A Resounding Yes! BCP and DR Can Bring Real Cost Savings
Recently, there was an online discussion where the question was raised if both Business Continuity Planning (BCP) and Disaster Recovery (DR) service and implementation can be quantified in terms of real dollar savings. I believe that to be a great question—one that anyone in those fields should be asking. And to be clear, I think the reply is a resounding “yes.”
In recent years, it would be very easy to say that dollars have become “scarce” from the standpoint of business planning and operations. Many of our clients have recently shifted their focus toward and improved cost/benefit ratio and greater overall savings in BCP and DR. This eye toward savings extends into both the tactical and—more importantly—strategic areas.
Tactical and Strategic Aligned
On the tactical side of the equation; we see the focus moving to short implementation times and efficient conversions from other systems. New clients are typically eager to start or re-energize their BCP/DR efforts. Their goals are to ensure full compliance while at the same time maximizing the outcomes from a complete and robust plan. While this will not show quantified savings, it does maximize the organization’s investment in the program. The real savings lies in the organization’s leveraging of the tactical into the strategic.
It is the strategic side of a BCP/DR plan that provides the real cost/benefit improvement and a measurable dollar savings. A complete BCP strategy can greatly reduce premiums on business-interruption insurance. A quantitative and qualitative Business Impact Analysis (BIA) can also help an organization adjust amount of coverage needed and validate the selection.
Compliance is Key
A complete BCP/DR software solution should—at the very minimum—generate a number of plans. Some of the major standards most commonly encountered or required include:
- ISO 22301
- ISO 22313
- FFIEC, etc
The inclusion of these plans should meet and exceed the requests of most auditors. Having these included at the beginning should drastically eliminate the need for costly back and forth between BCP professionals and auditors.
The Importance of Continuity
In the area of Business Continuity Planning, we have spoken with customers regarding the use of the data collected within BCP/DR solutions for both business-process improvement and for streamlining operations. Providing CIOs and Information Technology (IT) leadership with an IT Gap Analysis has quickly become one of the most popular cost-saving offerings. A methodology that provides IT infrastructure with an accurate Recovery Time Capability (RTC) allows the organization to map the most aggressive Recovery Time Objective (RTO) for their applications. This provides the organization with clear gaps for focused planning and remediation.
Real Results: Real Applications Yield Real Savings
The greatest savings derived from BCP/DR savings in the healthcare industry can be found at the intersection of IT and DR. One of the very first efforts is to leverage those business software applications identified in the BIA that ultimately have little-to-no impact on the actual operation of the business.
Often, we find clients who have abandoned legacy applications in certain business units and no one in the organization has notified IT. Often, this may be a case of simple oversight. In other cases, those business units feel they may need these applications in the future. For one of our clients, this simple exercise saved the organization almost $2.1 million.
Another direct cost savings is using the Business Operational Blueprints from a complete plan in a surprisingly different direction… Human Resource “Onboarding” of new employees. A complete Business SOP (Standard Operating Procedures), complete with related supporting resources, can be leveraged in educating a new employee on departmental processes and interdepartmental dependencies.
Testing Means Savings
Another important savings opportunity comes from first applying the Business Impact Analysis, mapping business applications to IT infrastructure, and then applying risk models to those results.
Working with a large client, we provided their Chief Information Officer (CIO) with several risk-level scenarios. This allowed him to identify his most-critical applications and then establish a remediation plan. The result was certainly impressive. Instead of spending millions of dollars to adjust risk levels to ensure resiliency across high-risk business applications; this CIO saved considerable money, demonstrated fiduciary responsibility, and created understanding among his peers.
The push toward cost-savings grows more important every day, as the Aberdeen Group estimates the industry average cost per hour of downtime to be approximately $181,770.