplier) were much lower because of the client's position on the value chain. The risk profile for the new application was on a par with the client's existing book of business.

The client agreed to supply the material subject to contract terms and conditions that assigned liability fairly and required each party to defend, indemnify, and hold them harmless in the event of a claim or lawsuit. The decision to supply this material has opened the doors to other, similar opportunities. Most importantly, it has allowed them to meet and/or exceed growth goals while considering (and pricing) the relative degree of product liability risk within the product's pricing structure.

1. Perform stability testing. How long will the business last at status quo if various interruptions occur? What steps need to be taken to insure business continuity? All possible scenarios need to be tested. For example, what happens if a fire causes sprinklers to go off in the entire building? Water damage means your labs are no longer certified. Do you have alternative work space in a certified lab? If you can recover lab space, what about lab notebooks if your computers are not working? Or, what happens if a key supplier of reagents or equipment has a crisis and cannot make deliveries? What are your alternatives? We lay out the business process first. We would then cover up one of the processes. For example, if you were to experience an outage during production of a master sample, what alternatives would be available? These alternatives provide the strategies for plans to be built.

2. Evaluate and select alternatives. The strategies are evaluated and business leaders should select the alternatives that meet the business' needs and its ability to implement. Plans should then be created around these initiatives, and technology for implementation put into place.

3. Focus on the impact, not the cause. This approach to planning enables you to look at the impact of an outage and not be overly concerned with the causes. There are many causes, and writing a plan focused on just a few specific causes may not provide enough flexibility to respond to an actual emergency. Generally speaking, all plans will contain some common items. Start with making sure the contact information for key people is up-to-date, and build in a process to audit that information.

Next, brainstorm every possible point of disruption in your business. To do so, first focus on the critical processes, and then determine what actions are needed to implement the strategy that management approves. Often these include manual procedures that can be followed if an IT disruption occurs, alternative work sites or locations that can complete the process steps, and outsourced labo-ratories that could continue the development process. This planning approach enables you to respond to the impacts of an outage (which you can manage) rather than the cause(s) of the outage (which you often can't control).

4. Do tabletop exercises around crisis. This can often be accomplished over a lunch meeting with the team members that have a role in the recovery process. Build a scenario (this could be a fire, a flood - caused by rain or a burst pipe, a weather event such as a hurricane, or a natural event such as an earthquake). Don't forget events such as accidents or targeted acts of terror against your company (perhaps by someone opposed to animal testing). These scenarios should be varied and complete enough to use during an actual event. We recommend this be done at least annually once you have an established plan, and more frequently if you are still building your plans.

Continuity plans are not considered complete until you can demonstrate they will work. Make sure your plans have backups and al-ternates designated for key roles and responsibilities. Workplaces that change as new staff are brought onboard requires that you keep the teams updated, trained, and ready to respond.

5. Maintain your plan and update it annually. You can either devote two full days yearly to updating it, or do so in weekly or monthly increments. In many cases, working incrementally can mean devoting less than an hour per week to keeping the plan up-to-date. We like the latter approach, because it keeps managers and staff thinking about it.

Continuity planning is a process, not a project. Completing one and placing it on the shelf so you can point to it when asked doesn't get you far. So keep the planning updated and continuous. This will enable you to deal better with a crisis, as well as make you a better investment risk (which could improve your funding prospects). The plan also might improve your insurance-risk profile, providing you with more opportunities or higher insurance limits (see "Four Ways to Save Money - and Your Business"). It will also provide you with a better understanding of the expected impact of an actual disaster from a financial and operational perspective.

OUTCOME: The company had prepared well and acted quickly. Production was not halted, and manufacture of the therapeutic protein was not stopped. If the company had not been prepared to respond, customer's lives might have been endangered, as well as brand reputation and the company's revenue.