Session No. 13

# Course Title: Business and Industry Crisis Management, Disaster Recovery, and Organizational Continuity

# Session 13: Business Contingency Planning 

## Time: 1 hr

Objectives:

1.  State the general objectives of business contingency planning.

# 

# Describe the general disaster (crisis) recovery planning process as presented in Geoffrey H. Wold's 1992 article "Disaster Recovery Planning Process*.*"

**Scope:**

This session starts with a review of the terminology used in business
contingency planning and the objectives (strategic and tactical) of the
planning process. Part I (I of III) of Geoffrey H. Wold's 1992 article
"Disaster Recovery Planning Process" is assigned as student reading and
provides an overview of the entire planning process. His steps cover all
of the predisaster (crisis) event functions, from the preliminary risk
assessment and BAIA through plan development and testing. Reference is
made to previous sessions for those steps addressing the functions
previously covered in the course. Specific plan content and format
receives only general coverage in this session and will receive more
in-depth coverage in the next session.

**Readings:**

*Student Reading:*

Emergency Preparedness Canada, with the Disaster Recovery Information
Exchange. 1995. *Business Resumption Planning* *-- A Guide.*
Fredericton, NB, Canada: Minister of Supply and Services. Free copies
(catalogue no. D82-37/1995E) are available from: Communications
Directorate, Emergency Preparedness Canada, 122 Bank Street, 2nd Floor,
Ottawa, Ontario K1A 0W6, Phone: (613) 991-7035, FAX: (613) 998-9589,
e-mail:
[cominfo@epc-pcc.x400.gc.ca](mailto:cominfo@epc-pcc.x400.gc.caor); or
directly over the Internet at:
<http://hoshi.cic.sfu.ca/epc/pub/manuals/en_busresume.html>.

Federal Emergency Management Agency. 1996. *Emergency Management Guide
for Business and Industry*. Washington, DC: Federal Emergency Management
Agency. "Section 1: 4 Steps in the Planning Process." Pages
19--29.Available on the FEMA Web site at
<http://www.fema.gov/library/bizindex.htm> or in published form from
FEMA, Publications, P.O. Box 70274, Washington, DC 20024. (Previously
assigned for session 5).

Lerbinger, Otto. 1997. *The Crisis Manager -- Facing Risk and
Responsibility*. Mahwah, NJ: Lawrence Erlbaum Associates, Publishers.
Chapter 2, pages 19--29.

Wold, Geoffrey, H. 1992. "Disaster Recovery Planning Process -- Part I
of III*.*" *Disaster Recovery World III.* \[CD ROM\]. St. Louis, MO:
*Disaster Recovery Journal*. Pages 15--18. Originally appeared in
*Disaster recovery journal* (Vol. 5, No. 1). Available at
<http://www.drj.com/new2dr/w2_002.htm>.

*Instructor Reading:*

Cronin, Kevin P. 1993. "Legal Necessity." *Disaster Recovery World II*
\[CD ROM\]. St. Louis, MO: *Disaster Recovery Journal.* Pages 65--66.
Originally appeared in *Recovery Magazine* \[on-line\] (winter 1993).
Also available on the internet at
<http://www.drj.com/new2dr/w2_022.htm>.

Edwards, Don. 1991. "The Contingency Planner." *Disaster Recovery World
III* \[CD-ROM\]. St. Louis, MO: *Disaster Recovery Journal.* Pages
16--17. Originally appeared in *Disaster Recovery Journal* (Vol. 5, No.
10).

Emergency Preparedness Canada, with the Disaster Recovery Information
Exchange. 1995. *Business Resumption Planning: A Guide.* Fredericton,
NB, Canada: Minister of Supply and Services. Free copies (catalogue no.
D82-37/1995E) are available from: Communications Directorate, Emergency
Preparedness Canada, 122 Bank Street, 2nd Floor, Ottawa, Ontario K1A
0W6, Phone: (613) 991-7035, FAX: (613) 998-9589, e-mail:
[cominfo@epc-pcc.x400.gc.ca](mailto:cominfo@epc-pcc.x400.gc.caor); or
directly over the Internet at:
<http://hoshi.cic.sfu.ca/epc/pub/manuals/en_busresume.html>.

