Opportunities for Action in Financial Services. Overcoming the Unexpected: A Business Imperative

Transcription

1 Opportunities for Action in Financial Services Overcoming the Unexpected: A Business Imperative

2 Overcoming the Unexpected: A Business Imperative Every financial institution is vulnerable to disruptions from natural and man-made disasters. In the face of continuing global tensions and a history of periodic breakdowns in basic services in particular, computer and phone systems planning for business continuity has never been more critical for banks, insurance companies, and other financial-services firms. Clients and customers expect seamless operations, even when disaster strikes. For these reasons, national regulators in the Americas, Europe, and Asia are paying renewed attention to companies strategies for business continuity, raising the issue to the top of management s agenda. Terrorist attacks are the most visible and immediate events underlining the vulnerability of financial institutions. Terrorism can temporarily cripple an entire financial district, as New York discovered after September 11. An analysis by The Boston Consulting Group and several other consulting firms revealed that the destruction of the World Trade Center impaired the economy of New York City by $83 billion, with financial services firms sustaining the greatest damages of any sector. 1 Similarly, the City of London has experienced considerable financial losses as a result of IRA bombings. But extreme weather conditions can be almost as devastating. Hurricanes have shut down entire urban areas, including in some cases the financial heart of a 1. New York City Partnership and Chamber of Commerce, Working Together to Accelerate New York s Recovery: Economic Impact Analysis of the September 11th Attack on New York City, November 001.

3 city, as Gloria did in New York in Floods also wreak havoc, as so many central European towns discovered when the Danube, the Elbe, and other major rivers overflowed in 00, sending local financial institutions scrambling to protect their real estate and maintain their businesses. The floods cost the region $15 billion, hitting financial institutions especially hard. Banks and insurance companies, in particular, face risks to their infrastructure and critical business partners from less sensational crises, such as fires, electrical outages, and other events that can cripple the operations on which businesses, governments, and society at large depend. Many financial institutions in Europe, the Americas, and elsewhere consider disaster planning simple common sense. Wise leaders have armed their firms with well-constructed, comprehensive plans that will allow them to continue operations when the next calamity occurs. They have organized their corporate infrastructure to minimize threats by, for example, deconcentrating operations and building redundancy into systems. In doing so, they have institutionalized the notion of expecting the unexpected. Such careful preparation pays off by saving lives and preserving essential business transactions. For example, in the World Trade Center attacks, Morgan Stanley was able to ensure the safety of all but a handful of its more than 3,000 employees in that massive complex by means of a well-planned and executed approach that it had implemented after the 1993 bombing. Some employees moved to nearby backup facilities within 0 minutes of the first attack, and critical customer information and communications were immediately routed through Dallas. During the recent European floods, Commerzbank prevented serious data losses by using remote data-storage facilities that backed up all the bank s transactions.

4 Similarly, significant investment and careful planning kept YK from causing serious disruptions at financial institutions; it is widely believed that without such measures, billions of dollars in lost productivity as well as systems breakdowns would have resulted. Despite its clear necessity and evident benefits, however, business continuity planning is still on the back burner for an alarming number of firms. A recent BCG survey of leading real-estate executives for North American companies, conducted to assess the impact of the September 11 attacks, revealed that many companies still need to do more to anticipate threats of disruption and in the worst case destruction. Although most of the executives surveyed agreed that business continuity is critical to their strategies, customer service, and operations, many admitted that they skimp on committing resources to protect against disruption. Three-quarters of the respondents said they spend less than $1 million a year on business continuity planning. And few reported having dedicated business-continuity organizations or companywide plans. We believe that firms that fail to develop and maintain an up-to-date approach to business continuity based on a detailed analysis of the threats they face and on planned responses to protect people, communication links, and facilities are imperiling their success, and possibly their survival. Financial institutions must address several critical issues to ensure that their operations continue in the wake of a broad spectrum of disruptions.. The survey covered different types of companies; about half the respondents were from financial or professional services firms. The sample included many large companies, with 30 percent of them having annual revenues of more than $10 billion and more than 10,000 employees.

