Calculating the ROI of Business Continuity Management: Digital strategies and software to get your money's worth PDF Free Download
1 / 6/6
100%
Calculang the ROI of Business
Connuity Management:
Digital strategies and soware
to get your money’s worth
Business Connuity
Calculang the ROI of Business Connuity Management: Digital strategies and soware to get your money’s worth
2
Business connuity is in vogue now. But execuves have long
doubted whether they’re geng their money’s worth.
Right now, business connuity is in fashion. Organizaons,
having performed post-mortems on their COVID response,
reason that their preparaons were inadequate; that they
need to be more proacve in ensuring that mission-crical
operaons connue to work during unplanned disrupons.
It hasn’t always been like that. For a long me,
organizaons failed to resource business connuity
programs adequately, viewing those programs as pure
costs to the business.
Unfortunately, it’s not unlikely that this thinking will
remerge once the present crisis threat recedes.
When that happens, how will business connuity
praconers get funding and priorizaon for
their programs?
We argue that praconers will have to get comfortable
making ROI-based arguments for business connuity
management. Not sure how? This guide seeks to help
praconers deliver an execuve-targeted business
case for digital business connuity strategies and
soware plaorms.
Why business connuity management is a business benet
Let’s start at the beginning.
Outside of moments of crisis, execuves fail to priorize
business connuity, because benets derived from the
program tend to be less visible than those derived from
other mission-crical units.
Business connuity praconers, as such, will have to
push against this tendency to see business connuity as
an expense. Instead, they must demonstrate to higher ups
how their programs can be an asset.
This, of course, entails showing how the return will be
greater than the overall cost.
The easiest way to do so is calculate program ROI. The
business connuity ROI showed to execuves is the
esmated cost of the program (including associated
tools and resources) subtracted from projected revenue
loss risked a disrupve event occurring without proper
business connuity safeguards.
Top business risks to prepare for
But not just any disrupve event. Praconers, here, must determine which risks pertain to their business.
Those risks, likely to change over me, will be based on factors such as geography, industry, polical and regulatory
climate, customer base, etc.
Generic risk indicators are a good place to start. For instance, the most recent Allianz Risk Barometeri (2022) amassed a
list of the top global risks; threats include the following:
Cyber incidents
Business interrupon, including
supply-chain disrupon
Natural catastrophes
Pandemic outbreak
Changes in legislaon and regulaon
Climate change
Fire, explosion
Market developments
Shortage of skilled workforce
Macroeconomic developments, e.g., monetary
policies, austerity programs, commodity price
increase, deaon, inaon
3
Calculang the ROI of Business Connuity Management: Digital strategies and soware to get your money’s worth
Countries and regions face their own microeconomic developments, and so, risk oen varies in predictable paerns.
In many advanced European, North American, and APAC economies, for instance, Allianz concludes the top risk is
business interruponii. Meanwhile, cyber incidents are considered the most pressing risk in powerful emerging economies
like India and Braziliii.
The cost of unplanned downme
Of course, execuves don’t just want to know what’s likely
to happen. They’ll demand to know how much unplanned
downme from that disrupon is likely to cost them.
Costs, here, are likely to be higher than the C-suite thinks.
What’s more, unplanned downme is much likelier to
happen than the C-suite imagines.
How much more likely? According to industry data,
82 per cent of companies have experienced at least one
unplanned downme incident over the past three years;
most, in fact, have suered mulpleiv.
Meanwhile, the costs associated with these incidents,
calculated using a combinaon of direct and indirect costs,
keep geng higher (See below).
Direct costs Indirect costs
Labor • Direct labor
• Over me
• Outside
contractors
• Idled operators
• Indirect labor
(back-oce)
Producon • Wasted product
or materials
• Reduced
capacity
• Tesng and
quality control
• Startup/restart
• Parts and
materials
• Shipping
• Ulies
Finances • Lost revenues
• Tighter prot
margins
• Lost sales
opportunies
• Customer
service risks
Unplanned cost esmates will oen vary by industry;
unplanned interrupon in heavy industry, for example,
entails higher machine costs.
Cross-industry esmates, though, can provide reliable
data. Praconers, for their part, can feed some of that
data into ROI calculaons. For instance:
Server downme. The hourly cost of server
downme tops $1 million for 44 per cent
of enterprisesv.
Data breach. In 2021, the cost of a data breach
was $4.24 million, represenng a 10 per cent
jump in two years. Lost business (including
increased customer turnover, lost revenue due
to system downme and the increasing cost
of acquiring new business due to diminished
reputaon) constuted 38 per cent of the total,
or $1.59 million.
