One of the recurring questions in the area of preparedness planning is: Do efforts to prepare for recoverability have a return on investment (ROI)? Overall, proffered answers can be put into six different categories1:
- Zero ROI: Preparation has no value for the organization. Organizations survive because of culture, individual responsibility, strategic planning, and other factors not related to preparedness; recoverability planning is irrelevant.
- Insurance ROI: Preparedness is the same as insurance – it is a sunk cost and is only there to protect the organization in case of disaster; it does not have an ROI per se.
- IT ROI: The real value of preparing to recover is in its synthesis with production IT; by providing information about business owners’ requirements for IT, preparedness helps inform IT on how best to allocate resources and spend money.
- Risk Mitigation ROI: Preparation efforts are only best served as an arm of Enterprise Risk Management to identify, quantify, evaluate, and mitigate risk.
- Qualitative ROI: Preparedness efforts provide intangible, secondary benefits during the planning process, such as increased: alignment with business goals, credibility, customer service and loyalty, and quality improvements.
- Quantitative ROI: There can be an actual dollar value to each dollar spent on preparedness.
Which one of these six positions is correct? A potential solution to the problem comes with the use of a conceptual model of preparedness and recoverability.
The RPC Model of Organizational Recoverability2 states that three factors are needed for a service, unit, or organization to recover from a physical or staffing loss:
- Resources: Physical assets required to provide services.
- Procedures: Methods, practices, and instructions for taking action to recover services.
- Competencies: Characteristics allowing individuals to function throughout recovery.
Naturally, each of these three factors can be broken down into its constitutional elements. Several different tiers of elements exist; a diagram of RPC factors at the second tier might look like this:
The precise details and constituent elements of the model are immaterial for the purposes of this discussion on ROI. The model simply provides a way to categorize investments in preparedness. What is important is that this model, or one like it, can offer a solution. The model suggests:
“Investments in RPC factors which also directly or indirectly benefit operational services will have an ROI; investments in RPC factors which do not directly or indirectly benefit operational services will have no ROI,”
where R is resources, P is procedures, C is competencies, and operational services are those existing processes, functions, or services that support the core mission of the unit, area, or organization.
Efforts to prepare to recover from physical or staffing losses will be focused on ensuring that: resources are available at time of incident, people are immediately aware of proper response and recovery procedures, and critical competencies have been internalized. If these preparations benefit existing, front-line, operational services, then they will have a return on investment. If they are of benefit only at time of incident, then they are a “sunk cost,” like insurance, with no proper ROI.
Let us consider three brief and simple examples:
- The IT division purchases a new VM server (resources) for disaster recovery.
a. If IT finds a way to utilize the server in the production environment while still making it available for DR, e.g., providing data warehousing services, then there is an ROI.
b. If the server provides no help other than to be available at time of incident, then there is no ROI.
- The facilities division creates new procedures (procedures) to quickly send messages, record outgoing voicemail, and post web site information.
a. If these procedures are used to improve daily services, e.g., enhanced web site design and high quality customer interactions, then there is an ROI.
b. If these procedures are only used at time of incident, then there is no ROI.
- The payroll division undergoes leadership training (competencies).
a. If the training enhances the staff members’ ability to perform their jobs, then there is an ROI.
b. If the training is only useful during an incident, then there is no ROI.
More complex and more subtle examples are possible as well, especially considering the potential indirect benefits of improving RPC factors in an organization:
- The establishment of off-site service recovery center resources may provide new meeting locations, conference space, and consultant work space, thus improving vendor relations, increasing productivity, and boosting R&D and sales.
- The act of creating specific service recovery procedures may help with process reengineering, Six Sigma quality improvements, and ITIL implementation.
- The effort to enhance the organization’s competencies, like investments to create high-performing teams, may improve individual project success, bolster the PMO, and decrease time to market.
Returning to the six positions regarding ROI, we can begin to address each of them.
- Zero ROI: This position is significantly flawed. An organization cannot recover without resources, procedures, and competencies. Some factors may be more important than others, and not all may be immediately available,3 but they are necessary. Any investment made in any RPC factor, if it can benefit existing services, has an ROI.
- Insurance ROI: This position is entirely one-sided. The position is true if RPC investments cannot benefit existing services. But it does not recognize that some improvements of RPC factors will benefit existing services.
- IT ROI: This position is much too narrow; preparedness work in IT can indeed provide an ROI, but IT related benefits are not the only, exclusive ROI benefits.
- Risk Mitigation ROI: This position is much too narrow; preparedness work can provide an Enterprise Risk Management program with an ROI, but is not the only, exclusive ROI.
- Qualitative ROI: This position is both too broad and too narrow:
a. While it is true if RPC investments, particularly those in procedures and competencies, provide qualitative and/or secondary benefits to existing services,
b. It is not true if the investments do not benefit existing services (too broad), and
c. And it does not take into account potentially beneficial resource investments (too narrow), e.g., additional staffing, equipment, and hardware.
- Quantitative ROI: While very difficult to estimate in practice, it would certainly be theoretically possible to quantify some ROI for dollars spent on RPC investments if said investments benefitted existing services. Clearly, the precise mathematics are yet to be established.
The results might be summarized in a table as such:
Investments in RPC factors provide NO benefit to existing services
Investments in RPC factors provide some benefit to existing services
|IT ROI||Accurate||Accurate but too narrow|
|Risk Mitigation ROI||Accurate||Accurate but too narrow|
|Qualitative ROI||Inaccurate||Accurate but too narrow|
|Quantitative ROI||Inaccurate||Accurate but immature|
The resulting table indicates that none of the positions as they currently stand accurately reflect the nature of an ROI for preparedness to recover. They should be discarded as they are. The use of a conceptual model, like the one introduced earlier, provides for a singular and more accurate answer to the ROI question. To restate: Investments in RPC factors which also directly or indirectly benefit operational services will have an ROI; investments in RPC factors which do not directly or indirectly benefit operational services will have no ROI.4
The question has been answered, and accurately so. Yet the solution seems disappointing. Perhaps this is because the answer to, “Does preparedness have an ROI?” boils down to: “It depends.”
On what does it depend? It depends both on the capabilities of the continuity professional and the culture of the organization.
This is a very significant dependency and understanding its implications may change our reaction from disappointed to unsettled. Part Two unpacks the ramifications of this dependency to the discipline.
1. For more information on the six categorizations, see: Copenhaver, John, and David Lindstedt, “How to Focus the Discipline of Business Continuity,” Journal of Business Continuity and Emergency Planning, Vol. 4, No. 2, 2010.
2. For more information, see: Lindstedt, “Measuring Preparedness and Predicting Recoverability,” 2012, http://busfin.osu.edu/FileStore/ECMP/Measuring%20Preparedness%20and%20Predicting%20Recoverability_V1_Lindstedt.pdf
3. In this case they get cashed out in terms of costs; see final diagram below.
4. Reminder: The model only addresses preparedness to recover from a significant staffing or physical loss; the scope is not expanded to include readiness, resilience, survivability, sustainability, or any other all-embracing concept. A narrow scope helps to address the ROI problem specifically for recoverability planning.
David Lindstedt, PhD, CBCP, PMP is the Program Director for Enterprise Continuity Management at The Ohio State University, the largest university in the United States. He is the creator of the RPC Model of Organizational Recoverability and author of “Measuring Preparedness and Predicting Recoverability.” Dr. Lindstedt has presented at numerous conferences and has published several articles in international journals. He has taught continuity planning for Norwich University and currently serves on the editorial board for the Journal of Business Continuity and Emergency Management.