Managing Business Risk

There were a number of really good presentations at the Symposium on Supply Chain Management on Friday, but one of the ones that really stood out was the presentation by Francis Borromeo of Shell Oil Canada on Business Continuity Planning.

Business Continuity Planning is one of the best ways to manage risk, including supply chain risk, and last year, Shell Oil proved it. Hurricane Katrina devastated multiple oil refineries in South Texas. The effects were that plants were closed for months, with a mid-term effect on supply and a detrimental effect on oil prices. It was all over the news. However, what they didn’t tell you was that it could have been much, much worse.

Oil refineries process more oil than most oil tankers carry. And we all remember how many years it took to clean up those spills off of Alaska. And multiple refineries were almost destroyed. Had they been processing oil at the time, it could have been one of the worse environmental impacts of the decade, putting the plants out of commission for years, if not closing them down permanently. But not one dropped was spilled. Why?

Shell Oil, like the other major producers in the region, had rock solid business continuity plans that identified all of the major risks as well as measures to not only recover from disasters, but prevent the severe ones from occurring in the first place. As soon as the hurricane started heading toward the region – processing stopped. Tanks were emptied. Above ground pipes were pumped empty. Stockpiled oil was relocated inland.

In addition, thousands of people could have been seriously injured or killed. This did not happen. All non critical personnel, and their families, were airlifted out of the region well before the storm hit. Critical personnel were evacuated as soon as possible. The end result, only buildings – easily rebuilt – were destroyed. It was a disaster, but it paled in effect to what it could have been.

And you can do this too. Business continuity planning and risk management does not have to be ridiculously expensive. The key is that you

  1. have a business continuity plan with
  2. prioritized risks and recovery plans that you can use to
  3. manage the recovery process in order to
  4. transition to business as usual in a manner that permits an
  5. after action review to allow you to improve and thrive.

A business continuity plan not only provides a framework for the recovery of the critical business processes, but it allows you to safeguard your brand and reputation.

But it’s probably last on your management priority list. After all, you only see a return when a major disruption or disaster happens. However, considering that Aberdeen recently found that your average international company experiences two significant disruptions per year, it is critical that you have one. So how do you get the support and resources you need to initiate one?

Francis outlined the following arguments that you can use. On their own, chances are not one of these will win you the support you require – but taken as a whole, the business case becomes very compelling.

  • the insurance provided vs. the cost of insurance;
    a well designed plan will only cost pennies on the dollar and will deliver a ROI many times what it cost to prepare in the event of a disruption … many times …
  • a business impact analysis is bound to identify process improvements
    no business does everything optimally … and often the only way you figure this out is through documenting the process and identifying recovery methodologies
  • tangible, documented, business knowledge
    which can then be shared throughout the organization vs. silos that reside in your employee’s head
  • validation of organizational focus
    once you’ve identified the critical processes, you know what you need to focus on … and chances are you’ll discover a few processes that are a lot more critical then you otherwise thought
  • customer requirement
    a marquis customer will only work with you, or stay with you, if they know you can recover as fast as they can in the event of a major disruption