Updates from March, 2014

  • How to calculate your Business Continuity budget? 

    Premise: Business continuity is about your recovery of your business post crisis not before. Insurance does not recover business, it recovers losses or existing investment.

    The true recovery is your ability to continue your business as before. Put simply your business should be able to generate same sales as planned as before.

    So how to calculate your business continuity budget?

    We use this is a benchmark. See if this works for you.

    In order to do this, first assess your current insurance strategy.

    To make this simpler we take the case of an individual life insurance.  If your life insured value is 1 crore (or 10 million) and your annual premium is 250,000/- the percent you pay to 2.5% per year.

    Note this amount is for your family members to receive typically after you are gone. It is not the price for ensuring for your continuity, which is your own life. Your life continues when you yourself can ensure your annual compensation.

    Today every business has set of insurance policies. Get all the policies together. Get the annual premium together and annual insured value. Remember that you recover the losses not your business. But the ratio of  premium to insured value gives an indicator – a percent.

    The percent is your existing risk appetite. Apply this appetite/percent to your sales. This value is your business continuity budget.

    An example with numbers!

    Lets say your combined percent of premium to recovery is 2.5%. So if your sales turnover is 10 crores (or 100 million), then your business continuity must be 25,00,000 or 2.5m. Since you are already paying tax premium deduct this from 2.5m and what you get is the remaining budget for business continuity.

    You can do the annual calculation of business continuity at the end of the financial year, which will then set the target for the next year.

    Summary

    (1) Identify your insurance cost or insurance premium per year

    (2) Identify your insured value

    (3) Divide 1 by 2 into percentage terms. You have a percentage.

    (4) Apply the percentage to your sales turnover from the last financial year. You have the business continuity budget for the next year.

    (5) Deduct the existing annual premiums (1) from (4) – you get the balance value.

    We deduct (1) from (4) because (1) represent a part of your risk management strategy.

    This is your pending budget for business continuity for this year.

    Hope this helps!

     
  • Business Impact Analysis (BIA) – the foundation of business continuity 

    Business Impact Analysis (BIA) is the act of identifying and prioritising an organization’s services (internal and external) that should be up and running in the event of disaster. Combined with maximum tolerable period of disruption(MTPOD), return time objective (RTO), return point objective (RPO) and minimum service levels, it gives the business continuity management/CEO the ‘requirement’ for continuity. Once done efficiently, thus enables ‘cost-benefit analysis’ for the Business continuity budget as well as any associate decision.

    Note that this is not IT strategy, it is business strategy first.

    Here are some of the outcomes/business benefits of BIA:

    1. Business impact analysis (BIA) Helps to identify organisation into services or activities. ISO 22301 calls it mission critical ‘activities’.
    2. Business impact analysis (BIA) helps define organization into 3 or more logical set of services. Examples are revenue generating services (RGS), essential infrastructure services (EIS) and delayed start services (DSS). You may replace RGS with your own set of mission critical terms. A hospital may replace RGS with key patient support services or any other suitable terminology.
    3. Business impact analysis (BIA) helps you identify which strategy is best for you, which is not (Strategies are (Build, Buy or Rent) working from home, intra-city, intercity, out-of-country, out-of-continent) using a monetary and non-monetary approach.
    4. Business impact analysis (BIA) helps formulate single or multiple Incident management Plans(IMPs) and Business Continuity Plans(BCPs) against individual threats (fire/floor/earthquake/tsunami, pandemic) and impacts (site outage, network outage, people outage)
    5. Business impact analysis (BIA) can be performed relatively quickly compared to strategy and Incident management plan (IMP) or the business continuity plan (BCP) formulation/implementation.
    6. For those seeking ISO 22301 compliance, BIA is mandatory. BIA forms the basis of other associated processes such as risk assessment, strategy formulation, selection of choice.
    7. Last but not the least, if you are not sure of the scope of business continuity management, do BIA. It will help bring everyone on the same page; if you have a BCP without a BIA, getting a BIA helps management align with the BCP.

    Coral eSecure provides consulting and certification support for ISO 22301.