Continuity at a crossroads: as long as the bottom line remains robust, corporate boards rarely pay much attention to a firm's ability to survive ... until the proverbial bullet hits them in the chest. Business-continuity managers say the concept still has a long way to go before it's fully accepted.

Business continuity rocks. That's the view of Carol Moffitt, the former director of risk management, technology and solutions at BMO Financial Group, the former Bank of Montreal. Moffitt, now a consultant, insists that business continuity professionals are becoming strategic partners in everything from rolling out new products to negotiating deals with outsourcing partners and managing SARS-like international crises. "Business continuity is absolutely a board-level issue," says Moffitt. "It's being treated as a serious concern throughout organizations."

It's too bad many business-continuity professionals disagree with Moffitt.

Take Bill Harrison, for example, managing director of the Crisis Management Practice at Aon Risk Services in Princeton, N.J. He says that much of the time, corporate brass pays only lip service to the function. "I would hope that business continuity would get an executive-level nomination, but in most cases it's not there," he says.

Moffitt acknowledges that Sept. 11 was a catalyst for raising the visibility of business-continuity planning, but believes other events have been equally pivotal.

"People focus on Sept. 11 as the event that brought business continuity into the spotlight. But there have been a lot of important lessons learned from other events since then that demonstrate the continuing maturation of the industry," Moffitt says.

Last year's North American power outages are a striking example. "Physical operations were so broadly disrupted that business-continuity plans were pushed to file limit," she explains. "Use of service providers was pushed to the limit. We saw what the impact of a widespread regional event could be. And, as business-continuity plans were implemented, the world did not come to an end."

The good news, Moffitt concludes, "is that because of events like these, the business-continuity community has evolved to the point that, at many organizations, the basic plans are in place."

No one disputes that interest in continuity, planning received a dramatic boost after the World Trade Center catastrophe.

Not everyone, however, shares Moffitt's view of how far it's come since then. Bernard Chapple, chief information officer at Edward Waters College in Jacksonville, Fla., is a champion of the process. But he believes the idea still has a long way to go. "Unfortunately, a lot of people don't think about Sept. 11 today. As a result, business continuity remains an item on the checklist. It's an after-course or dessert around coffee," Chapple says.

Despite an increasingly nimble business-continuity profession and the proselytizing of converts like Carol Moffitt, an awareness of the need for business-continuity planning has failed to percolate throughtout many organizations.

Too often, business-continuity professionals face a corporate culture that dismisses these planning issues as a necessary evil and only an expense, not an investment.

THE "LUXURIOUS NECESSITY"

The financial services and utility industries have clearly understood the importance of business-continuity planning, in part because of the regulatory environment in which these kinds of companies operate. Financial institutions are under scrutiny from regulators and consumers. Utility companies must address these issues, if only because of the political backlash resulting from power failures that keep voters in the dark. Outside of these two industries, however, the corporate approach to business continuity varies greatly.

Even if a company embraces the continuity planning process, business-continuity executives face a challenge enlisting board-level support and the resources to fight for change.

"We definitely have visibility at the higher levels of the company," says Charles Jones, the project manager for business continuity at New Haven's United Illuminating Co. Business-continuity planning "has been pushed by our board of directors. It's well supported by our senior executives," Jones adds.

But his company may be the exception. "At other companies, however, I think board support ebbs and flows," Jones says. "Whenever people think they've dodged a bullet (like Sept. 11), there's a lot of interest."

But, he adds, "the further you get away from any single event, the harder it is to build momentum."

When times get tough, business continuity is still one of those luxurious necessities," he says. "No one will say, 'We don't need business continuity,' but they may think, 'We can live without this temporarily, we don't have to move on it right away.'"

Richard B. Johns, corporate director of risk management at Schaumburg, Ill.-based Motorola, says his company knows that business continuity is a shareholder-value issue. "If you have problems delivering product, that directly affects your bottom line." But Johns believes that business-continuity executives often need to work harder for greater attention from the top.

Although top management at Motorola understands business continuity, Johns says, "I think institutionalizing business continuity programs at all levels of a company can be a problem." For the process to be effective it must be implemented not only, at the site level but also at the strategic-planning level, he says.

JUST-IN-TIME CONTINUITY

When companies--such as those in the data technology sector--depend upon just-in-time supply-chain management, they're likely to be more aware of tire importance of having effective business-continuity strategies in place.

Usually these firms insist that suppliers also embrace business continuity. "You've got to make sure that outsourcing is covered," says Johns. "We have a checklist for key suppliers to make sure they have adequate plans."

