Dr Simon Ewing-Jarvie
A Context for NZ BCP 2002
If those engaging in the nature versus nurture debate are observing business continuity
practices in New Zealand, then the ‘naturists’ will be whooping for joy because the
results of the 2002 survey on BCP would undoubtedly lead one to assume that we live in an incredibly benign environment (I think some well known New Zealander misguidedly used that term just prior to Sept 11, 2001). Of course, that is not the case and organisations around the world are facing increasing turbulence, challenge, covert and overt assault. The 2002 NZ BCP results show a relatively stable pattern of executive belief and behaviour, one that gives the lie to the ‘nurturists’ ethos that we are a product of our environment and therefore modify our behaviour to suit changing circumstances. How could so much environmental threat go without meaningful response from those who consider themselves professional organisational leaders?
Since the publication of the 1999 NZ data, much has changed in the world. Y2K came and went with the only notable results being that the IT industry managed to achieve what the Christian world had been attempting for 2000 years, (i.e. to get every non-Christian to abide by their calendar); combined with a temporary ballooning of IT budgets and labour force remuneration. Essential services continue to be a political and organisational medusa in New Zealand with water and power supply inextricably linked through hydro generation, looming exhaustion of gas supplies, the constraints of the Resource Management Act on new development and the possibility of oil price hikes as a result of military activity in the Gulf. And then there was 11 September, 2001.
This environmental profile is made more complex with the migration of asymmetric challenges from the military to the economic sphere. In the military sense, asymmetric threat or warfare is the incongruity of facing a spear chucker with a tank, a fighter plane versus a wire across the valley…or an airliner used as a cruise missile. In the organisational sense it means dealing with the full measure of the hazardscape, not just those that are convenient, trendy or require compliance through legislation. It is probably little wonder that many executives I have spoken to simply say it’s too hard to plan for. I have no problem with that as a personal or organisational choice. Why then do they bother with any BC measures at all? This is totally inconsistent with the most fundamental premise of mathematics…the effect of multiplying by zero.
If it is accepted that an organisation cannot be invulnerable to risk, the goal must surely be one of resilience. How is resilience defined? The resilient organisation is made up of three interlocking components:
The most important aspect of this functional relationship is the presence of each of the three components in business continuity practices. Otherwise, the danger of ‘multiplying by zero’ is ever-present and any successful BC intervention is as statistically significant to the overall organisation as having a method for winning Lotto. Small progress in each area provides exponential growth in resilience. An increasing focus on only one or two areas has the same effect as buying more tickets in the draw, with no way of knowing the total number of tickets or when the competition ends.
This is not to suggest that scenario based planning is particularly useful. The most resilient NZ organisations generally take a ‘capability approach’ to BCP, using scenarios for testing only.
These are not difficult concepts and when discussing them with NZ executives, I find general agreement with the approach. This makes the results of the 2002 BCP survey all the more baffling. If it could be summed up easily, the line would be “if you keep doing the same things, you’ll keep getting the same result” Some have suggested that this is the invisible hand of Adam Smith at work and that poorly prepared organisations will eventually be selected out of the gene pool (I await with interest the announcement of the first ‘Darwin Award’ for BCP stupidity!). However, in a tiny economy like NZ that relies heavily on small-scale employers and their interdependencies, lack of organisational resilience is a national, strategic issue.
It is not possible to include all the results in this article but they are available. The response rate of 10% was similar to previous years despite the change of recipient from Human Resource Manager to Business Continuity and Risk Manager on the survey addresses. 518 medium to large business, including all of central and local government, were included in the sample.
