Enhanced BIA
Blending the Human Factor into Business Impact Analysis
Author: Steve Crimando and Marv Wainschel
Concerns about people and their contribution to the corporate bottom line do not fit neatly into recovery plans for operational failure. Still, the landscape of potential hazards has shifted dramatically over the past decade, ushering in a need to plan for novel and complex crisis scenarios wherein a focus on people cannot be avoided. Analyzing such crises as pandemics, dirty bombs, and economic meltdowns, and developing effective contingency plans for them requires new approaches to traditional hazard vulnerability assessment (HVA) and business impact analysis (BIA).
There is growing awareness in the scientific and professional communities, as well as within the U.S. Department of Homeland Security, that some hazards will leave facilities and systems largely unaffected but result in substantial behavioral disruption to the workforce and surrounding communities. Failure to accurately anticipate the behavioral consequences of these kinds of threat scenarios can render disaster plans ineffective and even jeopardize lives. Yet, in recovery plans for operational failure, little to no thought has been given to protecting a corporation’s primary asset during a crisis-its people.
Human-focused Crisis Scenarios
The recent H1N1 influenza outbreak, declared a Phase 6 pandemic by the World Health Organization in May-and arguably overblown by the media-showcased the impact of behavioral issues on business continuity. Even in an outbreak of what was considered a mild flu strain, school closings in many jurisdictions had immediate and profound ramifications for students and parents, ultimately impacting employers.
Parents unable to arrange child care on short notice found themselves homebound even though they and their children were healthy. The impact on hospitals and healthcare systems was also dramatic with a substantial surge of “worried well.” Public health emergencies, CBRN incidents, and other hazards that lack clear parameters are known to produce high numbers of psychological casualties often not factored into traditional BIA models.
Traditional BIA-What’s Missing?
Continuity professionals who focus on operational failure know that a BIA will yield acceptable downtimes for business processes, which, in turn, leads to the identification and quantification of recovery resources, including personnel resources over pre-defined recovery phases. Longer downtimes correspond to slower recovery of resources. Corporate recovery strategy addressing operational failure is based upon the need for such resources over time.
What’s missing? Pandemics, terrorist attacks, and civil strife fall outside the discipline of operational recovery, but require planning for mitigation. While such events are not in themselves operational failures, they can affect operations- and planning for mitigation is not so much about recovering resources as dealing with behavioral issues.
Chemical, biological, and radiological events are fraught with uncertainty and fear. Disease and radiation cannot be seen, felt, heard, or smelled. Pandemic fears are compounded by additional uncertainties: persistence (duration), recurrence (in waves), geography and speed of spread, as well as the change in virulence of the virus. In a June 24, 2009 Washington Post article, John Barry, author of The Great Influenza, cited the two most significant aspects contributing to impact: the virulence of the virus (over which we have no control) and interventions.
Corporate interventions include the establishment of employee assistance programs (EAPs), stocking of antiviral drugs, awareness and educational programs, increased hygiene, and social distancing. These mitigations can be costly, and the question a BIA can answer is, “How much is enough?” Current BIA protocols that address only operational failure do not answer this question, because the impact on personnel contributions is not a factor in the BIA.
While BIA protocols for operational recovery depend upon acceptable process downtimes, impacts to personnel contributions depend upon the human condition. Determination of acceptable downtimes is rooted in losses that have a lasting effect on customer service, financial position, corporate image, and the ability to meet legal and regulatory obligations. Traditionally, those four measurable exposure areas have been the central issues of business impact analysis. However, there is a fifth measurable area of exposure that can have a lasting effect on the corporate bottom line. That area is the potential
degradation of personnel contributions.
BIA Evolution Needed
It’s obvious that personnel contributions affect operational recovery, but what issues affect personnel contributions? How realistic can our strategies be for meeting recovery time objectives (RTOs) if the likelihood of people remaining or returning to work in various hazard scenarios is not fully anticipated? On a process and enterprise level, what long-term losses to personnel contributions will ensue if a company’s human factor mitigations are insufficient? Philosophical responses are barely helpful in quantifying solutions. Astute executives look for measurable indicators of impact. What could the business stand to lose if it didn’t protect and enable surviving personnel?
From a corporate welfare perspective, the humanitarian view of protecting people is not germane. It’s not the people; it’s the contribution they make to the organization. The distinction is non-trivial. People have characteristics like family, the need to survive, hunger, personalities, leadership abilities, skills, knowledge, the ability to operate under pressure, friends, experiences, hopes, etc. While the combination of those things supports their contributions to the firm, they are not the contribution. They are not what we need to measure in analyzing impact when things go awry.
To determine the need for human factor mitigation, what continuity professionals need is a tool that can reflects the downside of personnel contribution. The downside is more than “the lack of personnel contribution,” it includes obstruction to the corporate mission in the form of poor decisions, lowered morale, and the contagion of reduced productivity.
Business continuity professionals, take heed. The risks that lie ahead require a 
new approach to assessing and integrating the complexities of operational risk and human factors in a manner that go beyond today’s best practices. Evolving risks require further evolution of BIA models. Enhanced BIA featuring the seamless integration of a human impact audit or human factors assessment may represent the next generation of BIA. CI
___________________________________________________________
Steve Crimando is the Managing Director of XBRM, a company focused on the human factor in business continuity. He can be reached at steve@xbrm.com.
Marv Wainschel is the CEO of McWains Chelsea, a business resilience consulting firm. He can be reached at marv@mcwains.com.
Print/Mail/Save
To contact us for more information, click here to go to our Contact Page, email us at info@xbrm.com, or call us at 212.366.8200
