When a disaster occurs, businesses can struggle to continue operations and return things to normal. That is why having a business continuity plan in place even before catastrophe strikes is so important. For most executives and operations managers, business continuity means finding any available options to reduce the interruption's impact on the organization and maintain services or sales to customers. But as many companies learned after recent catastrophes like Hurricane Katrina or 9/11, such measures often fall short of providing total financial recovery from the catastrophic impact of a large-scale physical disaster.
Disasters can result not only in wide-ranging damage to a company's physical facilities, but also in compromised infrastructure, transportation and supply chains. They frequently damage communication systems, hamper emergency response units and strain civil support services. They impede the supply of parts and materials and complicate the job of rebuilding and recovery. In their wake, the paper trail documenting what was lost or destroyed—and what is required for the organization to recover its losses through insurance-often gets lost in the shuffle, making recovery even more difficult. As a result, it is critical that an organization take steps to track and preserve the information needed to prepare an insurance claim. And one of the most important steps is to ensure that risk management is involved in business continuity planning from the start.
Imagine a financial services company with dozens of locations that was severely damaged by multiple hurricanes in the same season. Subject to wind deductibles, the company fully expected that insurance would cover the cost of rebuilding. Documentation unexpectedly became an enormous problem during the claim process, however. As temporary and permanent repairs were made to the damaged locations, the associated costs were reported through the accounting system on a regional basis. This was consistent with the business continuity plan and normal operating costs, but was not in accordance with the insurance policy requirements that costs be reported by the individual damaged locations.
Permanent and temporary repairs and additional operating costs were all reported regionally. When presented with these claims, the insurer balked and requested the information by location, which was no longer available. No one had anticipated how the business continuity plan and the insurance policy documentation requirements may have differed.
In this circumstance, the documentation issue could have been easily avoided had the business continuity team and the risk management team been in better communication before and after the event. The company had many locations at risk from tropical storms and hurricanes, so the scenario could have been anticipated prior to the loss. After the incident, the company's risk management team drafted specific documentation and procedural guidance for the business continuity planning team to help ensure that similar problems did not occur on future losses.
Assessing the Risks
Identifying and assessing the risk of business interruption and gauging how to plan for recovery will depend on a complete understanding of how the company operates. Companies should examine the potential areas of risk, the probability of an event's occurrence, its potential level of disruption, the likely impact to employees and the financial impact of disrupted operations.
First, a company must identify what the risks are, not only of catastrophic events such as fires, storms or earthquakes, but also of other risks such as operational disruptions or contingent impacts to significant vendors or customers in the supply chain. Past losses and claims are helpful indicators, but the largest losses affecting an organization often stem from events that management has not envisioned.
For instance, a Louisiana food manufacturer relied heavily on local water to make its products. In the aftermath of Hurricane Katrina, civil authorities informed the company that it could not use the water because it had become contaminated.
The company identified a contractor who could transport clean water from a distant reservoir to the plant, so that the plant could continue production and provide for fire suppression and public health needs (i.e., restroom facilities). The company also obtained a permit to dig a well, in order to establish a more reliable water source than from trucking alone. The company now maintains the well as a contingency. In retrospect, the company could have mitigated its losses even further if operations and risk management had explored the constraints to the production process prior to the event and contemplated ways to mitigate that risk, possibly by installing the relatively inexpensive well prior to Hurricane Katrina.
Contingent losses are another type of risk that catastrophes can create for companies. This is a loss area that can catch companies by surprise, since many business continuity plans are structured to respond to a loss to the company itself, rather than to one or more of its vendors or customers.
An example of contingent losses involved a chemicals manufacturer that was unable to receive raw material into its facility following Hurricane Ike because rail lines had been damaged and rail delivery was unavailable. Force majeure was declared by the chemical manufacturer's rail freight provider because of the damage sustained to the tracks. There was no physical damage to the chemical manufacturing facility's rail yard, but the rail lines in and out of the plant had been flooded or damaged by the hurricane.
The manufacturer found alternative ways to ship the raw material into the facility, but did so at substantially increased costs and planned to file a contingent loss insurance claim based on the damage sustained by its rail freight provider.