- Physical Assets
- Processes and System
- Staff Capability
- External Relationships
As with all these results, caution needs to be applied as the questions were bi-polar, and the score gives no indication of the degree to which a measure is used. High use preventive actions are those where 75% or more of the response indicates use. The two scores in brackets indicate the 1999 and 1998 result (the latter for organisations with more than 100 staff only). In 2002 there was two:
- Planning for technological redundancy (eg computer backup) – 89% (94%, 92%)
- Making regular modifications to insurance coverage based on risk assessment – 84% (79%, 82%)
Neither of these changes is considered significant. What is interesting is that there are only two in this group compared to 7 in 1999 and 4 in 1998. High incidences of consideration were recorded for the following specific types of crises:
- Computer breakdowns – 92% (90%, 97%)
- Physical security breaches – 78% (72%, 79%)
- Loss of essential services (power, water etc) – 78% (92%, 90%)
- Fire from non-specific cause – 76% (79%, 75% – this data is from the ‘accidents’ question of previous years)
- Work-related health problems – 76% (86%, 84%)
- Sexual harassment – 92% (79%, 85%)
These results are stable except for loss of services and sexual harassment. Perhaps the clamour for resources in the lead up to Y2K has exhausted interest in this area. Anecdotally, there is evidence of organisations disposing of their generators and failing to upkeep emergency supplies such as water. This represents a serious gap in BC thinking. The upward movement from 79% to 92% in sexual harassment contingency planning is strong. The law requires compliance in this area so the question could be asked why is it not 100%? The likely answer to this is that some respondents would not view this as a crisis issue but simply one of HR policy. No doubt certain international leaders wish it were the latter also!
Low score categories were those below 25% usage. In preventive management actions these were:
- Permanent inclusion of outsiders on board or BCP team – 23% (40%, 32%)
- Dedicated research on potential hidden dangers – 18% (40%, 29%)
- Increased relationships with activist or special interest groups – 23% (15%, 26%)
In the case of the first two, the downward movements are considered significant. Again, I believe that the removal of outside consultants and research activities associated with Y2K has contributed to this result. It is concerning and reveals a myopic organisational view of BCP amongst NZ managers.
The most unconsidered crisis events are as follows:
- Extortion – 18% (15%, 12%)
- Bribery – 16% (15%, 14%)
- Boycotts – 11% (16%, 12%)
- Hostile takeovers – 13% (15%, 13%) Counterfeiting – 15% (13%, 19%)
- Copycats – 9% (5%, 23%)
- Kidnapping of executive or family – 10% (7%, 17%)
As with previous years, NZ managers have demonstrated their ability to simultaneously hold mutually opposing views on business continuity. On the one hand, there is enthusiasm for an export led economy, free trade agreements and membership of the global marketplace. On the other there is a general lack of engagement with some of the seedier sides of these opportunities such as external economic or information attacks and psychopathological behaviour.
What about those in the middle ground? Significant movements have been seen in the following preventive management criteria:
- Inclusion of BCP in the strategic planning process – 55% down from 68%
- Training & workshops in BCP – 43% down from 67%
- Crisis simulations – 53% down from 67%
- Updating BCP policies & manuals – 61% down from 85%
- Reduction of hazardous products & processes – 72% UP from 58%
- Use of outside expertise in BCP – 57% down from 71%
- Stringent maintenance & inspection schedule – 60% down from 73%
- Improved acceptance of whistleblowers – 52% UP from 34%
- Consideration of human impact of crisis – 49% down from 60%
- Symbolic recall of past crisis – 33% down from 46%
In the middle ground, planning for specific crisis events changed significantly as
- Theft of intellectual property – 39% UP from 20%
- Loss or theft of information – 50% down from 64%
- Recalls – 46% UP from 25%
- Product defects – 63% UP from 38%
- Plant defects – 46% down from 57%
- Terrorism – 49% UP from 24%
There appears to be a pattern of reducing use of preventive management actions and increasing focus on scenario-based planning. This is a concern given that the most success has been recorded by those organisations that focus on overall capability and resilience rather than specific crises. It is unlikely that NZ managers are getting LESS informed about BCP which suggests that there could be a certain level of fatigue associated with the area or possibly a general fatigue. In my earlier report, I noted that crisis is a time-constrained laboratory for the study of change. Therefore, if organisations are poorly prepared for or unable to cope with crisis, it is possible this is the same for change management capability as a whole. Is the rate of change in the NZ economy and market causing managerial fatigue? Is this fatigue increasing risk through a lack of comprehensive or logical business continuity planning? Or is it just a case of managers not preparing properly but knowing that they should?
