Company Critical Elements
Business Continuity is a vibrant industry dedicated to identifying, prioritizing and safeguarding critical business functions. From small businesses such as neighborhood bakeries to business titans such as Microsoft, each entity that can name, rate and guarantee the continued functionality of its required systems can survive in crisis. As the following analysis shows, the critical processes of all modern businesses fall into common basic categories that are vital to survival.
The Bakery
A bakery has several critical functions, some common to all businesses and some unique. "Agility Recovery" generally identifies "business critical functions" as those that: "(1) are most sensitive to downtime; (2) fulfill legal or financial obligations to maintain cash flow; (3) play a key role in maintaining your business' market share and reputation; (4) safeguard an irreplaceable asset" (Agility Recovery, 2010, p. 1). Simplifying the process somewhat for small businesses, CSO defines critical areas as those "that, in their absence, prevent your business from earning income" (Smith, 2011). Despite the simplified explanation, to categorize business functions as critical or non-critical, the bakery's management must examine each function, asking: what objective/goal it supports; how often it occurs; how many departments perform it; whether relies on other functions; whether other functions rely on it; whether there is potential revenue loss if it is not completed; whether there is potential for fines, lawsuits or other punishment for failing to fulfill regulatory requirements; whether noncompliance with regulatory requirements is tied to a specific downtime; whether it directly impacts the bakery's image or share of the market; what priority ranking it should receive compared to the bakery's other functions (Agility Recovery, 2010, p. 2). While processes analysis can clearly be a laborious process, there is an added benefit in that a company may not only identify but also re-evaluate current business activities, possibly deciding to improve some while eliminating others and thus possibly "creating a more efficient and profitable operation" (Anderson, 2011).
Though there are numerous methods for identifying and prioritizing business functions, assigning numeric values based on each function's Time Before Impact, Customer Impact, Regulatory Impact and Financial Impact, then assigning a related alphabetic Sensitivity Code to the numeric total allows management to identify the most critical business functions (Okolita, 2009, pp. 1-3). Somewhat modifying Okolita's rating system to accommodate the unique setup of a bakery (Yusop, 2010), the business functions are graded and assigned a sensitivity code as shown in Table 1 and the Rating Total/Sensitivity Code Key on the 2 following pages:
Table 1
A
B
C
D
E
F
G
H
I
Function Area
Function Name
Risk Code
F = Financial
C = Customer
R = Regulatory
Time Before Impact
0 = week 2/more
1 = week 1
5 = up to 3 days
10 = day 1
20 = 4 hours
40 = immediate
Customer Impact
0 = None
1 = Low
3 = Med
5 = High
Regulatory Impact
0 = None
1 = Low
3 = Med
5 = High
Financial
Impact
0 = None
1 = Low
3 = Med
5 = High
Rating Total
Sum of D - G
Recovery Time Sensitivity Code
Finance
Banking
F
10
3
1
3
17
A
Production
Order Supplies
F
5
3
0
3
11
B
Production
Baking + personnel
F + C
40
5
0
5
50
AAA
Customer Service
In-store order + personnel
F + C
40
5
0
5
50
AAA
Customer Service
Online order + personnel
F + C
40
5
0
5
50
AAA
Customer Service
Phone order + personnel
F + C
40
5
0
5
50
AAA
Distribution
Maintain inventory
F + C
5
3
0
3
11
B
Distribution
Delivery vehicles + personnel
F + C
40
5
0
5
50
AAA
Finance
Payroll
F + R
1
0
5
5
11
B
Legal
Required filing
F + R
0
0
5
3
8
C
Production
Baking equipment
F + C
40
5
0
5
50
AAA
Production
Refrigeration equipment
F + C + R
40
5
5
5
55
AAA
Information Technology
Computers
F + C + R
40
5
5
5
55
AAA
Production
Building Maintenance
F + C + R
40
5
5
5
55
AAA
Production
Utilities
F + C + R
40
3).
Please see Rating Total/Sensitivity Code Key on following page
Rating Total/Sensitivity Code Key
45 or more = AAA (Immediate Recovery). Must be performed in at least two dispersed locations that are fully equipped and staffed.
25 to 44 = AA (Up to 4 Hours to Recover). Must have a viable alternate site that can be staffed and functioning within 4 hours.
15 to 24 = A (Same Day Recovery). Must be operational the same business day; therefore needs viable alternate site that can be staffed and functioning within the same business day.
10 to 14 = B (Up to 3 days)
Can be suspended for up to 3 business days, but must have a viable alternate site that can be staffed and functioning by the fourth business day.
