Journal of Corporate Real Estate Volume 4 Number 4

Corporate real estate and business continuity: An integrated enterprise approach Temba Msezane and Jeff McBride Received (in revised form): 2nd April, 2002 Real Property Strategies, BoozAllen Hamilton Inc., 8283 Greensboro Drive, McLean, VA 22102-3838, USA; Tel: ⫹1 703 377 1674; Fax: ⫹1 703 917 2692; e-mail: [email protected] or Tel: ⫹1 703 902 4016; Fax: ⫹1 703 917 2692; e-mail:[email protected]

Temba Msezane is an Associate with the Organisation and Management Team (Real Property Strategies) at BoozAllen Hamilton, Inc. He specialises in e-business strategy and has functional expertise in real estate. Specifically, Temba has most recently focused on real estate analysis surrounding development activities at the property and portfolio levels. In addition, his experience includes development management and investment analysis in the real estate side of the hospitality industry. He holds an MBA from Emory University. Jeff McBride is an Associate with the Organisation and Management Team (Real Property Strategies) at BoozAllen Hamilton, Inc. He specialises in e-business strategy and has functional expertise in real estate and health care. Jeff has extensive experience in the areas of strategic planning, organisational analysis, market research, and survey design and analysis. He holds an MBA from Wake Forest University and an MA from the University of Colorado.

Journal of Corporate Real Estate Vol. 4 No. 4, 2002, pp. 348–356. 䉷Henry Stewart Publications, 1463–001X

Page 348

ABSTRACT This paper explores the strategies and roles for the organisation’s corporate real estate function during times of increased uncertainty. Although business continuity planning (BCP) might appear to be a separate and unique effort, there are synergies between continuity planning and

standard business planning functions. It is suggested that enterprises should avoid the historically common mistake of stove-piped planning within the context of BCP. Rather, enterprises must fully embrace an integrated approach to business continuity from crossfunctional to cross-informational. If done correctly, business continuity planning can become a strategic asset that fully leverages an essential factor, the corporate real estate function. Keywords: business continuity management, enterprise risk management, strategic planning INTRODUCTION Whether you are planning to ensure the continuity of operations or planning to meet organisational goals and objectives, managing and mitigating enterprise risk is of primary importance. In corporate real estate planning, tools such as scenario planning and real option approaches are increasingly being used to manage uncertainty.1 While these tools have shown effectiveness for specific projects or investments, they do not apply an integrated approach to enterprise planning and uncertainty management. As uncertainty continues to increase and enterprises become more interconnected

Msezane and McBride

through process re-engineering and justin-time management, macro level risks as well as specific business risks require vertical and horizontal consideration.2–4 This paper will attempt to explore the strategies and roles for the organisation’s corporate real estate function during times of increased uncertainty. Although business continuity planning (BCP) might appear to be a separate and unique effort, there are synergies between continuity planning and standard business planning functions.5 It is suggested that enterprises should avoid the historically common mistake of allowing stove-piped planning, while developing and implementing a meaningful and actionable BCP. Rather, enterprises must fully embrace an integrated approach to business continuity to include three key dimensions:6 crossfunctional;7 cross-locational (headquarters, region, building, etc) and cross-business unit8 (including the supply chain). If done correctly, business continuity planning can become a strategic asset that fully leverages an essential factor, the corporate real estate function. UNDERSTANDING THE BUSINESS ENVIRONMENT Corporations have addressed all types of proposals, concerns and initiatives resulting from disaster-related events. One convincing argument for proactive risk management emerges from the need for senior management to minimise its own exposure, in the wake of crises, to the inevitable angry stockholders and customers who question why the company did not plan for the crises while the competition had done so. Another such argument stems from the fact that companies spend money on all types of insurance and then never have to use it. Despite the apparent ‘waste’ of capital expenditure, no executive would say,

Case study: Risk mitigation through corporate real estate strategy Lehman Brother’s purchase of Morgan Stanley’s new one million-square-foot office was primarily driven by Morgan Stanley’s business continuity concerns. With primary space at 1585 Broadway and 745 Seventh Avenue, the firm’s trading and backup facilities would be concentrated in two buildings within one city block that are dependent on the same transportation and power infrastructures. Morgan Stanley Chairman and Chief Executive Officer Philip J. Purcell said that eliminating that situation would leave the company ‘better positioned from a business continuity standpoint’.9