5 Organizing for Business Continuity Companies must begin by organizing properly. That means setting two priorities: first, establishing an effective and sufficiently senior leadership structure for managing the effort; and second, developing plans for leadership succession and management coordination. Priority One: Installing Committed Leadership and an Effective Reporting Structure. Effective continuity planning requires the CEO s leadership, perspective, and involvement. The CEO should set the agenda for business continuity, ensure that the right people are involved even at lower levels of management, where continuity planning is not considered a high institutional priority and empower them to engage in the planning effort. Several others on the senior management team should be instrumental in setting policies and leading continuity-planning efforts. One senior executive should be given responsibility for implementing and executing the firm s continuity initiatives and should report directly to the CEO. This person will need a business continuity team consisting of leaders from infrastructure and real estate, information technology and data processing, and human resources. It is equally important to engage management teams from the main business units at the outset and to keep them onboard as a steering committee throughout the planning and long-term implementation process. The firm s senior risk managers should also be involved in the effort, as should external suppliers. In addition to the right leadership team, business continuity requires its own reporting structure. Infrastructure reporting should reach up the corporate chain of command so that these issues receive

6 sufficient attention and opportunities can be seized. Without senior backing, for example, it may be hard to use business continuity to achieve cost reductions. Our survey of real estate executives showed that few firms achieved meaningful cost efficiencies as they addressed continuity-planning issues after the World Trade Center attacks. Priority Two: Planning for Leadership Succession and Coordination at All Levels. If the CEO and other top leaders are suddenly unable to run the organization, those left behind need to know who will. Senior managers should know in advance who will lead the backup team. Close cooperation and cross-training help ensure that business can rebound quickly from the loss of one or more crucial employees or units. Soldiers use such tactics to great effect, teaming up to inform one another, replace fallen colleagues, and reroute their operations quickly. Achieving business continuity also means coordinating at the global, regional, and local levels, down to office management and individual employees. Although coordination is important, decentralization frees the global center and regional levels to implement the next steps to keep the firm running. Lowerlevel actions allow for business survival and emergency containment. In addition, companies should evaluate their third-party providers continuity plans and consider all geographic locations to ensure that risks are fully understood. Planning for the Short Term You cannot prepare for everything. But developing a simple, straightforward plan that covers the main effects of disasters is critical for short-term business continuity. We have found, however, that financial

7 institutions often focus on events rather than on the results of those events. A plan that takes account of consequences rather than causes is the key to shortterm survival in a crisis. (See Exhibit 1.) Exhibit 1. The Impact of a Disruption Is More Critical Than the Cause Successful planning requires looking through layers of possibilities to identify real dangers Fires Accidents War Theft Severe weather Tornadoes Unable to enter building Unable to access equipment or data Unable to reach client Causes of Disruptions Immediate Effects Impact on People Communication links Facilities Product or deliverable loss Earthquakes Utility outages Loss of power Voice mail disruption Telephone disruption Office disturbances Law enforcement activity Injury or death Network disruption Terrorism Floods Human error Such a plan must address the organization s greatest vulnerabilities, such as its concentration of locations and resources, on the basis of a thorough assessment of the nature and type of risk associated with each. At a minimum, continuity planning usually means providing data storage backups and alternative work sites. Even though most organizations are experienced in IT contingency planning, the biggest challenge is still ensuring that staff can reestablish critical processes at different sites with as little downtime as possible. De- Widespread illness Hurricanes SOURCE: BCG analysis.

8 Exhibit. The Facilities of a Typical Financial-Services Firm Are Heavily Concentrated Indicates various types of banking facilities Retail HQ/administration Warehouse/storage Other Numbers indicate multiple sites in the same city SOURCE: BCG analysis.

9 veloping a plan to achieve this short-term goal is a two-step process. The first step is to map all major business processes in order to identify those that cannot be disrupted under any circumstances. These so-called process maps delineate each business function and demonstrate how each contributes value to the business cycle. They rank processes by importance, separating primary processes that are critical to customer and client service, secondary processes that provide support, and tertiary processes that are discretionary and don t generate revenue. The second step is to conduct an audit of strategic sites and business processes, which then provides the building blocks for the continuity-planning framework. The audit information is used to generate a risk assessment database: a complete tabulation and ranking of risks and responses. That information provides the fact base to support an assessment of process priorities, head-count needs, and space requirements. The firm can then analyze issues and options in detail. It can identify which facilities, links, and resources should be more robust and where there is a need for increased redundancy. Such an approach can show, for example, whether business continuity issues should inform the firm s decisions about site locations. In Europe, the analysis may well speed relocation away from financial centers. In Asia, it may prompt a firm to ensure that there are backup data-storage facilities accessible from the main financial centers. In North America, it might impel a shift away from the Northeast. (See Exhibit.) In fact, the Federal Reserve, the Securities and Exchange Commission, and other regulators in the United States are now considering guidelines that would require financial institutions to maintain full