7 to 10 = C (Week 1)
Can be suspended for up to a week, but must have a viable alternate site that can be staffed and functioning the second week following an interruption.
0 to 6 = D (Week 2 or greater downtime allowable)
Can be suspended for greater than one week, though a maximum number of days should be identified for this functionality of business functions (Okolita, 2009, p. 3).
As the accompanying Rating Total/Sensitivity Code Key shows, business functions are categorized under basic Function Areas and given numerical codes of: 0 -- 40 under Time Before Impact; 0 -- 5 under Customer Impact; 0 -- 5 under Regulatory Impact; 0 -- 5 under Financial Impact. A business functions total score is then tallied and assigned a Recovery Time Sensitivity Code: AAA, requiring immediate recovery, for a score of 45 or more; AA, requiring recovery in up to 4 hours, for a score of 25 -- 44; A, requiring same-day recovery, for a score of 15 -- 24; B, allowing up to 3 days for recovery, for a score of 120 -- 14; C, allowing 1 week for recovery, for a score of 7 -- 10; and D, allowing more than a week for recovery, based on a score of 0 -- 6 (Okolita, 2009). Assessing the bakery's critical functions per the analysis in Table 1:
1. Baking is a critical function of the bakery, having high scores in Time Before Impact (40), Customer Impact (5) and Financial Impact (5), though a low score regarding Regulatory Impact (0), totaling 50 and therefore receiving an AAA Sensitivity Code;
2. Order taking in-person, online and by phone, and the personnel needed to perform those tasks, all receive AAA Sensitivity Codes, as all they receive the highest impact numbers for Time Before Impact (40), Customer Impact (5) and Financial Impact (5), earning Rating Totals of 50 each;
3. Deliveries and Delivery Personnel also receive the AAA Sensitivity Code indicating a critical function due to the highest code for Time Before Impact (40), Customer Impact (5) and Financial Impact (5), totaling 50 on the Rating Total and therefore the highest possible Sensitivity rating;
4. The Baking Equipment, necessary for performing the essential function of Baking also receives an AAA Sensitivity Code, as it is vital to perform another AAA Sensitivity Code business function;
5. Refrigeration Equipment is also a critical function, not only for Time Before Impact (40), Customer Impact (5) and Financial Impact (5) but also for compliance with health regulations regarding refrigeration of some ingredients, (such as milk, eggs and butter), for the preparation of products and also for storage of some finished baked goods for sale to the public. Consequently, Refrigeration Equipment receives the highest possible Rating Total of 55 and receives the Sensitivity Code of AAA;
6. Computers also receive the highest Rating Total (55) because they are necessary for proper machinery functions, for taking some orders, for inventory records and for data entry and maintenance required for the bakery's legal filings. Due to those factors, Computers are critical to the bakery and receive the AAA Sensitivity Code;
7. Building Maintenance affects all 3 Finance, Customer and Regulatory areas of business and is also critical to the bakery. In order to bake, take orders, refrigerate, keep inventory and hand the baked goods to customers, the bakery must maintain the building in which those functions are performed. Consequently, Building Maintenance receives a 40 for Time Before Impact, a 5 for Customer Impact, a 5 for Regulatory Impact, a 5 for Financial Impact, a total rating of 55 and an AAA Sensitivity Rating;
8. Utilities, which support the critically important building and all the functions within it, also receive the highest possible ratings in all categories of Time Before Impact, Customer Impact, Regulatory Impact and Financial Impact and the highest possible Sensitivity Rating of AAA.
In contrast to critical functions, all of which received AAA Sensitivity Ratings, the Legal Filing business function, fulfilling federal, state and local requirements, received a zero for Time Before Impact because that is not immediately required to keep the bakery operational. Legal Filing also received a zero for Customer Impact because the failure to file paperwork has little or no immediate impact on customers. The highest rating (5) was given under Regulatory Impact because the failure to file required paperwork would have an impact on the bakery's business. Finally, the cessation or delay of Legal Filing will have a possible Financial Impact on the bakery, subjecting it to possible fines and administrative fees; however, a moderate "3" rating is warranted because the failure to file would not be a willful failure; rather it will be unavoidable and explainable due to crisis or disaster. Other normal business functions which rated lower-than-critical ratings are: Banking, which received an A rating and should be brought back to functioning the same business day; Ordering Supplies, which received a B. Sensitivity Rating and can be suspended for up to 3 days; Maintaining Inventory, which received a B. And can be suspended for up to 3 days. The designation of the listed functions as critical or less-than-critical due…
