e martë prill 18, 2006

Is there an ROI on earthquake preparation?

Today is the 100th anniversary of the Great San Francisco Earthquake. The media hoopla is reminding those of us in Silicon Valley, and in the broader Bay Area, of the need to make preparations for the Big One. At home, I'm finally putting together a formal earthquake kit. I know this makes sense because just a little preparation could make a big difference as to how well my family survives a major quake and its aftermath. I don't need to do the math to know that the value of my family's survival is so high that that value times the probability of a quake would far exceed the cost of a first-aid kit, some cans of baked beans, the can opener that I mustn't forget, and jugs of water. For me, there's definitely a positive expected ROI.

For companies, though, calculating the expected ROI on earthquake preparation is not so easy. In their deliberations, companies have to consider -- in addition to the cost of preparation and the likelihood of a big quake, -- what the value of their company will be after the quake. Will it realistically be enough to justify investing money, time, and effort today in creating a Business Continuity Plan (BCP) to improve the chances of survival tomorrow? Is the expected ROI on BCP positive? The answer depends largely on how dependent the company is on the Bay Area.

On the one extreme are companies with only upper management in the Bay Area and with operations, customers, and vendors elsewhere. Their value will not be hurt much in the event of a quake so the relatively low cost of BCP's to assure that management can stay in contact with operations should have a positive expected ROI.

At the other extreme are companies with operations, vendors and customers heavily dependent on the Bay Area. Their economic ecosystem is going to be so disrupted by a quake that no matter how well they prepare, survival is doubtful. The cost of a BCP, likely to be an expensive proposition given the amount of operations in the Bay Area, would have a negative expected ROI.

Most companies, though, fall between these two extremes. Sun, with its globally-dispersed operations, international supply-chain, and worldwide customer-base is pretty close to the “it makes sense to BCP” extreme. I'm not sure, though, how far down the continuum between the two extremes is the dividing line between those for whom “it makes sense to BCP” and those for whom “it does not make sense to BCP”. I suspect companies on both sides of the line are acting in ways that are not rational for themselves and/or not best for the public, and this creates some troubling concerns – particularly as they relate to Silicon Valley companies and the future of technology.

My first concern is that the “bet the farm” business style of Silicon Valley results in companies not putting enough effort into creating BCP's even if rationally they should because their BCP would have a positive expected ROI. While many companies talk about the importance of creating BCP's, the lack of standards in Business Continuity Planning, a field that is still relatively new with little real after-disaster experience, makes it difficult to know whether the proper level of time, money and effort is being expended. Realistically speaking, when confronted with the need to show quarterly results, it is always tempting to forego efforts that might not pay off for many years.

My second concern is the corollary of my first. While some companies may not be putting enough effort into BCP's when they should, my second concern is about companies putting in effort when they shouldn't. Spending money on things like duplicating facilities and taking management time on developing, presenting, and approving plans are drains on company resources and the economy at-large. Are companies seriously debating whether developing a BCP makes sense? I doubt it, and it's probably politically-incorrect to even suggest that a debate is worthwhile. People often see BCP as a life-safety issue, which it isn't. The effort required to save lives in the event of an earthquake is very different from that required to assure the continuity of a business enterprise. If a BCP doesn't have a positive expected ROI, it should not be pursued.

My third concern arises, not from the perspective of the company, but rather from the perspective of the public. Where companies are acting rationally and not pursuing BCP where the expected ROI is negative, their decisions may not be serving the public well. The life blood of the tech sector, and Silicon Valley in particular, rests on a lot of small, entrepreneurial companies creating, developing, and market-testing new ideas that find their way to market via the larger companies that acquire them. These local, small companies are exactly the types of companies for whom “it does not make sense to BCP”. Most are on the edge of survival already and can't afford the time and resources to create BCP's for some possible future event. Yet, if these companies were to go under after a quake, the Silicon Valley food chain would be disrupted for many years, and the advance of technological innovation upon which the public good depends would be significantly slowed.

Are there any solutions? My first two concerns – that corporate managers are not always making rational choices as to whether to invest in BCP's -- need to be addressed by the growing “BCP industry”. The consultants, contractors, and corporate managers involved in the BCP movement have been great at proselytizing the need for BCP's, raising awareness, defining risks and proposing mitigation strategies, Now, though, is time to move beyond advocacy. They need to introduce financial discipline to BCP thinking so they can become decision-facilitators. The path from proselytizer to decision-facilitator is one that other industries, like environmentalism, have also followed in order to have impact.

The third of my concerns requires some new thinking. Rational corporate decisions that are not necessarily best for the public are common in capitalism, and require intervention to protect the public interest. I have no idea, though, what such intervention might look like for this situation. I certainly don't see any government role, but maybe there's a role for the larger Silicon Valley companies. They could take smaller ones under their wings and help protect them by including them in their BCP's. Or maybe they could fund an organization that, in turn, funds BCP's for the smaller companies. These ideas are, admittedly, a bit idealistic, but perhaps they can prompt the creation of some better ones.

In the meantime, we all should do those things that obviously have positive ROI. Let's make preparations to protect our families, the lives of others, and the Bay Area institutions upon which our lives depend. In the corporate world, let's make BCP part of every day decision-making and take all the little easy steps first. Let's not forget, for example, that everytime a Silicon Valley company hires a person here instead of elsewhere the company's earthquake risk increases. Let's take the easy steps one at a time so that we might be able to avoid the large steps needed once a company becomes too Bay Area dependent. For the companies that are already very Bay Area dependent, let's evaluate critically how much should be invested in BCP. Let's not get too caught up in the warnings accompanying the San Francisco Earthquake centennial. Let's try to make personal and corporate decisions rationally. And as a public, let's extend the discussion about earthquake preparation beyond bridges and aqueducts and start talking about how we can protect the economic ecology of Silicon Valley and the advancement of technology.