Federal Emergency Management Agency. 1996. *Emergency Management Guide
for Business and Industry*. Washington, DC: Federal Emergency Management
Agency. "Section 1: 4 Steps in the Planning Process." Pages 19--29.
Available on the FEMA Web site at
<http://www.fema.gov/library/bizindex.htm> or in published form from
FEMA, Publications, P.O. Box 70274, Washington, DC 20024. (Previously
assigned for session 5).

Lerbinger, Otto. 1997. *The Crisis Manager -- Facing Risk and
Responsibility*. Mahwah, NJ: Lawrence Erlbaum Associates. Chapter 2,
pages 19--29.

March, Randall A. 1995. "Is Your Recovery Plan 'Done'?" *Disaster
Recovery World III* \[CD-ROM\]. St. Louis, MO: *Disaster Recovery
Journal.* Pages 50--51. Originally appeared in *Disaster Recovery
Journal.* Vol. 8, No. 4. Available on the Internet at
<http://www.drj.com/new2dr/w2_002.htm>.

Wold, Geoffrey, H. 1992. "Disaster Recovery Planning Process -- Part I
of III." *Disaster Recovery World III.* \[CD ROM\]. St. Louis, MO:
*Disaster Recovery Journal*. Pages 15--18. Originally appeared in
*Disaster recovery journal* (Vol. 5, No. 1). Available at
<http://www.drj.com/new2dr/w2_002.htm>.

General Requirements:

Present the content by means of lecture and discussion as necessary.

Complete the modified experiential learning cycle for objectives 13.1
and 13.2 at the end of the session.

Objective 13.1 State the general objectives of business contingency
planning.

Requirements:

Present the material by means of lecture and discussion as necessary.

Remarks:

I.  Background -- Terminology of business contingency planning.

```{=html}
<!-- -->
```
A.  The process of business contingency planning is also commonly
    referred to as "disaster recovery planning," "business resumption
    planning," "business recovery planning," "business continuity
    planning," etc.

B.  The titles assigned to business contingency planners vary throughout
    the business world and include such descriptive titles as disaster
    recovery coordinator/planner, contingency coordinator/planner, and
    business continuity coordinator/planner.

C.  For the purpose of this course, the terms "business contingency
    planning" and "business contingency planner" will be used in the
    general sense of the process of and people assigned responsibility
    for considering and coordinating the planning for potential events
    that can have a negative effect on the business.

D.  Included under the umbrella of business contingency planning are
    component plans including:

```{=html}
<!-- -->
```
1.  Emergency response plans.

2.  Incident management plans.

3.  Corporate crisis management plans.

4.  Corporate crisis communications plans.

5.  Disaster recovery plans.

6.  Business continuity plans.

```{=html}
<!-- -->
```
E.  As defined in the crisis management and business continuity model
    presented in session 4 (overhead 4-2), the business contingency
    planning function is a critical element that should tie together the
    pre-crisis event functions of risk assessment, BAIA, risk
    management, safety and security management, and training, exercises,
    and drills to the event- and post-event-focused functions of
    incident response, incident management, crisis communication, crisis
    team management, disaster recovery, and business resumption,
    restoration, and recovery.

```{=html}
<!-- -->
```
II. Objectives of business contingency planning.

```{=html}
<!-- -->
```
A.  The overall strategic objective is to ensure organizational survival
    and economic viability through the accomplishment of tactical
    objectives, including:

```{=html}
<!-- -->
```
1.  Ensuring the **safety of personnel,** customers, and the public.

2.  **Protecting assets** (human, physical property, image, data, and
    information).