‘Let’s cancel the insurance to save money’. While intrinsically convincing, these arguments do not address the underlying reason for business continuity planning or stress the importance of an enterprise approach towards the effort. The most practical description of BCP is the United States National Fire Protection Association’s Charter, which states: The documentation of the strategies, procedures, resources, organisational structure and information database utilised by an organisation to respond to, recover from, resume and continue operations in the event of a substantial disruptive incident.10 In a relatively recent effort to encourage business continuity, the United Kingdom’s Institute of Chartered Accountants released a report requiring firms listing on the London Stock Exchange to begin, ‘Identification in a timely man-

Page 349

Corporate real estate and business continuity

ner of the key business, operational and compliance risks facing the company. Such risks include those associated with, for example, market, technological, reputational and business probity issues.’11 Research at Oxford University presents evidence that a firm’s recovery of shareholder value immediately following a catastrophic loss is largely independent of insurance coverage. Rather, recovery depends more on ‘high quality Risk Management and Contingency Planning systems’.12 Despite this evidence, a review of industry literature suggests that most companies do not have business continuity plans, or if they do, the plans are either ineffectual, impractical or untested with some being a combination of all three.13–19 Additionally, while more than 80 per cent of current contingency plans are data-centric driven, there is much more to avoiding business disruption than protecting informational databases (though the average organisation’s requirement for recovery time from a major system outage now ranges from two hours to 24 hours).20 Often continuity plans for facilities and critical equipment, including inventory shortages or alternative site relocation, do not exist at all, let alone integrated across business functions.21 As is argued by the United Kingdom’s Department of Trade and Industry, and a growing number of multinational firms, business continuity planning must incorporate the entire organisation in order to maintain mission viability.22,23 Pulling together business areas and creating a substructure of key stakeholders is critical in both business continuity and emergency operations. Integration of departments such as IT, finance, human resources, risk management, security, facilities and public affairs to build a comprehensive programme is necessary in all planning efforts. The South Korean conglomerate, Samsung Group, recently

Page 350

reported that management’s ability to control crisis has become more important than ever in doing business in periods of uncertainty, ‘Standard procedures of crisis management have to be put in place at all levels of corporate hierarchy to ensure uninterrupted business operation.’24 Each department should have a key role in disaster preparedness efforts pre-, during and post-event. The traditional corporate real estate (CRE) function has played a supporting role primarily responsible for providing space based upon corporate strategic plans that are translated to headcount and facilities infrastructure requirements.25,26 In terms of planning, both strategically and operationally, corporate real estate has been overwhelmingly reactive. As developed in Martha O’Hara’s ‘Place to Space’, the dominant corporate real estate mindset has evolved slowly from the market mindset (‘Get a deal on it!’) to cost minimisation (‘Get rid of it!’), to ‘strategic’ (’Allocate it as a strategic resource’).27 Although most corporate real estate functions are transitioning from the traditional role to a more strategic relationship with business units, very few are positioned to provide truly strategic organisational value. If the evolution of corporate real estate is to become strategic, a more active role in enterprise business issues, such as business continuity, is necessary. BUSINESS CONTINUITY MANAGEMENT In recent years, business continuity has undergone a metamorphosis. The term management has replaced planning where ‘management’ can be defined as the process of planning, organising and controlling the resources and activities of an organisation in order to fulfill its objectives most cost-effectively.28 Business

Msezane and McBride

Risk Categories

Hazard

Strategic

Financial Operational

Figure 1 The integrated enterprise BCM model

STRATEGIC Ex. Portfolio Distribution

TACTICAL Ex. Emergency Preparedness

TECHNOLOGY PROCESS PEOPLE INFRASTRUCTURE

OPERATIONAL Ex. Security Management

Levels of Management (Organisational Activities)

continuity management (BCM) is an ongoing process of risk assessment and management with the purpose of ensuring that the business can continue if risks materialise.29 These risks may be external (eg, acts of terrorism, computer fraud, kidnapping, natural disasters, failures within the supply chain or affiliate organisations etc) or internal to the organisation, such as deliberate or accidental damage to systems or safety and security breaches in research and development or manufacturing. Within this context, BCM may be considered as a living, dynamic, all-encompassing, integrated and enterprise-wide function resulting in the ability of an enterprise to act, both proactively and reactively to ‘unplanned events’, whether internal or external, hazard or economic.30,31 To assist organisations in addressing these concerns, the authors have developed an enterprise conceptual model for BCM, which helps align the management of risk with planning throughout the enterprise (adapted from

