Gerrit Vink about business impact analysis and scenario planning
22 September 2018
How unexpected dependencies can be fatal
Entrepreneurs generally have a good idea of the direct and indirect consequences that a fire or other incident could have on business continuity. And yet, a business impact analysis can sometimes provide unwelcome surprises and unexpected dependencies, says Gerrit Vink, senior consultant at Riskonet.
A business impact analysis starts with clarifying the flow of goods in a company’s entire production chain. By linking the flow of money to the production chain, you can obtain a complete picture of the financial consequences of an incident. A business impact analysis focuses on identifying and quantifying the most critical incidents for a company. In this context, Gerrit Vink advocates more attention to scenario planning.
The individual running the production location of a large business can usually judge what the consequences of a potential incident would be for that location based on their years of experience. But what about insight into the consequences for the rest of the internal and external production chain? For example, at one business they put vast amounts of time, energy and money into securing a department where the company produced an important raw material for several end products.
“They had invested for years without anyone questioning it,” says Gerrit Vink, expert in the field of business impact analysis at Riskonet. “Through a business impact analysis, we found that the raw material could be bought elsewhere relatively easily and without additional costs. All the measures and costs to ensure the continuity of the business were actually rather superfluous. There didn’t appear to be alternatives for the production of various end products. In the context of business continuity, the company was therefore better off spending money on additional measures at locations for the end products. At the same time, we also found other situations and risks to business operations that could be given more attention.”
Reasons for a business impact analysis
Increasing numbers of businesses are having such an analysis carried out, and for varying reasons. “There is often an insurance issue behind it, but it is increasingly being led by the company’s own desire for insight or from questions from customers about business continuity,” says Gerrit Vink based on his years of experience. “A discussion about risks, chances of consequential loss, the time duration and recovery costs can evoke the question of what the actual situation is: which causes can have which consequences, how likely is the chance that certain events will occur, and how can the continuity of production be guaranteed as much as possible? Also: which link in the production chain is the most critical, and where should the priorities lie not only to reduce the chances of an incident but also to limit certain consequential loss?”
Volumes, utilisation rates and inventory
When carrying out such a study, Gerrit and colleagues are thorough in their methods. An agency study provides a picture of the supply chain with volumes, utilisation rates and inventory. They also examine survey reports of the applicable locations and map out the interdependent alternatives and contingency plans and financial data per branch.
“Scenario planning should be given more attention at production companies”
A visit to the business and interviews with the staff involved at a company also provide essential information for instance about critical processes and product flows, mutual and external dependencies, possible damage scenarios, existing risk management measures, reconstruction and recovery times, internal and external contingency plans, any stock levels and additional costs in the event of an incident.
Clear picture of dependencies
With all this information, Gerrit Vink sketches a clear picture of the product flows and of the reciprocal dependencies among the various locations. “We also establish a maximum number of damage scenarios per location and map out what affect a specific scenario will have on other business units. That includes a worst case scenario without a contingency and a realistic scenario with internal and external contingencies. That demands a high level of scenario planning, while considering the question: what if? When working out and calculating such scenarios, we look at the reconstruction and recovery times, the internal and external contingency plans, possible stock levels and any additional costs in the event of an incident, for example. The result is a complete picture of the financial impact (the business losses) of a scenario on the turnover and the costs for the whole company.”
More attention to scenario planning
Gerrit Vink thinks that scenario planning in particular should be given more attention in production companies. “It is not a criticism or issue of being alarmist – it is extremely difficult to do this on your own. Organisations often employ us after previous internal attempts have failed to create realistic scenarios and to quantify these in financial terms. It is good to get external experts with their years of experience in risk and damage analysis behind them to take a look.”
Consequences for risk management
There can be major positive consequences for risk management. “Damage is often caused through a chain of events, with either limited or major consequences. It is good to periodically ask certain pertinent questions. Which direct and indirect events can actually affect our supply chain? The weakest links are sometimes the most crucial ones; failure can affect the entire chain. In our experience, not every manager or director is aware of (or can have insight into) the major consequences that underestimating the dependencies can have. Small causes can have big consequences. Our analysis sometimes provides very surprising conclusions and eye openers.”
Better discussions with insurers
It is clear that a good business impact analysis can also improve the quality of discussions with insurers. “Our analysis is often used to determine how and for which amounts business losses should be insured. The information forms a good foundation when setting priorities in taking or rolling back certain management measures that influence the risks and possible damage and on the insurance premium. Furthermore, on numerous occasions I have seen how businesses have made correct decisions based on a good analysis for the continuity of management. It is an issue of good business sense to take this type of risk management very seriously.”
