When deciding whether to insource or outsource business continuity management, many organisations let cost guide the discussion. Cost is important, but the real criterion should be value.
By Michael Davies, CEO, ContinuitySA
Once a company decides it needs to take business continuity and resilience seriously, it becomes necessary to consider whether to insource or outsource the capability. A particular sticking point is the recovery facility to which staff can move if the primary site becomes unusable, and a backup data centre.
More often than not, the discussion quickly becomes one focused on cost. After adding up their figures, companies sometimes conclude that commissioning their own recovery site and data centre is cheaper than what an expert service provider can offer.
On closer examination, though, these cost-savings are misleading. This is because calculations typically only include direct costs—the indirect costs such as procurement, planning and design, furniture and equipment, cleaning, security and utilities costs are seldom included. Many of these are hidden away in other budgets, and are hard to separate out. The same is true of ongoing rental and maintenance costs, as well as management, which can be considerable.
These calculations also seldom take into account the cost of adding to the workload of existing staff members when insourcing, nor the heightened risk of distracting already busy people still further not only during normal working conditions but even more importantly, during times of crisis and incidents.
Non-experts also often forget to cost in the connectivity and communications needed both for the data centre and the back-up office, which might include highly specialised call centre seats.
A key consideration for CFOs is that many of the costs of insourcing will have to be recognised as capex on the balance sheet which can be a source of worry to investors, and generally disliked by many CFOs as non-core capital expenditure for the business.
By contrast, an outsourced solution will cover all these costs, including the hidden ones, in a single, monthly payment that would not appear on the balance sheet because it is an operating expense. Because the facilities would be “shared” with the outsourcer’s other clients, so are many of the fixed costs.
There are also other ways an outsourcer can help cut costs; for example, by offering syndicated seats or data centre space for a proportion of the solution, based on a proper business impact analysis. The savings can be substantial and still result in a comprehensive business continuity solution.
Searching for value
So much for cost. There is, however, a much more important conversation that needs to take place about value. The essential point here is that whatever the solution costs, it must deliver results. As noted above, insourcing means relying on staff who are “free” in the sense that their salaries are already being paid, but who are unlikely to have the time (and possibly the inclination) to become experts on business continuity. In addition, BCM is something that needs to be updated regularly as circumstances and risks change, something that is seldom undertaken.
More than likely, then, when the chips are down, the backup plan simply won’t work satisfactorily—or at all.
By contrast, engaging with a reputable BCM provider means that the solution can be scoped after a proper business impact analysis and threat assessment has been done resulting in a customised business continuity plan, and it will benefit from being run by experts. BCM is far from easy, and thousands of details have to be considered. A BCM provider with years of experience will understand how the BCM life cycle works and how to assist a company during tests and disasters.
Most important of all, a BCM provider will undertake regular, rigorous testing of the solution to improve it continuously to ensure that, when the chips are down, it actually does work.
It’s also worth mentioning that planning for a disaster is very different from surviving one—the presence of experienced people who have dealt with this many times is not the least of the value that an outsourced solution can bring.
A final consideration: statistics in United States show that 40 percent of businesses never reopen after a disaster. My personal experience shows that companies with an effective BCM solution that has been regularly tested can recover within a very short time, reducing financial impacts of business interruption and protecting the company’s reputation which can be seen as invaluable to the business in terms of long-term sustainability.