3.  Ensuring orderly and effective response through clearly defined
    **responsibilities and procedures.**

4.  **Minimizing disruptions** to business operations.

5.  **Minimizing potential economic loss.**

6.  **Resuming, recovering, and restoring business functions** and
    operations according to a predeveloped and well-thought-out priority
    scheme.

7.  Maintaining a **positive public image.**

8.  **Complying** with legal, statutory, and regulatory requirements.

9.  Establishing awareness and **building support** at all levels of the
    organization for integrated crisis management and business
    continuity.

> B. The **ultimate success** of the planning process is the
> development, testing, refinement, and maintenance of realistic and
> integrated plans that support these objectives.

1.  Success is not the development of plans that, once completed, **sit
    on a shelf** and are not tested and refined to reflect changes in
    the organization and its environment.

2.  Plans developed to merely meet internally or externally imposed
    requirements and which are not tested and refined to reflect reality
    are of **no or limited use** in an actual crisis and can actually
    exacerbate a crisis if the information they are based on is not
    current and correct.

Supplemental Considerations:

None.

# Objective 13.2 Describe the general disaster (crisis) recovery planning process as presented in Geoffrey H. Wold's 1992 article "Disaster Recovery Planning Process." 

Requirements:

Present the material by means of lecture and discussion as necessary.

Section I. B. 8 includes a question for class discussion.

Section II includes a written homework assignment to be turned in during
the next session and discussed at the start of the next session.

Complete the modified experiential learning cycle for objectives 13.1
and 13.2 at the end of the session.

**Remarks:**

I.  Disaster recovery **planning process.**

```{=html}
<!-- -->
```
A.  The first part of this three-part article lays out **a ten-step
    approach** to disaster recovery planning (or business contingency
    planning using this course's terminology). This definition and
    approach to planning go back to the start of the overall crisis
    management and business continuity model to include the functions
    starting with risk assessment and BAIA. This approach is certainly
    valid and is consistent with the emphasis placed upon risk
    assessment, BAIA, risk management, and safety and security
    management in this course.

> B. The **ten-step** approach.

1.  Obtain **top management commitment** (expanded by this author to
    include commitment at all levels of the organization).

```{=html}
<!-- -->
```
a.  This point has been continually emphasized. **Significant resources
    (hours and dollars) are required** to support the development,
    testing, refinement, and maintenance of a realistic and useful plan.

b.  As stated by Don Edwards in his article "The Contingency Planner,"
    **"If you don't have that commitment, you don't have a plan"** (p.
    16).

c.  Obtaining top management commitment requires an understanding of the
    total scope of what needs to be done to develop and maintain an
    integrated plan. Obviously, top management must also realize the
    benefits of having a plan. Essentially, they must be convinced that
    the **resources expended are an investment in the organization**
    rather than just another cost of doing business.

```{=html}
<!-- -->
```
(1) **Sound analysis** (risk assessment and BAIA) and risk management
    decisions will help make the case for planning. Results should be
    documented and clearly communicated to top management.

(2) Top management should also realize their **personal responsibility**
    to protect and preserve the resources of the business and the
    potential business and personal legal liability for not doing so.

```{=html}
<!-- -->
```
(a) This topic will be addressed in more detail **later in the course.**

(b) At this point, suffice it to say that disaster preparedness,
    including contingency planning, **is an emerging legal liability
    issue.** As Kevin Cronin explains in his article "Legal Necessity,"
    "Considering the costs of defending corporate lawsuits -- much less
    the cost of losing such suits -- business recovery planning is not
    just smart. It's a bargain."

```{=html}
<!-- -->
```
d.  Contingency planning is **not only work for the planner,** it is
    work for almost everyone in the organization. Members of the
    planning team (described in session 7; see step 2 below),
    stakeholders, survey respondents, all levels of management, etc.,
    will have to devote time and effort at all junctures of the planning
    process.

```{=html}
<!-- -->
```
(1) The contingency planner needs their **cooperation** **and
    participation** since they will be the end users of the product
    (plan).

