2008 BUSINESS RESILIENCY SURVEY RESULTS:

Transcription

1 ijet/wp BUSINESS RESILIENCY SURVEY RESULTS: An Insider's Look at the Current State of Risk Management, Continuity and Resiliency in Multinational Organizations July 2008

2 ABOUT THE RESEARCH For two weeks in May 2008, ijet International invited executives and professionals in the fields of business continuity, security, travel, HR and others to respond to a survey about their approach to risk management, business continuity and resiliency. The survey includes responses from 607 participants, representing more than 380 multinational organizations, mainly based in North America (87%), with a smaller number from Europe (10%) and Asia Pacific (2%). The majority of participants (65%) represent organizations with over $1 billion annual revenue. The remaining participants represent companies with $500 million to $1 billion (15%) and less than $500 million (20%) annual revenue. Most participants (92%) work for commercial businesses; the others represent federal government, Non-governmental Organizations (NGOs) and non-profits (8%, combined). A wide range of industries is represented, including: aerospace and defense, banking and finance, consumer goods, energy and utilities, health and pharmaceutical, manufacturing and business services and consulting. VPs or executive-level administrators (CEOs, CFOs, CSOs, etc.) make up 17% of respondents. The majority of participants have Director (32%) or Manager (31%) titles. Participants represent departments across the organization. The largest portion operates in security (38%) followed by travel (13%), risk or crisis management (12%) and business continuity or resiliency-related roles (10%). The remaining 27% of participants are distributed across administrative, business development, HR, IT, legal, finance, logistics and other roles. EXECUTIVE SUMMARY Business resiliency -- defined as the ability to rapidly adapt and respond to risks and opportunities in order to maintain continuity of business operations, remain a trusted partner and enable growth -- is capturing broad interest at multinational organizations. These organizations are starting to expand focus beyond mere responses to and recovery from business disruption, to include revenue retention and growth when considering risks and business disruptions. 2008, ijet International. All Rights Reserved. Page 1

3 As a practice, business resiliency is still a work in progress. While disaster recovery and business continuity are clearly defined and established practices, approaching business from a resilient standpoint has yet to settle into one standard of practice. Definitions, priorities and perspectives vary across departments and leadership levels. Commercial and governmental organizations also perceive threats and priorities differently. Key findings include: Most organizations are well prepared for emergency response and recovery: 84% of respondents have an emergency response plan in place; 83% have a business continuity plan in place. While fewer organizations have a business resiliency plan in place, results indicate that a significant number (41%) of businesses, NGOs and governmental agencies are applying resources to business resiliency. Senior executives define top resiliency concerns differently than do other leaders in their organizations. Senior executives identify loss of revenue (38%) as the greatest concern, while directors and vice presidents tend to be most concerned about damage to reputation and brand (32% and 29% respectively). Customers were cited by 49% of respondents as a reason to create and maintain resiliency initiatives, suggesting that as resiliency initiatives spread, customers will likely have higher expectations and make greater demands on organizations resiliency planning. A key component of resiliency and continuity planning is communicating resiliency successes across the entire enterprise. Nearly two out of three companies (62%) communicate the successful navigation of business disruption to their employees and 41% also communicate these experiences to their customers. While resiliency is identified as important, obstacles to advancing the initiative exist. Top barriers to implementing stronger risk management, continuity and resiliency plans include: competing priorities (55%), disparate geography (54%) and technologies (also 54%). The greatest perceived external threats vary by sector. Commercial businesses identify health and infectious diseases as the greatest external threat. Government also cites health and infectious diseases, along with transportation and weather/environmental disruptions as their greatest concerns. Nongovernmental organizations are most concerned about geopolitical unrest and health and infectious diseases. 2008, ijet International. All Rights Reserved. Page 2

4 TYPES OF PLANS The organizations surveyed are well prepared for emergency response and business continuity planning. Most respondents (84%) have an emergency response plan in place, followed closely by those with a business continuity plan (83%). A surprising 41% of respondents said that their organization has a business resiliency plan in place, suggesting that multinationals are starting to apply resources toward resiliency initiatives. Among the respondents, the largest organizations were most likely to have resiliency plans. Surveyed organizations with annual revenues greater than $1 billion were 52% more likely to have business resiliency plans in place than organizations with annual revenues less than $1 billion. Surveyed organizations with revenues in excess of $10 billion were 88% more likely to have a resiliency plan. 2008, ijet International. All Rights Reserved. Page 3

