From Expense to Asset: A Reexamination of BCM Plans and Their Value
By Aaron Miller , Protiviti Inc.
Each year, organizations spend considerable amounts of money developing business continuity management (BCM) plans, on the assumption that they need to prepare for a wide range of disasters. Fires, chemical explosions, computer failures, or even a terrorist bomb can cripple a thriving enterprise, bringing its operations to a grinding halt for weeks, if not months.
When done properly, BCM plans allow an organization to respond more efficiently and effectively to disruptions of normal operations. These plans help minimize lost employee time, service interruptions among customers and, most importantly, the loss of cash flow and profits for the enterprise.
Historically, though, the value of BCM plans has been minimized, if not overlooked completely. Many matrix organizations perceive BCM plans almost as an annoyance, something that must be done while incurring minimal cost. In some organizations, senior executives downplay the efforts necessary to craft effective BCM plans. They insist that the effort should take up little management time and prevention drills, like simulations and backup system testing, occur with minimal interruption to the company’s ongoing operations.
However, as today’s world becomes increasingly uncertain, the types and levels of business threats are changing. Over the past decade, the prominence of BCM plans has been on the rise, especially after 9/11. Manufacturing plants with dangerous chemicals have long had evacuation and crisis response plans. Today, even information-based companies and service organizations recognize the need for BCM plans given how much of their business relies on data retention and disaster recovery to secure their operational resiliency.
Should organizations begin perceiving their BCM plan as an asset rather than an expense? Does an effective BCM provide long-term value to the organization? If and when the plan is used, does having a well-prepared plan help the organization generate income and save money?
A strong case can be made to view BCM plans as a corporate asset rather than an expense. There is both an economic utility and strategic business logic to support this view. The goal is not to persuade the Federal Accounting Standards Board (FASB) to change its accounting rules, but to help BCM professionals develop hard numbers that can prove how their efforts produce value.
The Economic Utility Argument
Valuing a BCM plan as an asset makes the same economic utility sense as prepaid insurance. The BCM program is, in effect, “prepaid preparedness.” The organization makes an upfront investment in an asset that serves to mitigate its risks. The economic value of the BCM plan can be calculated in the same way as projecting the annual economic value of insurance. The same basic equation can be used both cases:
Total Benefit x Probability = Economic Monetary Value (EMV)
Using this equation, one can determine if the cost of insurance equals or exceeds its benefit to the company. If the insurance cost is less than its EMV benefit, it is a good buy. If the cost is higher than the EMV, then the company is wasting resources buying the insurance.
Suppose, for example, that an organization has a $250,000 insurance policy costing $800 per year. The policy covers disasters where probability is estimated at 1 in 200. This means that the effective insurance utility is $250,000/200 = $1,250. The insurance is a good buy, given that its cost of $800 is less than its economic utility of $1,250.
The same logic can be used to assess the economic utility of a BCM plan. One can easily compile the costs of a BCM plan and compare them to a calculated EMV. For example, assume the following scenario:
- Company ABC has $600,000,000 in annual revenue.
- The BCM program is devised to prevent a risk affecting one-third of its revenue ($200,000,000) over four months, thus $67,000,000.
- The probability of the loss is 1%, thus $670,000.
- The BCM program has annual costs as follows: $125,000 internal staff time + $75,000 dedicated technology + $100,000 services provider retainer = $300,000.
- Additional annual BCM costs include sole source discount loss @ $125,000 + dual shippers @ $65,000 + onsite trip monitoring @ $12,000 = $202,000.
Putting the facts (above) together yields the following equation:
|
Economic Monetary Value |
$670,000 |
|
Less BCM program costs |
($300,000) |
|
Less additional costs |
($202,000) |
|
Utility of BCM program |
$168,000 |
This example illustrates a positive economic utility on an annualized basis for this company’s BCM plan. Even with costs of $502,000 and a probability of only 1%, the program provides a utility of $168,000. This formula is repeatable across any enterprise and can be used to assess whether the company is investing wisely in its BCM plan.
The Accounting Argument
One of the traditional challenges to recognizing BCM as an asset is determining how to value it from an accounting point of view. While current FASB guidance does not consider the following implementation in a literal sense, one could argue that the economic utility equation above provides solid ground for demonstrating the value of a BCM plan using a Return on Investment (ROI) calculation. In the past, the inability to measure the annual ROI of BCM has put it at a disadvantage when competing for enterprise resources. However, it is quite possible to fashion a meaningful ROI calculation as a replicable algorithm across enterprises of all types.
The basic ROI formula is as follows:
ROI% = Benefits – Costs X 100
Costs
Using the same data for Company ABC in the economic utility argument, we can see that the calculation yields a 33% ROI, as follows:
ROI % = $670,000 - $502,000 = $168,000 = .33 X 100 = 33%
$502,000 $502,000
Of course, one might question whether the enterprise should spend less on its BCM program in an attempt to increase its economic utility and ROI. For example, leadership may claim that only $368,000 (instead of $502,000) should be spent on the BCM program, and this would raise the economic utility to $302,000 instead of $168,000, while lifting ROI to 82% instead of 33%.
However, a strong counterpoint to this argument is that achieving the same EMV might be less likely if the BCM program were less robust or encompassing of all risks. For example, a less robust BCM program might address only the risk of a three-month interruption in business activity, thus preserving only $50 million. This would then result in a lower EMV: $50 million X 1% = $500,000 rather than $670,000. Therefore, despite the decreased program costs, the lower EMV results in a proportionally lower economic utility and ROI, rather than a higher one. Such factors would, of course, need to be analyzed in-depth given the cascading effects they have on each other.
When a numbers-oriented discussion occurs, the BCM leadership can be successful in shifting the organization’s vision. Once a debate about the numbers begins, the BCM’s value proposition has often been accepted. Budget discussions can then focus on the estimates and claims around program numbers. The advantage is that the BCM program office can now effectively compete in these numerical exercises, because repeatable and standard measurements are now available for the BCM program.
Changing Language, Changing Perception
The fact that FASB does not recognize BCM as an asset is certainly a barrier to formally converting the BCM expense to a true accounting asset. However, this does not prevent the argument from being proposed and used by organizations to begin changing perceptions. Being able to develop and apply hard numbers can encourage leadership to look at BCM in a new and valuable way.
The fact is that language is powerful. When people refer to their BCM programs as assets rather than expenses and the work as “value adding” rather than “value consuming,” they can begin to own the debate about BCM resources needs. The very words used to talk about BCM can impact how the CFO and others examine their budgets and decide which projects to fund and at what level. Changing the language can change the mindset.
There should be little doubt that companies that rigorously prepare for disaster recovery are better able to keep their businesses operating than those without BCM plans. The consequences of continuing to minimize BCM plans or failing to appropriately invest in them will only intensify the repercussions of a disaster should it happen. An organization's ability to respond to chaos, capitalize on competitors’ inability to respond quickly, and continue to serve customers, employ people and operate the business, will be key to its survivability. Using the techniques outlined in this paper can equip BCM managers effectively compete for resources in a results-driven, ROI-analysis-focused organization.
Article from Protiviti KnowledgeLeader – www.knowledgleader.com.
KnowledgeLeader is a subscription-based website that provides audit programs, checklists, tools, resources and best practices to help internal auditors and risk management professionals save time, manage risk, and add value. Free 30-day trials available.
|
Protiviti is a leading provider of truly independent internal audit and business and technology risk consulting services. We help clients identify, measure and manage operational and technology-related risks they face within their industries and throughout their systems and processes. And we offer a full spectrum of audit services, technologies and skills for business risk management and the continual transformation of internal audit functions.
Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services. |