Among other business interrupon incidents,
Allianz esmates that:
– The average value of a re/explosion-related
insurance claim comes in around $6.7 million.
– The average value of a storm-related
insurance claim comes in around $4.4 million.
– The average value of an earthquake-related
insurance claim comes in around $1.6 million.
– The average value of a machinery
breakdown-related insurance claim comes in
around $.62 million
– The average value of a water damage-related
insurance claim comes in around $.55 million
Calculang the ROI of Business Connuity Management: Digital strategies and soware to get your money’s worth
4
Factors to consider when building your own ROI calculator for business connuity
strategies and soware
• Labor costs. Labor costs equal the sum of direct, incidental, and recovery costs associated with employees
during unplanned incidents.
–Direct costs are the total costs for employees impacted by a disrupon
–Incidental costs equal idle me that employees are not working during a disrupon
–Recovery costs constute the me needed for employees to recover from an incident; recovery me oen
involves overme.
• Technology recovery costs. Similarly, idled technology that must be rebooted also costs the business. These
recovery costs oen include overme, out-of-warranty acquision costs, outside-vendor and consulng costs.
Costs associated with system restoraon also come into play.
• Loss of business costs. Typically calculated as gross revenue divided by total minutes in a work year, these
costs represent lost gross revenue from disrupon. For instance, CNBC calculated that Apple made over $690
thousand per minute. An interrupon of one hour would cost the business over $41 million.
• Cost of customer condence/service value. An intangible cost, loss of customer condence and service value
oen results from unplanned disrupon.
Best-pracce business connuity strategies
Indeed, the costs of disrupons are increasing. Invesng
in digital business connuity strategies and soware is
meant to lower costs to the business – oen even to put
money back into the business when business connuity
intervenons idenfy expensive deciencies before
disrupons occur.
Of course, not all policy intervenons will have the
necessary ROI. Which ones will?
From the best-pracce literature, we conclude that
praconers must coax senior leadership to demonstrate
commitment to resourcing the following business
connuity management acvies:
• Ensuring that the business connuity policy and
business connuity objecves are established and
are compable with the strategic direcon of the
organizaon.
• The business connuity policy should be:
– Be available as documented informaon
– Be communicated within the organizaon
– Be available to interested pares, as appropriate.
• Ensure that the responsibilies and authories for
relevant roles are assigned and communicated within
the organizaon, with emphasis on the responsibility
and authority for:
– Ensuring that the BCMS conforms to the
requirements of the document
– Reporng on the performance of the BCMS
The business impact analysis (BIA) will also be the
cornerstone of any risk management program liable to
prepare for, respond to, and recover from disrupons
this year. Here, organizaons should use this process for
analyzing business impacts to determine their priories
and requirements.
According to best-pracce standard, ISO 22301, that
process should involve the following:
• Dene the impact types and criteria relevant to the
organizaon’s context
• Idenfy the acvies that support the provision of
products and services
• Use the impact types and criteria for assessing the
impacts over me resulng from the disrupon of
these acvies.
• Idenfy the me frame within which the impacts of
not resuming acvies would become unacceptable to
the organizaon
• Set priorized me frames within the me idened in
• For resuming disrupted acvies at a specied
minimum acceptable capacity
• Use this analysis to idenfy priorized acvies
• Determine which resources are needed to support
priorized acvies
• Determine the dependencies, including partners and
suppliers, and interdependencies of
priorized acvies.
5
Calculang the ROI of Business Connuity Management: Digital strategies and soware to get your money’s worth
These measures feed into the business connuity plan
(BCP). The BCP provides guidance and informaon to
assist teams to respond to a disrupon and to assist the
organizaon with response and recovery. Again, according
to best-pracce guidance, that plan should include the
following components:
• The purpose, scope, and objecves
• The roles and responsibilies of the team that will
implement the plan
• Acons to implement the soluons
• Supporng informaon needed to acvate (including
acvaon criteria), operate, coordinate, and
communicate the team’s acons
• Internal and external interdependencies
• The resource requirements
• The reporng requirements
• A process for standing down
It’s not enough, however, to simply develop a BCP.
Reviewing and tesng the plan is crucial, too, to evaluate
suitability, adequacy, and eecveness of its business
impact analysis, risk assessment, strategies, soluons,
plans, and procedures.
How to do it? Organizaons will need to undertake
evaluaons through reviews, analysis, exercises, tests,
post-incident reports, and performance evaluaons.
