Economic Impact of Disaster Recovery Planning on Organizations

Introduction

Understanding the economic impact of failing to have an adequate disaster recovery plan is important because it can help us grasp the financial costs a disaster can impose on an organization. The reason we need to understand economic impact is straightforward: we need to know what is at stake if disaster strikes. Knowing the costs of a disaster to an organization can help us better understand how to prepare a disaster recovery plan and identify the best ways to spend resources to mitigate such an event. Understanding the economic impact of a disaster will therefore enhance both how we plan for a disaster and how we respond to it.

There are many types of disasters that can negatively impact an organization. These range from natural events such as floods, earthquakes, and hurricanes to man-made causes such as loss of data and the capacity to produce. Man-made causes can include "fire, employee sabotage, computer viruses, physical damage (e.g., static electricity or disks crashing) and theft" (Carlson & Parker, 1998, p. 10).

The economic effect of disaster on an organization can be extensive and even potentially devastating. For example, during the 1992 flood in Chicago, organizations and businesses suffered over one billion dollars in damage. Even more significant is the fact that the effects of disasters can persist and impact an organization long after the actual disaster event. Disaster recovery is therefore an essential component of returning to functional and economic viability. As one expert on this subject states:

While the loss of sales during a disaster is harmful, the loss of customers, vendors, inventory and employee records extend recovery times from weeks and months to years. If a company has a well-designed disaster recovery plan (DRP) in place, the plan will minimize the inconvenience of a disaster, while improper planning can result in a company experiencing bankruptcy. (Carlson & Parker, 1998)

The magnitude of this problem is clearly evident from the following quotation from an article by Chisholm (2008) in The CPA Journal:

According to Info-Tech Research Group, almost 60% of North American businesses do not have a disaster recovery plan in place that would resume their information technology (IT) services in case of crisis. The seriousness of this problem is supported by research from Faulkner Information Services, which found that 50% of companies that lose their data due to disasters go out of business within 24 months. (Chisholm, 2008, p. 11)

This quotation not only emphasizes the importance of good disaster recovery planning but also stresses why understanding the economic cost of possible disaster scenarios and engaging in long-term contingency planning is essential. The lack of adequate disaster recovery strategies can lead to serious economic consequences and even to the loss of an entire business as a result of unpreparedness in the face of disaster.

This paper focuses on research into the economic impact of disasters in a way that shows how understanding the economics of a disaster can help us better prepare a disaster recovery plan. The target audience is fellow students and information technology professionals interested in the economic impact of disaster recovery.

Definitions and Key Concepts

A disaster, in the context of this study, can be generally defined as "any interruption in a company's operations that will significantly affect employees and/or customers" (Carlson & Parker, 1998, p. 10). Actual examples include the loss of power to First Chicago Bank in 1987 due to the heaviest rainfall in recorded history at the time, the flooding of the data center of the Robert Bosch Corporation in Charleston, SC, in 1989, and many more recent examples including Hurricane Katrina. However, many of these companies recovered owing to adequate recovery plans.

A sobering statistic that relates to the link between disaster recovery and economic recovery is as follows: "The average company that experiences a computer outage lasting longer than 10 days never fully recovers. Fifty percent go out of business within five years. The chances of experiencing a disaster affecting the corporate data processing center are one in 100" (Murphy, 1991, p. 60).

A disaster recovery plan (DRP) is defined as "the method by which a company identifies critical resources, determines how these resources are negatively impacted by a disaster, and develops a plan to minimize and recover from the negative impact of a disaster" (Carlson & Parker, 1998, p. 10). Another common and wide-ranging definition is as follows:

A disaster recovery plan consists of the precautions taken so that the effects of a disaster will be minimized and the organization will be able to either maintain or quickly resume mission-critical functions. Typically, disaster recovery planning involves an analysis of business processes and continuity needs; it may also include a significant focus on disaster prevention. (Definitions: disaster recovery plan)

A central issue that must be taken into consideration — especially regarding the economic effects of disaster recovery — is that if a business or organization is disrupted for a lengthy period of time, this would seriously affect "the overall viability of a company and may eventually lead to bankruptcy" (Carlson & Parker, 1998, p. 10). It follows that the comprehensiveness of a company's disaster recovery plan has a crucial bearing on the extent to which it can recover from any significant disaster. Consequently, the normative approach is to have a comprehensive DRP strategy that includes the following objectives:

(Carlson & Parker, 1998, p. 10)

A distinction should be made, however, between a continuity plan for disaster recovery and preventative planning for disaster. As Cerullo, McDuffie, and Smith (1994) point out:

A computer contingency plan is classified as a corrective control. It is not designed to prevent or detect various disasters, but rather to limit losses resulting from commonly occurring disasters. Assuming disaster strikes, the presence of a computer contingency plan enables a company to quickly restore its capabilities and to provide services and products for its customers efficiently and effectively. (Cerullo, McDuffie & Smith, 1994, p. 34)

An important additional point made in the above article is that the preparation of such a contingency and recovery plan also motivates the company or organization to assess assets in terms of value and vulnerability. In other words, a good disaster recovery plan will include an evaluation and analysis of assets in terms of both vulnerabilities and potential areas of structural weakness within the organization.