models created by Jensen32 and Brown33). Although firmly linked to risk management, BCM does not distinguish between insurable and non-insurable risks.34 The main value proposition in the BCM model is that it simultaneously incorporates an enterprise risk structure into continuity efforts with each enterprise area, including infrastructure. The integrated enterprise view of BCM reveals the interdependencies between the four enterprise areas (people, process, technology and infrastructure), levels of management or organisational activities (strategic, tactical and operational), and the four risk categories (strategic, financial, operational and hazard). Each of the risk categories can be dissected using an enterprise risk management framework in which all sub components work together. It is important to remember that all companies are in the business of taking risks and these risks are linked and must be managed.35 The Integrated Enterprise BCM Model (see Figure 1) may be used to evaluate, coordinate, and manage these potential

Page 351

Corporate real estate and business continuity

risks as they pertain to business continuity. This model is used to illustrate what BCM means to the enterprise as well as to provide a framework for corporate real estate in managing uncertainty. In Figure 1, CRE comprises a large portion of the infrastructure enterprise area. BCM typically focuses on the hazard risk category for planning and management efforts at the strategic, tactical and operational levels. CRE should address the business continuity efforts in the same manner. From a priority standpoint, operational efforts such as security management and planning are high because they are frequent and visible. Tactical efforts, such as emergency preparedness, however, must also be addressed systematically, because they may be catastrophic. In CRE’s evolution from a ‘market’ to ‘strategic’ mindset, CRE should also focus efforts at the strategic level looking at strategies such as portfolio distribution and site location in relation to possible hazards. As the Morgan Stanley case illustrates, the BCM Model highlights the need for strategic level planning at the infrastructure level. An analysis at the strategic level of the hazard risk category necessitates carefully evaluating the benefits of the previous portfolio distribution strategy. Additionally, at the operational level, ensuring continuous business operation with the firm’s trading and backup facilities concentrated in two buildings within one city block dependent on the same transportation and power infrastructures would also suggest re-evaluation of portfolio distribution strategy. While there are many complexities to developing a global (ie, considered as firm specific, either multinational or national) continuity programme, using the framework illustrated in Figure 1 facilitates identification of commonality

Page 352

across locations. Once the commonality is identified, it may then be populated with the model criteria determined at the macro level. As localities (eg, country, regional, site-specific) use the same conceptual approach, they will be positioned to determine and contribute the unique risk and resulting requirements. Following this process will ensure that both the global continuity requirements are met as well as the unique local requirements that may not be addressed in the centralised model. Furthermore, by applying this type of enterprise approach and potentially leveraging Internet-based tools for both building and continual management of the BCM programme, organisations may more readily meet changing global and local requirements. Although most large global organisations are locating the corporate BCM group within the risk management office or under the Chief Risk Officer (CRO) — CRE should be, and is, positioned to play a more active role in both risk management and BCM. STRATEGIC CORPORATE REAL ESTATE AND BUSINESS CONTINUITY MANAGEMENT GOING FORWARD The CRE function is cross-cutting and information-centric, touching every part of the organisation. The impact of CRE decisions on business performance may be significant in any operating environment. By taking an enterprise and strategic view to planning and management efforts, be it business continuity or traditional, CRE can be an invaluable resource in understanding the relationship between the geographic distribution of operations, key assets, security and location of employees. The CRE function may also leverage its cross-cutting position in supporting the development and implementation of a business continuity plan and management

Msezane and McBride

Table 1: Recommended courses of action Business continuity management programme in place

Business continuity plan or effort underway

No business continuity plan or effort underway

Ensure an integrated enterprise approach to continuity management. Analyse strategic risk mitigation methods. Leverage infrastructure information management systems (ie, CRE planning and management systems and vice versa)

Actively champion for ‘enterprise process’. Review the plan and revisit such facets as geographic distribution of facilities and people, emergency operations, remote operating centres and strategic security.

