When Bollywood Meets Business Continuity

I don't know of a single company whose risk assessment included the possibility that operations could be disrupted by the death (of natural causes) of a retired Indian film star.

It just goes to show you, you can never think of everything.

When Rajkumar died of heart attack at the age of 77, it sparked a wave of rioting in Bangolore, an impromptu (then official) state holiday, and the ransacking of some software companies' offices. I don't pretend to fully understand this (read the article by Alexander Zaitchik for one descrption and explanation). It's a reminder, as I've written elsewhere, that we should never assume other cultures are like our own.

The effect of the riots was a disruption of development activity (for those companies that had outsourced development work to Bangalore) and, perhaps more critically, a temporary loss of call centers as offices closed or staff were unable to get to work.

If the risk was one which couldn't be foreseen, can we reasonably have expected business continuity plans to cover it?

The answer is emphatically yes.

Our plans should have recognized and included the possible loss of communications with a remote call center, and the possible temporary (or permanent) loss of a work location. It could have been the traditional back-hoe (JCB® for UK readers) severing key communication links; it could have been a fire, a flood, a strike, or a hundred other things putting the call center temporarily out of use: our response (and the need for a response) would have been the same.

So if we should have planned for these things anyway, why do we still need to perform a risk assessment? We will never think of everything, will we?

While it would be nice to believe that business continuity professionals are omniscient and our risk assessment will identify every threat that could impact our business, we know that in practice it will never be true. But concentrating on on what we can't do misses the point. The objectives of a risk assessment are:

1. To identify threats which may severely impact the operation of our business,
2. To understand which business operations will be affected by those threats,
3. To estimate the probabilities associated with those threats,
4. To generate the expected loss information (using the above, and the information we obtained during our Business Impact Analysis).

The last of these is the key. We need this information if we are to make a rational decision about how to handle a threat. Should we spend money to reduce a risk (e.g. use two call centers in two cities), ignore the threat entirely (too unlikely), transfer the risk to someone else (using insurance), include the risk in our response or recovery plans, or simply change our operations to avoid the threat.

While we can neither estimate the probability of future events exactly nor can we determine every possible threat, we can arrive at approximations which are good enough (or the best we can do) for planning purposes and choosing a cost-effective approach.

And after we observe an event (such as the one described) we can update our risk assessments for the future. While we may not expressly include "death of Bollywood¹ film star" in our list of risks, the estimated probability of a disruption due to riot, civil disruption, or political instability may have increased. Just a bit.

¹ Yes, I know that Rajkumar wasn't a Bollywood film star (he didn't work in Mumbai and spoke Kannada not Hindi), but this is a distinction generally lost outside of India where knowledge of Indian languages and geography isn't widespread. It's certainly not a distinction I could have made before researching this article.