There is no one way to go about business continuity planning. It must be customized for the industry, risks, and evolution of the business.

Caused by a lightning bolt, the blaze in an Albuquerque, New Mexico semiconductor plant burned for just 10 minutes last March. But far away in Scandinavia, the fire touched off a corporate crisis that shifted the balance of power between two of Europe’s biggest electronics companies, both major players in the global electronics industry.”1

Some thirty years ago, mainframe users pioneered the field of Disaster Recovery to protect vital information stored in a company’s computer systems. As computing power was decentralized and began to permeate into all areas of the business, Disaster Recovery evolved into Business Continuity Planning and the protection of data on an enterprise-wide basis.  Both approaches share a primary focus on one aspect of business operations – namely, the transfer, storage, and manipulation of data.

Information technology (IT) is a vital element of business continuity.  But an IT-centric approach does a disservice to industries whose continuity of operations depends on more than data. Manufacturing environments are a good case in point.  The scenario described below involved multi-million dollar losses, loss of market share, and a decision to exit a certain market segment. Yet, no computer systems went down.  There was no inability to access data.  No communications were interrupted.  The disaster came down to a “simple” interruption in the supply chain to a manufacturer.

A small fire in a semiconductor wafer fabrication clean room caused a business continuity challenge for two electronics giants.  Both concerns were in the vulnerable position of relying on a single source to provide a chip critical for the production of their cell phones. One had processes in place that alerted them to a  developing problem of slipping delivery dates, and they were able to avert a complete halt of phone production.  The other ultimately reached a decision to outsource handset manufacturing in part due to the disruption in its third party supply chain as a result of the fire.

Traditional business continuity planning (BCP) methodologies, with their roots in disaster recovery, focus on data center operations and technology.  While every firm’s IT infrastructure is unique, the technologies are fairly standardized, the equipment is fairly uniform, and the solutions are often similar.  All those approaching BCP from this perspective will walk away with a “Plan” that calls for defining objectives, inventorying equipment and applications, and performing some measure of criticality.  From this, data recovery alternatives will be discussed, recovery teams and tasks identified, and relocation plans to an alternate processing location for recovery or continuance of data functions will be determined.

For the bank or the insurance company this may be all that’s needed. But maintaining data functions is not the sole area of criticality in industry, due largely to the drive to streamline operations.  The manufacturing industry, for example, employs a number of efficiency measures that have the effect of concentrating the capital exposed to loss and exaggerating time element loss potentials.  Just-in-time (JIT) inventories, sole sourcing or limited sourcing of supplies, fewer, larger plants, hi-tech automation, downsizing/ right sizing, outsourcing – all add up to increased exposure that often eludes risk managers with IT-centric BCP plans – until losses occur.

BCP is not a one-size-fits-all

IT centered processes, although important, tend to play more of a supporting role in industrial environments. In manufacturing, the ability to resume production in the event of a work interruption or stoppage is what keeps many an operations manager awake at night! Many manufacturers face stiff penalties or loss of business if they fail to deliver their product on time and in the correct quantity. Many will continue to receive shipments of raw materials that cannot be stopped because of purchasing agreements. Many employ large numbers of skilled workers who will of necessity find work elsewhere if the plant is down for a substantial time.

Many plants do not have substantial idle capacity. Therefore, it may not be possible to shift production to a sister plant to “make up” capacity.  Also, many companies have adopted a strategy of “Centers of Excellence” whereby a given plant focuses exclusively on a certain part of the production process. There is no sister plant to which to shift production. Many companies transfer parts back and forth between their plants for various processing operations before final assembly. Loss of the operations in one plant has a ripple effect that impacts all the other plants.

Equally critical as your own operations are those of your suppliers. Many companies, in an effort to reduce costs, have adopted sole source contracts. This strategy, combined with just-in-time delivery, means that a disruption in a critical raw material or component may idle several of your facilities. These internal disruptions will then expand across your organization like the ever-widening ripples formed when a rock gets tossed into a pool of water.

The distribution of your product can cause similar problems. If you ship “just-in-time”, any disruption will cause further disruption downstream to your customers’ operations. You may have contract penalties for late delivery. You may use a few central distribution warehouses. If you lose a warehouse, or are denied access, you may not be able to make up from production to meet your shipping commitments.

In addition to the complex inter-relationships among your supply chain, your production process, and your distribution system, the very nature of manufacturing equipment poses a challenge to developing continuity strategies.  After all, a steel rolling mill can weigh thousands of tons. You cannot easily transport one to an alternate site. You can’t call up and order one today and expect it to arrive tomorrow; in fact, you probably won’t even get it this year. They require millions of dollars of capital investment and take months to build. You are not going to keep one in inventory, nor are you likely to contract with a provider to keep one available for you. The economics of the operation require you to have one, and to operate it near, at, or even above, its originally designed capacity.

The nature of the beast…

Given all this, can you plan for business continuity in a manufacturing environment? Yes you can – but not in the same manner as when planning in an IT-centric environment. You will need to place more emphasis on risk assessment. It’s smarter (and easier) to try and prevent a disaster than to attempt to recover from it.  Many current BCP methodologies forego risk assessment and rush headlong into a business impact analysis.  Focusing on impact regardless of the originating cause may be valid for some environments – but not in manufacturing. The cause of a disaster is extremely important to forming an appropriate response in those instances, for example, where alternate means of production need to be determined.

It is critical to understand where your vulnerabilities lie for it’s never possible to relocate an industrial operation on a moment’s notice.  It is possible, and highly advisable, that you identify which disasters (natural and man-made) are most likely, and from there, map their respective impacts to your continuity of operations.

Further, your risk assessment will need to encompass the business strategy you are employing. Does it make sense to concentrate your production into a Center of Excellence or a sole source supplier, or should you sacrifice short term cost savings for improved corporate survivability?  To answer such questions requires a fundamental understanding of the operations and strategies of your business.  This means that the planning effort must include the active participation of the top levels of management, those who see the “big picture” and set the overall strategy.  It also means that your planning effort must include input and involvement from plant personnel, those who are intimately involved in the every day operations of the business.  Management needs to articulate the corporate strategy and with due speed identify those facilities that are essential to pursuing the successful execution of that strategy.  The identified individual plants, personnel, and processes need to be engaged to determine where threats and vulnerabilities lie within their operations that might prevent attainment of corporate goals.

A word to the wise

There will be those who disagree with the premise of this article.  And there are vendors who claim to have a BCP solution that fits manufacturing as well as service industries.  In our experience, it all too often becomes clear during a capabilities assessment that an IT-centric view comes up short in meeting the needs of an industrial firm.  Be comfortable that your continuity provider has experience in your environment, and avoid getting shoe-horned into a “data-driven” plan.

Continuity planning is essentially an informed business decision about risk.  It is about understanding how much risk you face and in what areas, how much risk exposure you are willing to accept, and how your choices impact overall risk to your organization.  A fundamental understanding of your vulnerabilities and their possible consequences allows you to focus resources on defining and developing continuity solutions germane to your specific business environment.

About the Authors
GE Global Asset ProtectionSM Services business continuity team members contributed to this article.  For more information contact Rob Quaranto, Consultant, GE GAP Services, IRI at 216-241-3493 or email him at [email protected]