The 2002 survey also introduced several new crisis events in order to acquire more specific data. The additions were responded to as follows:
- Predatory pricing (external economic attacks category) – 33%
- Environmental damage, which was previously at 62% subdivided as follows:
- Atmospheric damage (wind, rain) – 55%
- Geologic damage (earthquake, tsunami, landslide) – 57%
- Hydrologic damage (coastal or river flood) – 55%
- Wildfire damage (bush or vegetation fire) – 37%
- Major accidents, which was previously at 75% was subdivided as follows:
- Manufacturing accident – 40%
- Storage accident – 49%
- Transport accident (goods or passengers) – 54%
- Waste or contamination accident – 73%
- Fire from non-specific cause – 76%
Resourcing of BCP is an area where little NZ data is available. The survey examined this issue from three angles; dollars, phases and results. In dollar terms, only a few respondents were able to provide a percentage of turnover allocated to BCP. Some knew the figure only for IT DR and the majority admitted that they did not know. Average percentage spend on BCP was reported at 0.00358% of turnover (the range was 1.5% to 0.00028 with some outliers. This makes the median a better indicator at 0.1% of turnover). Using only those respondents that supplied their annual turnover AND BCP budget, the average expenditure on BCP was $530,000. The question must be asked as to whether that much value, in terms of resilience, has been created. I believe that the answer is no. Using the standard four phases of crisis planning, the degree of resourcing again showed itself weighted toward readiness (Phase 2) and response (Phase 3) at 29.62% and 26.73% respectively with only 19.81% of resources oriented toward returning to normal (Phase 4). Discussions I have with senior executives make me think that the phase 4 result is over optimistic and that few organisations have any idea of how they will return to normal operations after a crisis. The final question asked about how well the organisation thinks it coped with the last crisis it experienced. Taking 100% as a perfect score, the respondents’ mean was 68.4%. This result needs to be taken with caution as those who have gone out of business are not in the sample group.
This article does not set out to show a detailed, academic analysis of the 2002 survey but I am happy to receive emails (firstname.lastname@example.org) regarding specific queries. I wish to close with a more subjective assessment of the New Zealand BCP situation based, not only on the survey and its predecessors, but also many discussions with senior executives and consulting work undertaken.I think that NZ organisations are poorly prepared for the risks of the hazardscape. This is no surprise to many and inevitably begs the question…why? The reasons in my view are contained in the following bullet points:
- NZ leaders are risk averse and therefore look for logical rational bases for undertaking any business activity, including BCP. However, business i.e. the marketplace, is about behaviour and much of it cannot be quantified any more accurately in BCP than it can in marketing or employee relations. NZ leaders need to develop their intuition in parallel with their mind to overcome this limitation.
- Because interpersonal skills (particularly in middle aged to older men) are poor, emotions are concealed (boys don’t cry…get up and chase the rugby ball – yes mummy) and self awareness is low, many managers are unwilling to engage in discussions about staff capability, external stakeholder relationships and so on in anything other than sterile terms. Little wonder that NZ has developed an adversarial workplace culture that cannot be solved by either unionisation or free market policies. Both of these strategies involve the same relationships at work and organisations can only step away from this if they invest in addressing nationally, culturally and demographically induced patterns of individual belief and behaviour. In addition, our universities have overproduced lawyers and accountants for at least 20 years and by sheer weight of numbers, they flow through into general management, taking the ethos of their schooling with them.
- We are entering a national mid-life crisis as the baby boom generation takes the reins of power in almost every sphere. The mass of 40 something and 50 something leaders are more worried about their future, their children, their waistline and health, their child support payments to the ex and the sure knowledge that the government cannot keep them in the accustomed manner in their retirement and that they do not have enough savings to do it themselves. Well named as the selfish generation, they (we) are largely focussed on short term personal and organisational strategies that help to solve or distract from their self-imposed (and largely imaginary) personal dilemma. BCP isn’t in their mental model but it should be if there was much logic being applied to the situation. A healthy serving of spiritual development added to some mind and body work is the only way forward for this group but they are taking our organisations down through the connection between their power and personal needs.
- NZ has gone through an intense, although not continuous, period of change from 1984 to the present. This was largely necessary to deregulate and stimulate a basket case economy. While it has put the economy on a better footing, people who have lived and worked through the period are tired of change. Crisis is a laboratory for the study of change and, on the one hand, I believe that direct parallels can be drawn between change capability and BCP within an organisation. However, if this is true, the leaders can also sense that and therefore any discussion of BCP brings on the ‘rash’ associated with change. This has a sufficiently discomforting effect to lure many into ostrich land.
To the leaders out there who are ‘sticking it out’ inside organisations, as opposed to becoming consultants, academics or olive oil producers, I just have this to say about BCP. If not now, then when? If not you, then who?