ACTS OF GOD AND MONSTERS
For a company, getting hit by a disaster is bad enough. Not having a plan to deal with it is worse.
By Sethuraman Dinakar

June was a very bad month for Malcolm Hunter, CFO at Nestle Malaysia. Following the discovery of dioxin, a toxic chemical, in Belgian animal feed, the Malaysian government banned all milk products imported from Europe - including Nestle's infant formula. "We received 25,000 calls in ten days," recalls Hunter, who immediately faced a public relations nightmare - a nightmare that threatened to gut the group's 2 billion ringgit (US$525 million) annual sales in Malaysia.

Hunter did not panic, however. Working from a contingency plan devised for just such emergencies, he immediately went into action. First, Hunter opened a direct line of communication with the Malaysian health authorities, answering questions and providing information. Next, his team began obtaining the necessary documentation to prove that Nestle's products were dioxin-free. The Nestle CFO also helped coordinate the recall of tons of Nestle's milk-based products from stores and distributors across Malaysia. At the same time, Hunter rolled out a massive public relations campaign. That campaign included setting up 17 toll-free numbers to help answer consumer questions. In addition, Nestle ran full page advertisements in all Malaysian publications, proclaiming the safety of the company's products.

Within weeks, Hunter says Nestle had weathered the storm. The company's business continuity plan worked so well, in fact, that Nestle Malaysia's group sales dropped just 5 percent to 987.3 million ringgit (US$260 million) for the first half of the year. It could have been much worse. "We would have lost more without a plan," says Hunter, "and we ended up gaining consumer goodwill for being so open."

Few CFOs in Asia are as well prepared as Hunter, however. While a recent survey conducted by technology consultancy Dataquest showed that almost 83 percent of respondents in Asia took business interruptions very seriously or somewhat seriously, the majority of local corporates simply do not have business continuity plans (BCPs). "Their priorities are more immediate, rather than worrying about a yet-to-happen event," says Soon Seong Keat, group financial controller for Hong Leong Industries, a property and financing company in Kuala Lumpur. Indeed, Nestle's plan of attack, laid down in an extensive, group-wide BCP, remains the exception in Asia. Says Nathan Fong, finance and administration director of 20th Century Fox in Hong Kong: "I don't think BCP is even on the radar screen of local CFOs."

Then they need a new screen. Not planning for disaster is, in fact, courting disaster. Make no mistake, bad things happen. In the US, statistics from Contingency Planning Research show that 72 percent of companies each year have business operations interrupted because of power outages; 52 percent experience some sort of telecom failure; and 43 percent have business stoppages touched off by software problems. In fact, the most likely disaster to befall a company is a small one - a power outage that knocks out a network server, an accidental cut in a cable that wipes out the telephone network, a broken sprinkler system that ruins a production facility. None of these disasters will show up on the evening news. All of them can interrupt a business for days, even weeks.

Ghosts in the Machines

Terry Weir, CFO of Bangkok-based Hana Semiconductor, knows a little something about interruptions. In September 1997, Weir was working late at his office when the fire alarm sounded. Startled, Weir was able to get out of the building in time. But as he stood in the night air, he watched helplessly as flames consumed the company's integrated circuit assembly and testing facility. Obviously, the losses could have been greater. There were no fatalities, thankfully, and Hana's insurance covered the cost of the factory - nearly 435 million baht (US$10 million). But as Weir soon learned, the real casualty of the fire was Hana's relationships with clients. The disruption in product flow sent most of them packing. "We lost all our customers and half our business," he explains. Weir says that it took more than a year to win customers back from competitors. He notes the semi-conductor company had no business contingency plan. "We don't believe we can cover every type of event," he explains. "Really, what do we do against a nuclear strike?"

Then again, the chances of a nuclear strike in Thailand seem remote. But experts say the odds of getting hit by other sorts of disasters are high - and getting higher all the time. Surprisingly, technology is partly to blame. As companies look to improve operating efficiencies, they're increasingly turning to the microprocessor. But dependence on an integrated corporate computer network has its downside - mainly, downtime. According to Stratus Computer, every 60 minutes of network down time costs a company at least US$1,000 in diminished worker productivity.

The stakes go up dramatically if a company relies on an ERP system to manage its supply-chain. And network outages become even more painful when a company sells to customers via the Internet. If a minor snag shuts down an on-line business, sales opportunities go a-begging, and buyers find new sellers. "It is a significant competitive issue," says Mike Keynes, Hewlett-Packard's business recovery services head for the Asia Pacific region.