Commentators stress that disaster recovery represents "two vital words in today's security managers' and directors' vocabulary. Nowadays these people can't be without a disaster recovery plan or they may soon be without a job" (Murphy, 1991, p. 60). It should also be noted that there are many different approaches to disaster recovery, and each approach takes into account the type of business or organization and its particular vulnerabilities. For example, some recovery plans attempt to account for every possible disaster scenario or contingency, from earthquakes to vandalism. This may be economically restrictive and time consuming. Others may take a more directed and specific approach, targeting the most common and obvious disaster scenarios in their particular context. The important point to note is that failure to plan adequately for disaster recovery can have severe consequences ranging from temporary loss of data and sales to total financial collapse and legal penalties, depending on the extent of the disaster.

Economic Implications of Inadequate Disaster Planning

The importance of disaster recovery planning is emphasized repeatedly by various experts. As one commentator notes, "Aside from the legal ramifications of neglecting to safeguard vital data, disaster recovery planning is a business necessity. Simply put, business relies on computers more than ever before and will continue to do so" (Murphy, 1991, p. 60). Murphy also states that "It doesn't matter what you call it — automated data processing or management information services — the life of a business or organization is at risk without disaster management" (Murphy, 1991, p. 60). This is of course linked to the dependence on data and databases by almost every modern organization. Other sources reiterate the pervasiveness of modern threats to valuable data:

Failure to identify every potential event that can jeopardize the infrastructure and data that your enterprise depends on — in addition to the security and network threats, viruses, Trojans, worms, etc. — you need to identify any forces that are unique to your geography. Do you live on an earthquake fault, in tornado alley, or in a flood zone? Does your region experience frequent power interruptions from storms or rolling blackouts? (Disaster Recovery Business Continuity: Common Mistakes)

However, it is when one considers the financial and economic implications of a faulty or inadequate disaster response plan that the need for this planning becomes even more evident. On the other hand, the cost of actually implementing a thorough and comprehensive disaster recovery plan also brings into play various criteria that must be taken into consideration. As Bielski (2002) states, "Day-to-day process-related work is hard to back up — much of it isn't digital to begin with. Think of backing up all your e-mails or Word files. How much time would that take? Is it worth it?" (Bielski, 2002).

The economic implications of inadequate disaster planning and management are, on one level, fairly obvious. As noted several times in this discussion, there is a general consensus that any company or organization cannot function when there is data loss or loss of networking functionality, and if this disruption is extended over time it will invariably lead to serious economic consequences.

A serious possibility that can have dire economic consequences is the unplanned outage. "Whether it is a severe weather incident that shuts down a city or region or a simple mistake like kicking a power cord loose causing a server to halt, every business is susceptible to some form of outage or disaster" (Rennels, 2006). Experts state that even a short period of disruption and inability to access data can have severe economic repercussions:

At best one could expect to incur some financial losses and have to smooth things over with some unhappy customers, but at worst, and far too often this is the case, businesses are unable to recover and are forced to close. (Rennels, 2006)

An understanding of the economic implications of a disaster should also include aspects such as a decline in productivity and work stoppages caused by loss of email and communications. The research company Gartner states that "40% of all SMBs will go out of business if they cannot get to their data in the first 24 hours after a crisis" (Rennels, 2006). This statistic becomes even more alarming in light of the prediction that "another 35% are out of business within 3 years" (Rennels, 2006). Furthermore, the amount of lost revenue and productivity tends to increase rapidly when there is no fast and effective recovery planning, and this "does not account for the business and legal implications of lost data that could result in fines and even imprisonment" (Rennels, 2006).

The consequences of not having a disaster recovery plan are therefore extremely serious in the modern world. This fact is underscored by a study conducted by the University of Texas, entitled Financial and Functional Impacts of Computer Outages on Businesses. The following are among the most relevant findings:

(Disaster Recovery — a White Paper)

These findings shed a glaring light on the financial and economic implications of not having a good disaster recovery plan. Conversely, they should motivate organizations and companies to ensure that a well-thought-out and comprehensive plan suited to the assets and particular vulnerabilities of the organization is implemented. This is also reinforced by the finding from the same study that "of companies that experience a disaster but have no tested business recovery plans in place, only one in ten are still in business two years later" (Disaster Recovery — a White Paper).

The link between economics and disaster recovery planning is clearly emphasized in the conclusion of the above study:

Organizations which had prepared for an extended computer outage through insurance and/or a contingency plan reported significantly lower expected loss of revenues, additional costs, and loss of functioning. As a group, these organizations estimated that their revenue losses would be 2.5 times as severe if their contingency plans were not activated. (Disaster Recovery — a White Paper)

On the other hand, organizations that do not have a clear and comprehensive recovery plan will, in the event of disaster, also suffer from various intangible costs in addition to direct revenue loss. These can include "cash flow interruption, loss of customers, loss of competitive edge, erosion of industry image, and reduced market share" (Disaster Recovery — a White Paper).

