Over the past decade, many companies have realized the importance of having a comprehensive crisis management strategy in place for when the unexpected happens. Whether it's a server problem, a public relations problem or a life-and-death disaster, how nimbly an organization responds to a crisis can have lasting impact on its business. Dr. Lisa Reshaur, recently recognized as Consultant of the Year in Business Continuity and Disaster Recovery by DRI International, is a Director with PwC's Risk Consulting Services practice. She spends much of her time focusing on Risk Resiliency and Business Continuity Management, and says companies with good risk strategies are best suited to stop a minor problem from escalating to a crisis, and to recover when a crisis does occur. She shared with us some of her insights with Consulting's One on One about the trends opportunities of the business continuity market.
Consulting: What does the recognition you've recently received mean to you?
Reshaur: I was very honored, particularly for the fact that it was clients who nominated me and my peers would see that I'm having such a good influence in the Business Continuity Space, which was really exciting. When you're in client service the best compliment you can get is clients and peers thinking you're pushing the envelope within your space.
Consulting: What are some continuity challenges clients are facing these days?
Reshaur : Business continuity really started back when people started using mainframes. It became really popular in the 1990s around disaster recovery—how do we keep the technology up and running now that we're increasingly more dependent on it? We're seeing that a lot of organizations haven't necessarily kept current as the technology changed, so we're finding more and more clients wanting to talk about that space. What we're finding is companies do really well with the day-to-day issues: the server went down, I'm having some sort of reputational problem but it's something we handle day to day. When the earthquake hits or the tsunami comes, they know they're in a crisis there. It's the middle-type events that I think a lot of companies are trying to figure out. "When do I go from a minor incident to a crisis?" There's middle-level events, one of my clients calls it "muddling in the middle". It's events with a slower onset that could become crises if you're not handling them properly.
Consulting: Can you provide a recent example?
Reshaur : Well, the Icelandic volcano a few years ago, people thought, "it's Iceland what do we need to worry about?" Then all of a sudden nobody could travel anywhere in Europe. There were situations in companies where they couldn't move goods around, one client was trying to move goods back to the U.S. that had to be there for a specific date, I had other clients who had people over in Europe who randomly started getting on boats, planes and trains and going to other countries where they didn't have visas to get in.
Consulting: What are some areas clients are focusing on in light of recent high-profile disasters?
Reshaur: Typically what we look as a basis for business continuity management is loss of building, loss of system, loss of people or loss of key third parties. As we all become more globally focused and more integrated with our service providers, really focusing on what the vendors have. The Japanese Tsunami pointed to this again. Ten years ago I was asked by a client where do you see the future of business continuity? I said based on what we learned on 9/11, there should be more focus on your key third parties, and we think that's going to happen. Ten years later we hadn't really done all that much in the field with that, and then Japan came, and all of a sudden became an exponentially worse problem. In 10 years people have created these spider webs of networks within business so you depend on these companies. You're finding you had a key vendor in the tsunami zone, or cant reach a key vendor in Tokyo because communication systems are overloaded.
Consulting: What's the solution?
Reshaur: A lot of organizations are starting to look not only at that first line of key vendors, but also who those vendors are depending on. Look for the single-source vendors that may be 3-4 levels down that are the only supplier of a certain widget that has to go inside every single airplane and they supply everybody in the industry. Understanding where risk lies within the supply chain, we've got to really expand our understanding from a resiliency perspective and I'd almost argue from a complete risk and compliance perspective. It used to be you'd call up your key vendor "Do you have a plan?" "Yep, we have a plan." great, check the box. Now we're building it into the contracts what we require from you for recovery, we're going to ask for an audit report and test with you when we do our testing. So it's really taking what was a very internally focused continuity program and making sure we're really looking at it more broadly.
© Arc, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.