It turned out, however, that the chemical manufacturer contracted only with the rail company that operated on the damaged rails, not the rail company that owned the damaged rails. In this case, damage was not sustained by the chemical manufacturer's direct contractual provider, but by a vendor of its rail freight provider. Contingent business interruption insurance coverage therefore was not triggered. Hurricane Ike resulted in a financial loss to the chemical manufacturer, but not one that was covered by the contingent wording in its insurance policy. This example highlights the importance of the risk manager understanding exactly how the business operations and supply chains function and what business relationships exist in that process.
Developing and Reviewing the Plan
After obtaining a clear understanding of all business operations, the risk manager can then identify important issues to discuss with operations. These include options for sourcing product if a key supplier sustains a loss or alternative sales channels if a major customer goes offline. Consideration of alternative providers and outsourcing possibilities are best made before the loss occurs, rather than afterward, when an organization may be fighting for its life.
Other issues such as business or service interruption and complications with ingress or egress of a facility need to be evaluated along with any other potential exposure facing the organization. Risk management must understand how the business continuity plan and insurance policy respond to each risk.
The risk manager and the chief operating officer should review the organization's business continuity plan together to ensure that it will work in coordination with any potential financial recovery under the insurance policy. During this review, a number of items need to be considered. Once the business continuity plan has been activated, how does the insurance policy respond to the costs incurred? Should the policy be amended with insurers in order to cover the necessary costs?
The first consideration after a loss is the safety and well-being of employees. Once that has been established, the company needs to determine which employees will remain on the payroll in the event of a widespread and lengthy shutdown. It may be necessary to retain key or highly trained employees, but is it also necessary to retain lower-level laborers as well? What if the facility is located in a rural area where there is not a large labor population to choose from? It may be necessary to retain all of the employees in order to ensure a smooth and expeditious start-up once the facility is repaired. If so, does the policy cover the labor costs? This scenario should be considered in the business continuity planning process.
Other areas to consider are the protection and preservation of property. When does the business continuity plan dictate that a plant begin shutting down in the event of a pending hurricane? If it is three days before projected landfall, does the policy cover costs incurred within 72 hours of a named windstorm event? What if the policy only covers costs 24 hours prior? Without a joint review of the preservation and shutdown procedures in the business continuity plan by both operations and risk management, concurrence of these discrepancies between the plan and the insurance policy will not be known and may expose the organization to losses that might otherwise be mitigated through insurance policy modification or changes in business continuity protocol.
Be sure to consider the types of building and equipment that would be affected in a large property damage claim. Is the current insurance coverage appropriate with respect to replacement costs versus actual cash value of buildings and equipment? For example, a small nautical parts manufacturer incurred losses in a fire that completely destroyed one of the three buildings on its site. The destroyed building was an old wooden structure that could easily have been replaced by a much cheaper metal one. Therefore, the building, including its contents, was only insured for its actual cash value. But the equipment stored in the building was higher priced, already depreciated electronics. Actual cash value coverage for the equipment would only cover a fraction of the cost to replace it. Since there was little communication between operations and risk management, this coverage oversight did not become apparent until after a fire devastated the facility.
Developing a communication protocol for affected business units is critical, and each business unit must know to call risk management after a loss. Business unit leaders who experience a change in their operations because of the loss should contact the risk manager immediately. The business unit leader may not realize that the costs associated with the change in operations may be recoverable under the organization's insurance policy, so he or she should communicate the circumstances to the risk manager for evaluation.
Communication with the risk manager will also ensure that the documentation needed to support the loss will be maintained by the business unit. Loss-related accounts should be set up after an event to capture costs and maintain documentation related to the loss. These cost accounts can then be segregated and monitored for loss-related costs by a dedicated recovery team including members from operations, finance, marketing and risk management. This communication protocol needs to be a part of the business continuity plan before a loss occurs.
When operations and risk management understand and discuss the risks to the organization, they can collectively determine what measures are needed to mitigate the risks and assess whether insurance should be a part of the solution. This highlights the importance of coordination between operations and risk management in the drafting and execution of the business continuity plan. Such coordination will help the organization physically, operationally and financially recover from a loss in much more timely fashion.
Business Continuity Planning
|