Rolling Out Business Continuity Planning to Manufacturing Environments
There is no doubt the business continuity and disaster recovery field cut its teeth in the technology world, principally in white collar environments. Banks and other financial institutions have led the way, and more recently insurance companies, call centers, and outsourcers have participated in business continuity planning in far greater numbers than the manufacturing sector. While there are many reasons for this state of the union, the fact remains that continuity planning in manufacturing operations remains critical, and will receive more attention than it has in the past. Customer mandates around contingency planning, like those found in ISO/TS 16949 for automotive suppliers, continue to grow, and the continued reliance on just in time (JIT) inventory to some extent in most manufacturing environments means that margins for error will remain microscopic. This article will highlight three areas manufacturers should consider that differ from their white collar brethren.
Establishing A BCP Standard
There is nothing unique in the need to determine the desired level of preparedness for manufacturers, but there is a key difference. In most instances, manufacturers do not have regulators providing direct guidance to them regarding acceptable levels of continuity planning. For all the challenges surrounding business continuity compliance in a regulated industry, it does provide a concrete target for which an organization can aim. A manufacturer's requirement for business continuity is more driven by "reasonableness" than regulation. Even when a mandate is created as in ISO/TS 16949, it is frequently phrased as an open-ended requirement rather than a prescription. The Department of Homeland Security and the 9/11 Commission have helped manufacturers by designating the National Fire Protection Association's 1600 standard as the National Preparedness Standard. This document is only three pages long and written in plain English. Its requirements are far more modest than those in the financial services industry and it serves as an excellent guide for a manufacturers. Still, every organization must customize their approach to BC management to their own organization. For example, the National Preparedness Standard indicates an entity must test its plans on a periodic basis, but it is up to the individual entity to choose the type(s) of tests, the frequency, who must participate, and how testing of various plans is integrated.
It is important that people who will have to execute the business continuity plan during an interruption are involved in developing the standard. Creating a team of cross-functional managers who can gauge the reasonableness or business continuity requirements is important for the plan's long-term success, and by ensuring the team's participation in developing the requirement, you will also secure their commitment to fulfill it.
Working with Customers
Manufacturers have a unique opportunity to partner with their customers in the development of business continuity management programs. Many manufacturers are already including questions about BCM in requests for proposals and supplier quality audits, providing tier 2 and 3 manufacturers the opportunity to ask specific questions around the customer's expectation for BCM. Since most customers with these requirements are trying to protect their own manufacturing supply chains, they are far more open to the practical issues facing manufacturing continuity. Some areas are prime opportunities to coordinate with customers in the early development and ongoing maintenance of a business continuity program.
Recovery Time Objectives-Of course, some level of business impact analysis is always necessary to determine how bad the operational, financial, and human impacts are over time and the resources necessary for recovery, but one key source of information can be your own customer. Engaging in a dialogue with major customers about recovery time objectives for specific products is a wonderful way to establish goals for your program. Recovery Strategies-There really are only three variations of recovery strategies for manufacturers: (1) delaying the time for the impact to be felt through some type of inventory controls; (2) expediting partial recovery of production or developing a slightly modified product; and (3) expediting complete recovery. Because reconstituting an entire manufacturing site generally takes many months or even years, options 1 and 2 are the most logical path to pursue. In many cases, customers have an ability to alter the way they do business in order to provide more options for recovery strategies. For example, many customers perform their own quality testing of whole lots or samples on incoming product, even if quality testing is done before products leave the supplier. A reasonable strategy to recover plant-level testing and quality processes can be to work with the customer to provide manpower at their location to augment the current testing regime.
In areas where customers are Designing and producing prototypes, it is possible to work together to create a similar strategy for recovery of production. It's important to note that in most cases the combined unit will not function at 100 percent capacity quickly, but by working together you will be able to estimate the actual throughput and the customer can build those assumptions into their own business continuity planning. It is also possible that a customer can accept a slightly modified product if it can be produced more quickly than the original specification. This is especially true when the product is sole sourced, has a long lead time, or is in rare supply. One high-profile example was a semiconductor manufacturer whose 10-minute fire resulted in a major disaster for its two largest customers. In that case, one customer saw the problem before the other and worked with the supplier to redesign an acceptable product to ensure continuity of their operations. It is important to note, however, that product redesigns carry with them the risk of decreased quality, increased warranty exposure, and potential product liability issues. Showing initiative with customers will serve to limit these exposures and make any produce redesign effort more efficient as well.
Regulatory Oversight and Permitting
One area that manufacturers can easily overlook in continuity planning is the regulatory environment under which they operate. This is especially true in situations where IT or another corporate function owns responsibility for business continuity. Most manufacturers operate under local, state, or federal permits that require operations to function in a certain way. There is not time in one article to highlight all of these areas, but one of the most high- profile permitting areas involves compliance with environmental regulations. Environmental pollutants are not only used in the manufacturing process, but also are frequently involved in finished products and even packaging. The Clean Air Act and other requirements mean that manufacturers cannot simply resume operations in another location with out establishing the proper safeguards and pollution controls. In fact, the common assumption in the continuity community that excess capacity at a sister plant can be used is often false, because additional throughput at the sister facility may push the company over the pollutant threshold established by The Clean Air Act and other laws. Title III of the Superfund Amendments and Reauthorization Act (SARA) establishes requirements for Companies regarding reporting hazardous and toxic chemicals. The law requires companies to report the presence of various chemicals over certain thresholds to the county emergency management agency which is subject to public disclosure. Transferring manufacturing operations without considering SARA issues could mean a government forced closure of the alternate facility as well as the site of the interruption-leaving the company in double jeopardy for production of its product.
State and local laws, as well as federal laws governing intellectual property, interstate commerce, and customs are vast. In New Orleans, one of the first requests from businesses wishing to rebuild was the temporary suspension of many regulatory requirements that would make it difficult to resume operations in a timely fashion. These laws can make it difficult both to transfer production to another facility and to restart production in a less than pristine environment at the disaster site.
What to Do?
Recovering technology in a manufacturing company is important, but many times the heavy lifting is in actually recovering the plant operations. The organization's BCM steering committee should clearly identify its expectations for plant management to plan for business interruptions. This standard will not only provide a target for plant management, but will serve to undermine the frequent fatalism that "if we lost the plant we'd be out of business anyway." The standard will also demonstrate the need for risk mitigation activities where continuity solutions are difficult. Open a dialogue with customers about continuity planning. If you do not address it now, their expectations will likely remain higher than your ability to deliver in an interruption and it could cost your organization a client or worse. In the case of the semiconductor manufacturer cited earlier, the customer that did not respond well lost $500 million in product sales, while the customer who managed the interruption actually gained market share. This is an important issue that if managed well, can become a competitive advantage.
As you look at critical resources in a manufacturing environment, don't overlook those non-BCM regulatory requirements that are a cost of doing business. The loss of one pollution control device could shut down a plant or risk millions of dollars of fines and clean-up costs. Failure to recognize regulatory and permit issues in a possible recovery location could leave your organization totally unrecoverable after a disaster.
Michael Keating is an associate director with Protiviti, a global independent risk consulting firm. He is responsible for assisting clients develop and mature business continuity programs in much of the country.