- Justification of BCM Projects Implementation approach overview - Decision Methodology: The Key Probability, Cost-Benefit, Intuitive Approaches Business Continuity Management: Audit And Financial Imperatives

Justification of BCM Projects: An Example of Steps Estimate Losses by length of outage 2. Determine length of outage by backup/ recovery scenario 3. Perform cost/benefit analysis of each feasible scenario 4. Select and sell selected scenario

1. Estimate Losses by length of outage: Step 1 (Losses) An Electronics Wholesaler

1. Estimate Losses by length of outage: Step 2 (Recovery)

2. Determine length of outage by backup/ recovery scenario Recovery analysis for a large bank

3. Perform cost/benefit analysis of each feasible scenario

Decision Approaches Probability-based (used in insurance justification) Analysis-based (used in cost-benefit analysis) Intuition-based (used by most executives and expert systems) The analysis-based approach based on fiduciary responsibility will be recommended, since the probability approach and the intuition-based approach can lead to catastrophic loss exposures.

Probability-based (used in insurance justification) Mr. probability Cost of Hot Site Backup $500,000/year (2% of IS budget) Direct Losses over ten days$30,000,000 Probability of loss.01/year Net Direct Loss$300,000/event ROI -40% (Bad Investment)

Another Probability Approach Assume a 30 year life for the Hot Site Cost of Backup Site over 30 years$15,000,000 Direct Losses over 10 day period$30,000,000 Probability of 1 loss over 30 years26% Net Direct Loss $7,800,000 ROI-48% (Bad Investment)

Analysis-based (used in Life-Cycle cost-benefit analysis) Mr. Application Analyst Direct Impact Loss/Event (10 days) $30,000,000 Delayed Loss of Business/Event$360,000,000 (year to recover ½ sales) Total $ Loss/Event$390,000,000 (½ yearly profit) Probability of Losing our Jobs and Stockholder Suits100%

Step 1: Define Primary Evaluation Criteria of Key Stakeholders StakeholderEvaluation Criteria ExecutivesAssure continuity of a viable organization User ManagementContinue operations with minimum impact on system availability IS ManagementContinue operations with minimum impact on system availability AuditorsContinue operations with minimum impact on financial viability Financial AnalystsMinimize long term costs Intuition-based (used by most executives and expert systems)

Step 2: Perform Ranking of Backup Alternatives using Cyert & March Methodology Evaluation CriteriaDual Center Hot Site Cold Site No Backup Assure continuity of a viable organization (ratio of loss to profit) S (0%) S (1%) - (40%) - (70%) Continue operations with minimum impact on system availability (unavailability period) S (Shifts) S (Days) - (Weeks) - (Months) Continue operations with minimum impact on financial viability (ratio of loss to profit) S (0%) S (0%) - (40%) - (70%) Minimize long term cost (Cost of alternative) S $750,000 S $500,000 S $100,000 SS $20,000

Recommendation The authors believe that the life-cycle prudent fiduciary approach recommended in this paper, best represents the approach that should be used by industry and government. The probability and intuitive based approaches can be dangerous, since they occasionally leads organizations to take inappropriate risks.

BCM NOTE The fact that two of the three approaches often select the same commercial backup center approach is not unusual. It explains why the Backup Data Center Industry has expanded so rapidly. However, many organizations that require recovery in hours rather than days are moving to the dual data center approach; based on negative evaluations in the Hot Site column. Many organizations that still use information technology for support and accounting applications only, select the Cold Site approach because of the lack of negative elements in that column of their table.