5 STAGES OF RESILIENCY PLANNING The organizations surveyed were in various stages of planning for resiliency and were equally likely to be at the beginning stages of implementing a plan (28%), in process of implementing a plan (28%), or already had a resiliency plan in place (32%). DRIVERS OF RESILIENCY PLANNING For the respondents, organizational leadership applies the most pressure for the organization to be adaptive in the face of business disruptions. The most influential internal groups, according to those surveyed, are senior executives (64%) and the board of directors (40%). Customers were cited by 49% of respondents as a reason to create and maintain resiliency initiatives. Most significant concern about not having a resiliency plan in place: Loss of life or property 27% Damage to reputation/brand 25% Loss of revenue 17% Non-compliance with regulations 7% Decline in shareholder value 7% Not Applicable/other 17% Implications of customers driving organizations resiliency initiatives are significant. Early adopters of resiliency may be able to tout their approach as a differentiator when compared with competitors today. However, as business resiliency is more widely adopted, customers are likely to have higher expectations and make greater demands. Over time, a resilient approach to business may become a customer requirement. The surveyed organizations are clearly driven by the impact on individual employees and the effect a major 2008, ijet International. All Rights Reserved. Page 4

6 disruption would have on reputation or brand. Survey participants cite those two reasons as significant concerns about not having a resiliency plan in place. Loss of revenue was cited as the third most compelling reason. TOP THREATS DRIVING RISK MANAGEMENT AND RESILIENCY PLANS Data and intellectual property was noted by respondents as one of the top assets considered in organizations risk management and resiliency plans, policies and procedures. Protecting facilities and other physical assets (81%), employees and contractors (82%) and traveling employees and expatriates (70%) also rank among the top assets for risk management Internal Threats In order of importance and resiliency initiatives among the respondents. The category Customers and Partners was cited by 60% of respondents as a factor Computer Viruses/ Other IT Attacks Unplanned IT Downtime considered in planning, reinforcing the tie between resiliency and Employee Theft or Fraud Industrial Accident customer/partner requirements. The supply chain ranked as a Workplace Violence consideration for 45% of the participants. When asked to identify the top internal threats monitored as part of risk management and resiliency initiatives, participants generally agreed: 83% cited computer viruses and other IT attacks, 58% said other IT downtime, and 47% identified employee theft or fraud. External Threats In order of importance Health/Infectious Diseases Terrorism Weather/Environment Geopolitical Unrest Economic Changes Supply Chain Disruptions Transportation Disruptions Top external threats that the surveyed organizations monitor as part of risk management and resiliency initiatives include health and infectious diseases (47%), terrorism (45%) and weather/environmental disruptions (41%). COMMUNICATING SUCCESSES ACROSS THE EXTENDED ENTERPRISE A key component of resiliency and continuity plans is communicating best practices and successes across the enterprise and beyond. During the previous year, 61% of the surveyed organizations shared plans with the extended enterprise. Yet only 36% communicated the successful avoidance or response to a disruption and only 36% communicated resiliency-related capabilities that could help them secure new business. The surveyed organizations communicate successes and best practices most often to their employees (62%) and customers (41%). Investors, media, and prospective customers are not often informed of these issues, according to the respondents. PLAN IMPLEMENTATION & MAINTENANCE No one department was identified across the surveyed organizations as the de facto lead for business resiliency 2008, ijet International. All Rights Reserved. Page 5

7 and continuity planning. The Business Continuity or Resiliency Department is the lead in planning only 23% of the time among the respondents. Another 56% of respondents identified no less than nine responsible departments, including Security, Operations, Administration, HR and individual business units; 9% did not know who is responsible. For surveyed companies that have both continuity and resiliency plans in place, most organizations activated them at least once in the previous year. Of the 88% with a continuity or resiliency plan in place, half enacted it at least once last year. Some 11% activated the plan more than three times last year, and just under one third of those (29%) activated their plan on more than 10 occasions. The surveyed organizations are generally reviewing and updating plans regularly. Over the past year, 73% made adjustments to the plan itself; 61% identified key personnel required in the case of a disruption; and 59% assigned or updated roles or responsibilities for risk management and business continuity in their organization. However, among those surveyed, fewer companies have taken more proactive steps. Only half of the respondents (52%) tested their plans in the past year and only 35% percent identified key backup suppliers in case of a business disruption. The number of the surveyed organizations that upgraded their resiliency- and continuity-related systems over the past year was significant: 69% upgraded their communication system; 53% improved or implemented a traveler tracking solution; and 50% improved their risk monitoring and reporting solutions. IMPLEMENTATION BARRIERS Participants noted that the top barriers to implementing stronger risk management, continuity and resiliency plans were competing priorities (55%) and fragmented resources (information, people or technologies) across the enterprise (54%). Other barriers included: insufficient budget (29%), insufficient people or technologies dedicated to improvements (28%); information overload -- where it s difficult to discern which threats or events impact the organization (26%); and insufficient support from senior leadership (15%). OUTSIDE CONSULTANTS Some of the surveyed organizations are turning to outside advisors for help with planning -- largely risk consulting firms (31%) and accounting or auditing firms (29%). Of those with an outside advisor, only 36% felt their needs were met by those outside companies. Forty-five percent indicated they were unsure about whether their needs were met; 12% were somewhat satisfied and 7% were not at all satisfied. Respondents identified areas for improvement as: best practice information (practical tools and benchmarking data); customization of solutions or advice for the organizations needs or culture; and proactive involvement with the company. 2008, ijet International. All Rights Reserved. Page 6

