Over the last several years, one observed trend in the business continuity planning (BCP) field is the increased interaction with the risk management practice. This makes sense from a variety of viewpoints. One key area is that both risk management and BCP efforts must be enterprise wide. They must be able to break down business silos in order to properly ascertain exposures, reduce risk, obtain a fair price for protection (whether insurance or hot sites, record storage, etc.) and determine enterprise continuity direction.

Another area where both risk management and business continuity can have a quantifiable synergy in reducing both risk exposures and cost to the organization is in impacting commercial insurance costs. While there may not be direct insurance credit, effective risk assessments and continuity strategies can reduce the need for business interruption coverage limits. These could be reduced as recovery time is reduced.

Several real-life examples highlight potential areas where developing effective continuity strategies can impact and reduce insurance coverage.

Reducing Recovery Time to Reduce Insurance
The site of the first anthrax attack in 2001 on the former American Media, Inc. building in Boca Raton, Florida was still going through decontamination as of June 2005. If their mail handling had been done in a separate facility, their main operation may have continued operations uninterrupted.

Mail handling procedures became a big issue in the United States shortly after the anthrax scares. Many organizations conducted training sessions, provided dust mask and gloves or installed expensive mail handling equipment. While these steps may have provided some protection to employees, the key was segregating the potential exposure.

One organization had their mailroom located in their main operational computer room that housed over 400 servers. The potential business interruption and recovery costs caused by a mail bomb or anthrax letter in their mailroom were considered unacceptable. It was recommended that the mailroom be relocated. The organization made the decision to build a separate building just for handling mail.

Another organization, a gaming company, offered several areas that impact on insurance coverage. Because of the nature of the industry and of the company itself, several unique strategies were developed.

In concert with the company’s slot machine engineering staff, it was recommended that the company develop a “SWAT” type emergency team. This would consist of a team of cross-state licensed slot engineers (currently, only those residing in a certain state can work on slot machines in those states). By having multi-state capable engineers, the company could significantly shorten their recovery time (particularly if engineers are lost in the event).

The BIA findings also pointed out that the time to replace slot machines was unacceptable. It would take at least six months to a year for machines to be built, delivered and state certified. It was recommended that a slot warehouse of at least 500 machines be developed instead of instantly reselling them on the open market. This would allow the locations to maintain operations and at least some income even if they lost all of their slots in a disaster.

A third unique area involved facility security. State regulations require that gaming operations must have security cameras and video recording capabilities in place and functional before gaming can open for the day. The BIA indicated that all locations used different types of security cameras and replacement time could be several months. It was recommended that because several locations were considering replacing either their cameras or video recording equipment that all locations should use the same brand of equipment and that the replaced equipment be kept in a warehouse for possible use in the future. Each location should also order at least a handful of extra new cameras that might be able to be shared with the other locations in a disaster mode.

D&O Coverage and Marketing to Insurers
Effective continuity plans may also have an impact on Director and Officers (D&O) coverage. Risk managers often must present the results of their insurance coverage renewal to their board. They are often being asked to give an overview of the organization’s business continuity status and initiatives at that time. It provides an excellent forum to show how BCP can impact insurance costs.

Still another way to potentially reduce premiums via excellent risk management and business continuity programs is to market those efforts to current and prospective insurers. Coverage and pricing can be reflection of those carriers’ underwriting personality.

Some may be very conservative and may not place much emphasis on those efforts. Others may emphasize only physical controls. During the renewal process, presentation of your risk management and continuity efforts should be highlighted. This should include the steps in risk assessment and mitigation plus your continuity strategies and thinking. Making a good match with a progressive and flexible carrier can result in considerable premium savings.

While there may not be a formal insurance premium credit for business continuity, it is a part of an underwriter's evaluation of the overall management. If a risk has a documented plan, it becomes part of the underwriter's justification for applying additional credits, using a deviated company or providing coverage enhancements.

About the Author Al Sawchak, CBCP, ARM, ALCM is a senior consultant with Strohl Systems. He has over 15 years experience in BCP with extensive international, insurance-industry and risk management consulting experience including claim management, data warehouse systems and loss control. He can be reached at asawchak@strohlsystems.com.