We talk a lot about the need to mitigate the operational risks of a business disruption: what if your organization loses access to a key facility or suffers a ransomware attack or experiences the loss of a critical vendor?
Those of us who work in business continuity and IT/disaster recovery think about these kinds of problems night and day—and we work hard to create plans to mitigate the risks of them happening and to manage the impact if they do.
However, there is one kind of impact that is quite significant but frequently overlooked: the financial impacts which a business disruption can cause the company.
These can rear up and bite an organization at the worst possible time—when you’re scrambling to manage the operational aspects of a disruption.
The operational crunch can lead to a financial crunch, giving you double the trouble.
Therefore, it’s important to think about your organization’s financial readiness ahead of time. If the organization is not ready, there may be steps it can take to improve its posture—as we’ll set forth in today’s post.
Most large organizations have insurance to cover the expenses caused by business disruptions. However, we have found that there are frequently overlooked gaps in coverage. We suggest that the BC team participate in the process to ensure their organization really looks under the hood when it comes to making sure the potential financial impacts of an event are adequately addressed. The BC team may not have the expertise to look at the details but can give ideas and guidance. Consider the items below.
Medium and smaller organizations generally have less coverage and greater exposure.
One area where coverage tends to lag is cyber issues. A separate rider or policy may be required to obtain adequate coverage for the potential exposures in this area, particularly for companies that possess a great deal of their customers’ personal, private information. Damages in these cases can rise to the millions of dollars. The BCM team should make sure these protections are in place, not just assume they are.
The financial impacts of a crisis can be divided into short-term impacts and long-term impacts.
Short-term impacts would typically include such matters as extra expenses to deal with the disruption (e.g., overtime, temporary help, special equipment), loss of income as a result of the disruption, delays in income caused by the disruption, reductions in efficiency which thus reduce income, and fines or contract penalties which are incurred as a result of the disruption. These are all extra pressures on the company’s finances which can kick in right away.
Long-term impacts might include: Lawsuits relating to the disruption, loss of customers and therefore of income, and the expenses of bringing in new staff or providing extra training which relates to the disruption (think of the expenses Starbucks incurred recently in giving diversity training to its entire workforce). These roll in over a longer time window but can be just as financially stressful if not more so.
Insurance is not a silver bullet for preparing for financial impacts. It is a project in itself. To make effective use of insurance, you must first determine the amount of coverage necessary. You also need to understand your policy, especially with regard to its reporting and notification requirements. Depending on your situation, you might need special types of insurance or special riders. Common riders provide special coverage for business interruptions and data breaches. Work with your insurance provider to understand any wrinkles your policy contains in terms of actual loss, income loss, restrictions, etc. Remember that there might be an investigation before your claim is paid out.
Do you understand the difference between insurance and business continuity? See this Business Continuity 101 blog for a refresher.
Your crisis plan needs to include a section dealing with financial matters. Specifically, you should ensure that it requires that people track the expenses the organization incurs in dealing with the crisis. This will give you the option of making such a claim later.
Without the information, you might not be able to determine if a claim should be made. The information could also be important in a later lawsuit (if, for example, the company determines that another entity was responsible for the disruption and seeks redress in court). Often people are lax about tracking their expenses because they assume they can be reconstructed later on. This confidence is frequently misplaced.
As a general matter, it is worthwhile for the BC team to review contracts for penalties that might be assessed against the organization if it fails to provide a service. The organization might also wish to consider including exceptions to these penalties for crises that are outside its control if such provisions are not already in place.
Depending on the event, the organization could be required to make a significant outlay of cash to cover expenses. Does your organization have the cash or credit available to cover any such expenses? This should be part of your BC planning. Some organizations are very revenue driven, relying on revenue to cover expenses. If your organization is of this type, and your revenue dried up as a result of a disruption, would you have access to an alternate source of funds to keep the business going? Some organizations are able to make agreements with their vendors to extend payment terms in the event of a disruption. Alternately, the company could hold off on paying its bills for a period of time.
Whatever measures might be appropriate for your organization, the BC team should have an understanding of the potential shortfalls and know where the cash will come from in the event of an emergency.
When it rains, it pours. And when your organization experiences a disruption to its business processes, its financial position can also come under stress. Think about these issues as you craft your business continuity and recovery plans. A mature plan includes provisions to handle the financial impacts of the crisis as well as the operational ones. Are you financially prepared for a business disruption?