But as important as it is to examine each link in the supply chain, many companies have begun to realize that the process starts at the top. Thanks to the disclosure provisions of Sarbanes-Oxley, more companies now require that their own senior executives certify that business-continuity plans are in place.

"This year we're putting together a program that requires all of our executives to certify that they are in compliance with business-continuity policy, signing off that their part of the organization has business-continuity plans in place," says Penny Turnbull, director of crisis management and business-continuity planning at the Marriott Corp.

BMO's Moffitt says that business-continuity professionals have become leaders in the "certifying" process--demonstrating how it can be used successfully outside the financial arena.

"A buzzword at corporations generally these days is 'attestation,' with executives being asked to attest to one thing or another," Moffitt says. "It's all part of compliance and governance. Certainly business continuity is in the forefront here from a governance perspective; there are a variety of different levels of sign-off."

Although it's clear that continuity planning has become more important, the whole profession is relatively new. It started out in the 1960s as a means of keeping mainframe computers running.

But even very late into the 20th century, many companies didn't have anyone handling continuity issues. Continuity planning saw a resurgence a decade ago, as IT planners began to consider the chaos from glitches stemming from the change in digits from 99 to 00 beginning on Jan. 1, 2000.

Since then, however, continuity appears to have lost traction in some quarters, leaving continuity managers disillusioned. "Some industry professionals are frustrated, but you have to consider the progress that has been made and how much it has evolved since Sept. 11," says BMO's Moffitt.

Kathy Patterson, business-continuity and disaster-recovery manager for the Temple University Health System in Philadelphia, says that in tire past, continuity wasn't a priority in the health-care industry. But in the last few years it's come a long way. "For years the banking industry has had something in place regarding business continuity and disaster recovery," she says. "Several years ago the health-care industry did not. Considering that, the industry has made great strides."

Change takes time, she says, and the issue is to get the whole organization involved. Today Patterson works to make sure that every department has the proper procedures in place in the event of a computer disruption, for example. Not only is it good policy, she adds, it's also a requirement of the accrediting agency that certifies hospitals.

Ironically--despite obvious concerns about corporate liability-few business-continuity managers consider building ties with traditional risk managers. Most business-continuity managers don't report through the existing risk management function.

Marriott is one notable exception. "One of the unique things about Marriott is that this is considered a risk management issue," says Turnbull. But the job involves widespread contacts throughout the company. "I have a department of two. But we have a huge number of partners in other parts of Marriott who do much of the work."

Few business-continuity managers believe they should be seen as part of enterprise risk management, although ninny are involved in the process of managing risks for their companies. And if that sounds like a contradiction, perhaps it is.

"Right now I'm talking with our ERM area to see if there is a logical connection," says United Illuminating's Jones. "I think that there is a connection there. The fact that business can be interrupted is a risk." Jones sees business continuity as separate from ERM.

Adds Motorola's Johns: "I don't know if we should fall under ERM. A lot of ERM programs look more at financial risks; but if your business operations go down, it does create financial risks.

"At the same time, I do see what we do related to reputational risk," Johns says. "The potential impact of business-continuity risk is rather large, especially in this global economy."

AN UPHILL STRUGGLE

For the moment, as business-continuity managers continue to build a stronger case for what they do internally, few dollars appear to be flowing in their direction.

"In my view, business continuity is not getting more leeway," says Lance Harry, eastern regional manager for Great Lakes Chemical Corp., a fire suppression business based in Lafayette, Ind. "I'm not sure that those responsible for business continuity are being given a greater amount of authority or the wherewithal to spend more money."

Instead, Harry says, companies balance the need for better continuity planning with the cost of business continuity. "When the economy isn't doing that well, some companies argue, we have a responsibility to shareholders, we can't spend that kind of money," he explains, adding that executives at the moment are more likely to tighten the budget spigots.

"My company is tied closely to the economy--what we do is built into construction--so we have a pretty good feel for this debate," Harry says.

As he tries to raise awareness on the economic battlefield, Harry believes that the state of the economy has the most impact on how well business continuity is doing as a profession.

Not everyone is discouraged. Moffitt remains sanguine, citing regulatory concerns about compliance and governance.

Those issues won't disappear and will probably sustain the need for corporations to think about business continuity, even when economic times are tough, budgets are tight and corporate attention begins to drift.

"Am I bullish personally?" asks United Illuminating's Jones. "Why wouldn't I be? We have a tradition of working through disasters. That makes it easier to talk about risk management. I'm very fortunate to be in an industry and company that's focusing on this issue.

"But a lot of other people have a lot tougher row to hoe," he says.

LARRY QUINN writes regularly for Risk & Insurance. He can be reached at [e-mail]