First ask, ‘Why not?’ Identify best practices. Assemble preliminary facts and figures beforehand and discuss with senior management.

programme. Additionally, the CRE function should work to ensure that physical infrastructure and strategic plans are in place to sustain essential operations during interruptions either through established facilities recovery processes or alternate facilities. Furthermore, beyond addressing infrastructure needs and operational capabilities, the ability to account for employees in the context of space as well as providing emergency workers with the necessary building and emergency management plans can be critical. For example, after a series of bombings at its domestic facilities in the late 1980s, the International Business Machines Corporation (IBM) created crisis management teams at every one of its global sites that were responsible for rapid and orderly response to threats or attack.36 CRE should review the plan and revisit such facets as geographic distribution of facilities and people, emergency operations, remote operating centres and strategic security (as illustrated in the Morgan Stanley case study and IBM example). While every corporation has its own business environment and associated risks, the authors have provided the CRE

function some recommended courses of action (Table 1). Although a relatively new concept, a few firms have attempted to incorporate a similar integrated enterprise risk management approach. For example, USAA, an insurance and diversified financial services institution managing over US$60bn in assets (with offices throughout the USA and Europe), carefully evaluates its real estate portfolio and infrastructure as part of its integrated risk mitigation and business continuity strategy.37 USAA’s models are routinely modified, based on risk assessment which then guide its enterprise planning and management. Due to the nature of its business, USAA must continually reassess continuity plans to ensure cash flow in the event of disaster — such as mail service stoppage. Organisationally, USAA has corporate as well as separate business unit situation management sub-teams to consider such scenarios. Examples at the tactical and operational levels include the aggregation of mail operations as well as separate HVAC systems for the mail facility. While not all organisations require the sophistication of a busi-

Page 353

Corporate real estate and business continuity

ness continuity management programme, such as USAA, it is imperative to begin considering an enterprise risk-based perspective. As managers begin examining business continuity planning from an enterprise perspective, the authors suggest a number of key questions for senior managers as well as a more targeted purview designed to assist corporate real estate managers when considering business continuity. KEY QUESTIONS WHEN CONSIDERING INTEGRATED ENTERPRISE BUSINESS CONTINUITY MANAGEMENT Strategic • If we had an unplanned interruption today, what would the impact be on our firm’s reputation and value based on employee goodwill, shareholder value, customer forgiveness and customer service? • Do we need a larger geographic distribution of assets and do we want to occupy or be located near high profile buildings? Have we created unnecessary reliance on single locations (in one region, country or continent) or a limited number of providers and/or vendors? (eg, have we put all of our eggs in one basket?) • Do we have the agility and speed necessary in our chain of command and organisational structure to facilitate quick decision making in the event of a crisis? Have we built the infrastructure necessary to keep the lines of communication flowing across all segments of the organisation during an unplanned event? • Example — Strategic tradeoffs matrix: — Co-location (for collaboration) vs wider distribution — Resource optimisation (scale

Page 354

economies) mitigation).

vs

redundancies

(risk

Tactical • Do we have any risk management or planning tools in place for use on an enterprise-wide scale that can support business continuity efforts? • Can we implement simple programmes, such as ‘situational awareness’ to help mitigate risk? • Are we considering alternatives to the traditional workplace (eg, ‘hotelling’, ‘hotdesking’, video conferencing, telecommuting and other innovative work place strategies) to mitigate risk? Operational • Who is responsible for the updating and testing of our plans and procedures? • Do we conduct fire evacuation exercises, have we adequate mailroom security and do we evaluate our ventilation systems? Additional considerations • If we do not currently have an integrated enterprise BCM model programme in place, will we develop it in house or contract out for consulting services? • Do we have qualified personnel in house to develop a programme? • Which contractors or consulting firms employ a comprehensive BCM approach?

Experience, in speaking with many CRE managers and examining integrated enterprise-related issues, suggests that senior managers are currently struggling to determine where business continuity responsibility lies. This struggle underscores the challenge facing a firm’s management as it attempts to proactively mitigate risk. As Figure 1 conceptualisation implies, the CRE function is merely

Msezane and McBride

one of many perspectives that must be incorporated into a coherent business continuity design. The authors suggest that the CRE function, because of its cross-cutting and information-centric position, may be the place at least to begin the dialogue. If done correctly, the CRE function may eventually fully leverage business continuity planning to become the ‘corporate infrastructure resource management’ strategic perspective CREs have so long desired. ACKNOWLEDGMENTS The authors would like to acknowledge thoughtful commentary from John Cattaneo, Michael Craig, Gary Lance, Scott Foster and the anonymous reviewers on early drafts.