Take the case of eBay, the wildly successful, consumer-to-consumer auction Web site. In June, a snafu with the company's servers - rumored to have been touched off by the software that runs on those servers - knocked the auction site off-line for 39 hours. Remarkably, in that day-and-a-half, eBay reportedly lost US$5 million in revenues, as customers quickly switched over to rival providers like Yahoo. Worse, eBay's share price - the darling of Wall Street - took a header, shedding more than 20 percent of its value in the span of days.

Not surprisingly, IT-recovery services comprise the fastest growing segment of the disaster recovery industry. And in Asia, providers of business continuation services (BCS) report that sales are starting to pick up. According to a recent report by Dataquest, a technology consultancy, BCS vendors should do about US$270 million in business this year. Dataquest forecasts that number will reach US$646 million by 2002 - a near 130 percent increase.

Still, that's nowhere near the kind of revenues that ERP companies or e-commerce vendors rake in. What's more, much of the jump in BCS business in Asia stems from corporate concerns about the millennium bug. In fact, some risk managers and CFOs say that the year 2000 problem - and the corporate hysteria it has touched off - may actually turn out to be a digital blessing in disguise. They say that Y2K has finally focused the corporate spotlight in Asia on contingency planning - at least until January 1, anyway. Says Keat: "Large Malaysian companies are now aware of disaster planning because of Y2K. It has alerted us to what a disaster can do."

Kan Plan

Risk managers at multinational corporations are doing their fair share of alerting as well. Business contingency planning is standard operating procedure for finance executives at most US and European companies. Many global companies are now trying to convince managers at local divisions, as well as suppliers, to draw up business contingency plans. The arm-twisting makes sense. A fire at a vendor in Penang could damage a company's entire supply chain. That, in turn, could hamstring a corporation's ability to manage inventory and deliver products on time - a disaster in this age of just-in-time manufacturing and instant consumer gratification.

Managers at Siemens are not waiting for lightning to strike. The German electronics and telecommunications giant has rolled out extensive business contingency plans at a number of its cross-border subsidiaries. At its Indian operation, for example, the recovery scheme aims to get 70 percent of the subsidiary's business up-and-running a mere 24 hours after a disaster strikes. The plan calls for business to be back to normal within four days of an interruption. Siemens' corporate managers also review the BCP every month. Further, three employees in the IT department fill out a form at the end of each day, reporting on the company's disaster preparedness.

Not every company has the resources to fashion a business contingency plan as extensive as Siemens'. Indeed, vendors of BCP services point out that generating a workable plan is neither a week's exercise nor a one-shot assignment. The process can take up to a year, and experts say it demands the attention of a company's most senior executives. Michael Kan, CFO of the Singapore division of UK-based British American Tobacco (BAT) understands this. Prodded by his auditors and bosses in the UK, Kan recently drafted a thick book on business continuity. The book is part of a worldwide business continuity review BAT is currently conducting. Kan says his overall contingency plan is looked at every six months, and revised if necessary. It is also subject to a comprehensive audit every year.

To keep the BCP up-to-date, Kan says a team of managers from various departments devotes several hundred man-hours a year to simulate scenarios and update the plan. While BAT hasn't had a disaster in years in Singapore, Kan says: "We can't wait for a helicopter to hit our factory before we write a plan."

Operate Manually

While preparing for calamity can save a company millions in the long run, it can also be expensive. Officials at India's National Stock Exchange spent more than US$10 million to set up a disaster recovery site that replicates the exchange's back-room functions. "A disaster management plan can be an expensive, time-consuming affair," concedes Nathaniel Forbes, owner of Singapore-based Forbes Calamity Prevention.

That, in turn, tends to put local managers off. Says Hong Leong's Keat:, "Asians tend to be pragmatic," he explains. "If the cost-benefit ratio is not right they tend to take the risks on board." In fact, Keat sees no real need for a business continuity plan at many companies in the region. "Many small businesses don't even have computers," he points out. "They still run their operations manually." Those that do have IT networks don't often see the need for an elaborate disaster recovery plan. Adds Gerard Tan Wee Seng, partner and BCP specialist at PricewaterhouseCoopers: "Asian companies have no competence with corporate-wide disasters. Most only have software recovery plans."

If that. In Thailand, Hana Semiconductor has fully recovered from its fire. CFO Weir now works in a brand new office in a brand new building. Sales are on the rise again, too. But remarkably, despite the fire - and the subsequent loss of revenues and customers - Weir says he still has no disaster recovery strategy, no business continuity plan. "You don't think it will ever happen to you, do you?" he asks.

It did once.

Sethuraman Dinakar is CFO Asia's Singapore bureau chief.