From there, rm should also conduct evaluaons of the
business connuity capabilies of relevant partners and
suppliers. Other measures include:
• Evaluang compliance with applicable legal and
regulatory requirements, industry best pracces, and
conformity with its own business connuity policy
and objecves
• Updang documentaon and procedures in a mely
manner, e.g., at planned intervals, aer an incident or
acvaon, and when signicant changes occur
ROI-enhancing digital soware investments to help run every
aspect of business connuity eortlessly
Best-pracce strategies are only one part of the ROI
calculus. Digital business connuity management soware
is the other.
Not all such plaorms enhance ROI. Instead, praconers
will have to do due diligence to scout plaorms that
automate key business connuity management funcons,
to make business connuity planning and management
easy by applying industry standards drawn from the latest
versions of ISO 22301, ISO 22313, and ISO 22317.
The aim, here, should be to increase ROI with a plaorm
that helps managers and execuves determine disrupon
impacts and develop plans and recovery strategies to
address risks. ROI is also derived from plaorms that scale
up to any incident and back down to business as usual.
When it comes to enhancing ROI, what other soware
capabilies maer? We suggest the following:
Business impact analysis. Built-in BIA tools
provide a step-by-step process to idenfy
crical acvies, determine maximum
periods of disrupon, assess the risk and
impact of disrupons, collect and document
recommendaons, and report across the
business.
Find gaps easily. Collecng and aggregang
data to highlight any crical acvies, processes,
assets, and resources lacking recovery strategies
as well as untested recovery strategies that put
the business at risk.
Monitor crical dependencies. Quickly idenfy
dependencies between business acvies and
supporng assets or vendors and stay informed
when one is at risk.
A central locaon for all plans. Business
connuity plans, recovery strategies, and crisis
response plans can all be developed, tracked,
and reviewed to ensure opmal coverage.
Bale-test your recovery strategies.
Supports tests and exercises to help business
connuity and crisis teams rene and improve
their response.
Integrated crisis and incident management.
Built with crisis management principles to
include response teams and embedded
nocaons workows.
Acvies, process registers, and dependency
dashboards. Get a consolidated view of all
business acvies, crical dependencies, or the
status of BIAs to stay up to date and make beer
informed decisions.
Contact, asset, and vendor management.
Manage key details of sta, contractors,
customers, suppliers, regulators, and external
pares. See reliant acvies and related recovery
strategies at-a-glance, to know which ones are
potenal risks to the business.
Monitoring dashboards. Display key informaon
where (and when) it’s needed using exible
dashboards, analycs, and reporng that caters
to stakeholders.
6
Meet the next-generaon tool for corporate crisis and
business connuity management teams to collaborate, plan,
track their response, and share informaon. Built on the
Noggin Core plaorm, Noggin Business Connuity gives
response teams and decision makers the tools to know what’s
happening, collaborate quickly and eecvely, make beer
decisions, and enact the right plans to take acon when it
counts the most.
The Noggin Business Connuity soluon pack is backed by
the Noggin Library with hundreds of plans and best-pracce
workows, out of the box, and installed in minutes.
for Business Connuity
To learn more,
visit: www.noggin.io
or contact: sales@noggin.io
MAR-231
Sources
i. Allianz Global Corporate & Specialty: Allianz Risk Barometer 2022. Available at hps://www.agcs.allianz.com/content/dam/onemarkeng/agcs/agcs/
reports/Allianz-Risk-Barometer-2022.pdf.
ii. Ibid.
iii. Ibid.
iv. Sundeep Ravande, Forbes: Unplanned Downme Costs More Than You Think. Available at hps://www.forbes.com/sites/
forbestechcouncil/2022/02/22/unplanned-downme-costs-more-than-you-think/?sh=d60c93636f7e.
v. Laura DiDio, Tech Channel: The Cost of Enterprise Downme. Available at hps://techchannel.com/IT-Strategy/09/2021/cost-enterprise-downme.
Like what you read? Follow Noggin on social media
@teamnoggin facebook.com/teamnoggin linkedin.com/company/noggin-it
Finally, business connuity is in vogue now. But
execuves have long doubted whether they’re geng
their money’s worth.
Further, there’s reason to believe that this thinking will
return as the acute crisis phase of the pandemic recedes
and recessionary storm clouds come into view.
Business connuity praconers, in their turn, will have
to get comfortable speaking the language of ROI, geng
acquainted with how much unplanned disrupon will cost
the business.
From there, praconers can make execuve-targeted
arguments for business connuity ROI.
wROI, here, won’t just come from strategies but also from
business connuity management soware soluons, like
Noggin, that help companies get the best bang for their
buck by running every aspect of the program eortlessly
as well as ramp up during moments of crisis and back
down to business as usual.