10 backup facilities at a safe distance from Manhattan. Securing data and vital facilities would not only ensure continuity in the event of disruptions in New York but also reduce vulnerability to threats around the world. Once the financial institution has a plan for business continuity, that plan must be updated and tested regularly. A United States General Accounting Office study in January 003 found that only 7 of 15 major financial-services institutions have fully tested their business continuity plans. Such plans do not improve with age. In the event of a severe disruption, reactions must be instinctive and immediate. Routine training and disaster recovery exercises can save lives and preserve valuable business. Successfully implementing a revised and expanded approach to business continuity and infrastructure planning will require changes in habits and behavior. Reluctance is natural. Because the value of such efforts measured in reduced risk is not obvious to many people, senior managers must communicate why such efforts are vital and point out when continuity plans are being implemented successfully to save the business, and perhaps lives. Institutionalizing Business Continuity Clearly, any financial institution that has not developed a concrete plan to minimize problems in the face of a disruptive event must do so immediately. The most effective continuity plan, however, is integrated into a holistic, long-term master plan that covers the organization s overall infrastructure needs. Many financial institutions have plans that make sense for their current structures. The next step is to address business continuity in terms of both cur-

11 rent delivery platforms and the infrastructure the firm will require in five to seven years. Then institutions can examine, in particular, the continuity implications of the global sourcing and outsourcing of vital operations. Approaches to business continuity and infrastructure must complement the overall business strategy. As financial institutions assess continuity issues, they should address opportunities to improve customer service, optimize business processes, and reduce occupancy costs. This may mean moving processes such as mortgage receivables within one line of business to other lines of business or to external providers, within existing locations or beyond. Developing a long-term infrastructure strategy begins with assessing needs across businesses. A farsighted firm will examine synergies within and across businesses and determine whether synergies can be exploited by redesigning processes across products and regions. The company can then determine where it needs production centers and where it needs service centers, whether it should deconcentrate or centralize operations to provide for business continuity, and which activities should be insourced, outsourced, or moved, both to minimize business-processing risk and to provide cost-effective support. (See Exhibit 3.) The result of these analyses will be a process infrastructure blueprint against which the firm can assess all infrastructure decisions. The blueprint will be a living document, subject to change as business conditions and risks evolve. Ultimately, the plan will lead the firm to its ideal infrastructure, ensuring both efficient and sound delivery of products and services qualities that will differentiate competitors in the years to come.

12 Exhibit 3. Developing a Blueprint for Business Continuity Determine infrastructure needs across businesses in order to leverage investments across organizational units and geographic locations. Exploit synergies by redesigning processes across products and regions. Define appropriate processing architecture, including deconcentration versus centralization of facilities and services. Decide which activities can best be delivered through insourcers and outsourcers. Prioritize activities to be routed to cost-effective locations across businesses. Use worldwide time-zone campuses to ensure 4-hour business coverage. SOURCE: BCG analysis. In developing a continuity strategy, the team will identify the need for several major changes of infrastructure to increase the reliability and redundancy of resources, facilities, and links. Staff limitations, rental contracts, IT infrastructure investments, and many other issues, however, may slow down the process. We think that a five-year horizon for implementing all continuity-planning steps is realistic for many large financial institutions. * * * The risks to business continuity at financial institutions everywhere are higher than they have been in many years. Continuity planning is a crucial component of any organization s broader infrastructure strategy. The Bank for International Settlements new Regulation II for the global banking industry and

13 forthcoming principles for sound capital assessment for European financial institutions require specific capital allocations for processing activities. The associated capital will be inversely proportional to the soundness of an organization s business-continuity capabilities. Thus, the strength and efficiency of the delivery infrastructure will become competitive differentiators. Find out what your options are today. Remember that reviewing continuity issues now lays the groundwork for facing with confidence whatever nature or man may deliver. Sandy Apgar Antonio Riera Rüdiger von Stengel Sandy Apgar and Antonio Riera are vice presidents and directors in the Boston office of The Boston Consulting Group. Rüdiger von Stengel is a manager in the firm s Düsseldorf office. You may contact the authors by at: apgar.sandy@bcg.com riera.antonio@bcg.com stengel.ruediger.von@bcg.com The Boston Consulting Group, Inc All rights reserved.

14 Amsterdam Athens Atlanta Auckland Bangkok Barcelona Beijing Berlin Boston Brussels Budapest Buenos Aires Chicago Cologne Copenhagen Dallas Düsseldorf Frankfurt Hamburg Helsinki Hong Kong Houston Istanbul Jakarta Kuala Lumpur Lisbon London Los Angeles Madrid Melbourne Mexico City Miami Milan Monterrey Moscow Mumbai Munich New Delhi New York Oslo Paris Rome San Francisco Santiago São Paulo Seoul Shanghai Singapore Stockholm Stuttgart Sydney Taipei Tokyo Toronto Vienna Warsaw Washington Zürich BCG 3/03