(11) (12)

(13) (14) (15) (16) (17)

(18)

(19)

REFERENCES (1) Becker, F. and Sims, W. (2000) ‘Managing Uncertainty: Integrated Portfolio Strategies for Dynamic Organisations’, Cornell University International Workplace Studies Program (IWSP), New York, pp. 5-7. (2) Marsh Inc. (2001) ‘The New Reality of Risk’, Business Continuity, Oct. Vol. 1, No. 2. (3) Rigby-Smith, C., Dykes, L. (2001) ‘Business Interruption Insurance: Vital for Risk Management’, Marsh UK Business Continuity Management Practice, October. (4) Vogt, K. (1999) ‘Business Continuity and Total Risk Management’, Journal of Business Continuity, April, No. 28. (5) Smith, R. (2001) ‘Morgan Stanley Plans to Build a Backup Trading Floor’, The Wall Street Journal, October 30, Section C:1. (6) See ref. 1 above. (7) See ref. 2 above. (8) See ref. 3 above. (9) See ref. 5 above. (10) Moore, P. (2001) Business Continuity Planning: A Strategic Facility, Vol. 6.

(20)

(21) (22)

(23)

Available at: http://www.recovery.ifma.wego.net/?p=1472. Accessed 12 October. See ref. 10 above. Lack, K. T. (2002) ‘The Implication for Business Continuity and Information Security’, July. Available at: www.globalcontinuity.com/. Accessed 20 March. See ref. 2 above. See ref. 3 above. See ref. 4 above. See ref. 10 above. Knight, F. and Pretty, D. (1996) ‘The Impact of Catastrophe on Shareholder Value’, Oxford University Press, Oxford. Burtles, J. (2001) The Case for Business Continuity Management, Vol. 1. Available at: http://www.globalcontinuity.com/. Accessed 18 October. Woods, M. (2001) Information Management Individual Research Analysis, Vol. 1. Available at: www.cs.adfa.oz.au/courses/irm/RAMGW01.htm. Also available at: http://www.availability.com/resource/pdfs/DPRO-100862.pdf. Accessed 12 October. Noakes-Fry, K. and Diamond, T. (2001) ‘Business Continuity and Disaster Recovery Planning and Management: Perspective’. Available at: http://www.availability.com/resource/pdfs/DPRO-100862.pdf. Accessed 25 March, 2002. See ref. 2 above. Power, P. (2001) ‘Business Continuity Management — Preventing Chaos in a Crisis, Management Best Practices Directorate of the Department of Trade and Industry’. Available at: www.dti.gov.uk/mbp. Accessed 25 March, 2002. Anonymous (2001) ‘Global HR Issues, South Korean Employers Ramping Up Security Measures’, BNA. Available at: http://www.bna.com/employersrespond/story079.htm. Accessed 25 March, 2002.

Page 355

Corporate real estate and business continuity

(24) See ref. 23 above. (25) See ref. 1 above. (26) O’Mara, M. (1999) ‘Strategy and Place and Facilities for Competitive Advantage’, Simon and Schuster, NewYork. (27) See ref. 26 above. (28) See ref. 4 above. (29) See ref. 22 above. (30) See ref. 2 above. (31) See ref. 4 above. (32) Jensen, C. J. (2001) ‘Upside, Downside. Intelligent Enterprise’. Available from: http://www.intelligententerprise.com/cgi-bin/printable.cgi. Accessed 27 September. (33) Brown, B. A. (2001) ‘Step-by-Step

Page 356

(34) (35) (36)

(37)

Enterprise Risk Management’, Risk Management, Vol. 48, No. 9. See ref. 22 above. See ref. 33 above. Schrader, R. and McConnell, M. (2002) ‘Security and Strategy in the Age of Discontinuity, a Management Framework for the Post-9/11 World’, Strategy ⫹ Business, First Quarter. Available from: http://www.strategybusiness.com/press/paper/?art=228408&pg=0. Wayne, P. (2001) Proceedings of the IDRC Texas World Congress, 20–24 October, Dallas, Texas.