The implementation of a recovery plan also implies a business continuity plan. However, one should emphasize the difference between these two types of plans. A disaster recovery plan is usually referred to as being specifically targeted at IT systems, whereas a business continuity plan is considered the "all-encompassing corporate plan that describes the processes and procedures an organization puts in place to ensure all aspects of business can resume and be recovered should a disruption occur" (Disaster Recovery — a White Paper).

Conclusion

Many contemporary views of disaster recovery refer to the importance of being more inclusive in the assessment of recovery possibilities. In other words, there is an emphasis on taking more than just pure data into account in the process of planning for the recovery of economic viability. There has been a shift toward thinking that encompasses more than the recovery and protection of computer and data systems. This is based especially on the realization that a serious disaster, or even a prolonged interruption, can destroy a company economically. Coleman (1993) notes that "as PCs, workstations, and local area networks (LANs) have become more prevalent, industry has also begun to realize that data center recovery plans alone are not enough. A comprehensive, corporate-wide approach, known as business recovery planning, is required" (Coleman, 1993, p. 62).

This aspect is also stressed by other commentators who state that "disaster recovery planning involves more than off-site storage or backup processing. Organizations should also develop written, comprehensive disaster recovery plans that address all the critical operations and functions of the business" (Wold). This important point is again emphasized by Carlson and Parker (1998):

The entire company needs to be involved with the DRP process. Upper management needs to provide the strategic direction and financial resources for the DRP. Middle management is responsible for facilitating the coordination and effective execution of the plan. Lower management should understand the need for a DRP and provide insights into plan improvements and efficient execution. (Carlson & Parker, 1998, p. 10)

Coleman (1993) also states that while data recovery is obviously an essential aspect, it is not the only aspect that should be considered (p. 62). This view also relates to the evaluation and assessment of organizational assets and the determination of how the loss of certain assets will impact the company across a number of variables, including the company's legal exposure, revenues, customer service, and other operational considerations (Coleman, 1993, p. 62).

In the final analysis, disaster recovery (DR) planning can be seen as a process rather than merely a technology to apply. It involves "finding the right disaster recovery facility and making sure adequate logistics and communications are set up" as crucial steps (Disaster Recovery Planning and Operations Tutorial).

As noted above, the economic consequences of poor disaster recovery planning are also closely linked to the contemporary model of organizational business — the network-centric computing model. This model places a great deal of emphasis on corporate networks and, in turn, on risk management. Disaster and risk can come from various sources, including "technology failures, staff errors, a disruption in building environmentals, natural disasters or terrorism" (Rappaport, 1993, p. 73). While risk assessment can account for many threats and possibilities, a disaster recovery plan is an essential element of security applicable in the case of unexpected events. In this regard, a recovery strategy "must be defined, and written procedures must be developed. Once recovery procedures have been defined, they can be tested and fine-tuned to ensure the corporation's requirements are achieved" (Rappaport, 1993, p. 73).

The focus of this paper has been on the relationship between economic factors and disaster recovery planning. An understanding of the possible negative economic consequences of poor recovery planning clearly suggests the need for a comprehensive and inclusive disaster recovery plan in any contemporary organization or business.

References

Bielski, L. (2002). Thinking the unthinkable: Often dismissed as mere "insurance," disaster recovery ought to be considered part of the lifeblood of any business. ABA Banking Journal, 94(1), 44+.

Carlson, S. J., & Parker, D. (1998). Disaster recovery planning and accounting information systems. Review of Business, 19(2), 10+.

Cerullo, M. J., McDuffie, R. S., & Smith, L. M. (1994, June). Planning for disaster. The CPA Journal, 64, 34+.

Chisholm, P. (2008, July). Disaster recovery planning is business-critical. The CPA Journal, 78, 11.

Coleman, R. (1993, February). Six steps to disaster recovery. Security Management, 37, 61+.

Companies exposed from inadequate disaster recovery planning, testing. Retrieved from

Definitions: disaster recovery plan. Retrieved from

Disaster recovery — a white paper. Retrieved from

Disaster recovery business continuity: Common mistakes. Retrieved from

Hermanson, D. R., Ivancevich, D. M., & Ivancevich, S. H. (2007, December). Disaster recovery planning: What section 404 audits reveal. The CPA Journal, 77, 60+.

Murphy, J. H. (1991, August). Taking the disaster out of recovery. Security Management, 35, 60+.

Raffo, D. (2009). Disaster recovery planning and operations tutorial. Retrieved from

Rappaport, D. M. (1993, September). Disaster recovery: Toward a robust network environment. Business Communications Review, 23, 78+.

Rennels, B. (2006). White paper: A practical guide to disaster recovery planning — the basics to getting started. Retrieved from

Wold, G. Disaster recovery planning process. Retrieved from