ArcUser Online

Building Business Continuity Plans
By Johan Herrlin, Esri

Editor's note: The attacks on the World Trade Center in New York on September 11, 2001, vividly demonstrated that business losses from disasters are not limited to buildings and inventory. Losses attributed to business interruptions produced by disasters are significant and can be long lasting. According to Risk Management Solutions, the cost of business interruption for the World Trade Center attacks represents 25 percent of the total losses, estimated at between $35 billion and $70 billion.

Figure 1: This model takes into account not only proximity to key employees but also proximity to major roads and existing customers when determining meeting points.

One in five businesses experience a major business disruption each year. Disruptions can be caused by power outages, internal flooding, weather events, fire, terrorism, crime, or transportation problems. Many businesses, concerned about surviving the effects of a major disruption, have started preparing contingency—Business Continuity Plans (BCPs)—for these events.

The Business Continuity Institute defines a BCP as a "holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience with the capacity for an effective response that safeguards the interests of key stakeholders, reputation, brand, and value creating activities." Having a BCP in place enables a business to mitigate risks that disruptions pose in such areas as health and safety liability, loss of productivity from downtime, loss of work to competitors, failures within the supply chain, and higher insurance rates.

BCPs have many geographic aspects, and GIS has been recognized as a powerful tool for developing effective BCPs. GIS helps businesses develop BCPs by addressing the following issues:

• Facilities management
• Employee (and family) notification
• Incident mapping
• Weather mapping
• Office relocation
• Evacuation
• Threat assessment
• Supply chain assessment

Figure 2: This model geocodes the address of the building in question, buffers that location by one-quarter mile, clips a business location dataset containing the area's daytime population by business address, and runs the Hot/Cold Spot Analysis tool to find statistically significant hot and cold spots for building employees.

GIS is particularly well suited to BCP applications because of its inherent ability to integrate disparate data sources. Because a fundamental part of creating a BCP is determining the location of a company's assets, even the most basic GIS application adds value to a standard BCP. Simply geocoding assets lets BCP analysts evaluate assets in relation to potential disruptions in ways that are not possible with text or tabular representations of the same data.

GIS can provide a snapshot that shows where assets and employees are located. Using GIS to model what-if scenarios can capture the infrastructure, business processes, and locations of an organization in a meaningful way. Through GIS-based dashboard type applications, managers can quickly obtain a high-level overview of a situation and understand what needs to be done to reestablish critical business functions in the event of a disruption.

ArcGIS 9 introduces a new geoprocessing framework that lets users capture work flows and automate common tasks. It also provides a new geoprocessing toolset that contains statistical tools specially designed to work with spatial data. With these tools, analysts can compare features and geographic distributions and can model geographic relationships that will help develop more effective BCPs. Relocation and evacuation meeting points are two of many analyses needed when formulating BCPs.

Relocating Operations

Every BCP must address the relocation of personnel, operations, and assets. In some industries, such as financial services, specific rules govern what must be included in a BCP. For instance, the New York Stock Exchange Rule 446 mandates that companies must have a written plan, updated annually, for relocating operations in the event of an emergency.

Relocation analysis is similar to a familiar and commonly used task in GIS: site selection. However, BCP analysts incorporate factors not usually considered in traditional site selection applications such as identifying the locations of the company's most critical employees from a day-to-day operations perspective and determining a temporary operations site that is accessible and optimal in relation to these employees. BCP analysts are interested in mitigating risks. Consequently, part of relocation analysis should also address potential threats such as proximity to terrorism targets.

Continued on page 2