8 COMPARISON OF COMMERCIAL, FEDERAL GOVERNMENT AND NGOS Among the respondents, the differences in how the federal government, Non-Governmental Organizations (NGOs), non-profits and commercial sectors regarded continuity and resiliency are noteworthy. Thirty-eight percent of government respondents said their organization was operating without a resiliency plan, compared to 27% for NGOs and 15% for commercial organizations. Although all sectors surveyed generally agreed on the top four assets considered in risk management and resiliency initiatives (Data/Intellectual property, Employees/Contractors, Travelers/Expatriates, and Facilities/Physical Assets), there were some differences for other asset classes. Among those surveyed, the commercial businesses were much more likely than NGOs and government agencies to consider the supply chain or their customers and partners in their risk management and resiliency planning; 54% of commercial businesses surveyed consider the supply chain in their planning, compared to 15% of NGO respondents and 13% of those from government agencies. Some 64% of the commercial sector respondents consider their customers and partners in their policies, compared with 19% of NGOs and 38% of government respondents. Health and infectious disease was identified as the largest external threat to organizations when looking at all responses. However, commercial businesses that were surveyed ranked disruptions differently from NGOs and government respondents. Participants from commercial organizations ranked all of the external threats about the same: weather/environmental concerns, health and disease, terrorism and geopolitical unrest each received between 37% and 48% of responses. Government respondents ranked transportation disruptions, weather/environmental concerns, and health and infectious diseases as the greatest threats (63% each); whereas 2008, ijet International. All Rights Reserved. Page 7

9 NGO respondents identified geopolitical unrest (58%) and health and infectious diseases (62%) as top concerns. Among those surveyed, commercial businesses reported experiencing disruptive events more often than respondents from government organizations and NGOs: 57% of participants from commercial organizations experienced at least one disruptive event in the past year, compared with 50% for government respondents and 38% for those from NGOs. Among those surveyed, 11% of commercial businesses reported at least four disruptions. Only 4% of NGOs and no government respondents reported four or more disruptions. COMPARISON ACROSS LEVELS OF ORGANIZATIONAL LEADERSHIP Senior executives that participated in the survey (CEO, CFO, COO, CSO, General Counsel, etc.) reported a different perspective about their organizations preparedness when compared with responses from leaders at other levels in the organization. Senior executive participants had a different assessment from other leaders regarding which plans the organization has in place. For example, 58% of surveyed executives reported that their organizations have formal business continuity plans in place, compared with 87% of vice presidents and directors and 82% of other respondents. This trend applies to each type of plan addressed in the study; the senior executives were least likely to agree that their organizations had plans in place. Corporate officers who participated in the survey also identified different responsibility and oversight for business resiliency than other leaders. Corporate officers most often identified the highest-level executive as the lead department for oversight and implementation responsibility (63%) while only 10% of directors, 5% of managers and 7% of those with other business titles agreed. Participants top concerns for not having a business resiliency plan in place also differed based upon titles. Senior executives that were surveyed identified loss of revenue (38%) as the most significant concern, while directors and vice presidents tended to be most concerned about damage to reputation or brand (32% and 29%, respectively). SUMMARY OF FINDINGS The survey results suggest that the surveyed multinational organizations are interested in resiliency and many are implementing resiliency initiatives. However, most are still defining resiliency and identifying the differences between business continuity and business resiliency. Most organizations are in the early stages of determining which resiliency practices work best. That most of the surveyed organizations have some type of response or emergency management plan in place is not surprising, as disaster response and business continuity are established practices, with evolving standards to govern best practices. As the largest organizations take the lead to instill resiliency plans in their organizations, it is likely that business resiliency, as a practice, will mature as well. The survey results also showed that business resiliency is no longer driven solely by internal considerations. 2008, ijet International. All Rights Reserved. Page 8

10 Respondents identified customers as a focus for both implementing resiliency and for communicating resiliency best practices. The results suggest that as resiliency grows in adoption, so too will its importance in gaining and retaining customers. While resilient organizations today have a competitive edge, resiliency may well become a requirement for retaining business in the future. Further research into organizational models for successful implementation of business resiliency practices is needed. As the best approach is adopted by global organizations and evolves, best practices will emerge and guide planning, execution and communication strategies. In the meantime, organizations are building upon best practices established by disaster recovery and business continuity leaders. For more information, resources and white papers on Business Resiliency, visit ijet Intelligent Risk Systems ( is a leading provider of global intelligence and business resiliency services, helping multinational corporations and government organizations monitor, protect against and respond to global threats. Integrating world-class open source intelligence with patented technology, ijet s award-winning Worldcue solutions help clients monitor and assess global threats relative to their key people, facilities and supply chain assets; automatically track and communicate with travelers and expatriates; and deploy emergency response services throughout the world at a moment's notice. Providing a unified view of threats to assets, ijet enables clients to mitigate risks, reduce corporate liability and prepare for and respond to crises For additional information please visit or contact info@ijet.com. 2008, ijet International. All Rights Reserved. Page 9