(2) A **necessary, but not sufficient, condition** for obtaining their
    support is the **public declaration** of top management's
    commitment. A signed document (memo) by the chief executive officer,
    stating her/his support and directing support at all levels, can
    help facilitate this cooperation.

(3) Additionally, the contingency planner should take steps to make the
    process **a team effort.** This includes selling of the value to the
    individuals as well as the business, and sufficient awareness
    training.

```{=html}
<!-- -->
```
2.  Establish a **planning committee.**

```{=html}
<!-- -->
```
a.  The planning committee (team) was discussed in session 7. As a
    **minimum** it should include representation from all functional
    areas of the business. The *Emergency Management Guide to Business
    and Industry* lists input from the following areas as essential:

```{=html}
<!-- -->
```
(1) **Upper management.**

(2) **Line management.**

(3) **Labor.**

(4) **Engineering and maintenance.**

(5) **Safety, health, and environmental affairs.**

(6) **Public information officer.**

(7) **Security.**

(8) **Community relations.**

(9) **Sales and marketing.**

(10) **Legal.**

(11) **Finance and purchasing.**

(12) To the above could be added **other stakeholders** including: local
     government representatives, representatives of local citizen
     groups, customers, suppliers, and stockholders.

```{=html}
<!-- -->
```
b.  Team membership should be **broad enough** to include relevant
    perspectives but **not so large** as to be unmanageable.

c.  It is essential that the team members **have the time to devote** to
    the effort and the interpersonal skills necessary to communicate
    with others who will provide input to the planning process. An
    estimate of the time required to meet team commitments and the
    schedule for planned team meetings (e.g., every Thursday from 9:00AM
    --11:00AM), should be provided to the team members and their bosses
    for their approval before members are appointed to the team.

```{=html}
<!-- -->
```
3.  Perform a **risk assessment (and BAIA)** as explained in previous
    sessions.

```{=html}
<!-- -->
```
a.  The article discusses using **disaster scenarios** for conducting
    the risk assessment and BAIA, which is an accepted approach
    consistent with the methods discussed in previous sessions
    (identifying vulnerabilities and assessing their impacts).

b\. The statement is made, "The plan should provide for the **'worst
case'** situation: destruction of the main building" (emphasis added;
Wold p. 16). Other articles and texts also encourage planning based on
"worst case" scenarios.

(1) Remember that **risk is made up of two components: probability and
    impact.** Choosing the "worst case" scenario immediately focuses on
    the impact of risk without fully considering probability.

(2) Risk management and risk-based decision making (covered in
    session 10) **require the consideration of both** components to
    formulate risk strategies.

```{=html}
<!-- -->
```
(a) **Decisions are made and controls are implemented** to reduce
    probability and/or reduce impact to a level where the risk is
    considered acceptable or where further reduction is not economically
    feasible (**sensitivity** -- susceptibility to specific controls).

(b) Some high-impact events are considered to be of **such low
    probability** (e.g., the probability of a life-ending meteorite
    striking the earth) that no probability or impact reduction controls
    are implemented.

```{=html}
<!-- -->
```
(3) It makes **little sense to base contingency plans** on scenarios
    that have been determined to be of such low probability.

```{=html}
<!-- -->
```
(a) Better guidance would be to base contingency plans on **"realistic
    or credible scenarios"** that reflect the results of risk assessment
    and BAIA and risk management decisions.

(b) Such planning considerations stand a lesser chance of **overwhelming
    top management,** particularly when a business contingency effort is
    just starting in an organization.

```{=html}
<!-- -->
```
(4) All this said, **prudent business contingency planning** should
    probably consider the "credible" (called "worst case" in the
    article) scenario of the **destruction (or lack of access) to the
    main building, primary data bases, and information sources.** Unless
    a business is located in such an area or has instituted controls
    that reduce the natural, technological, and human-induced risks to
    such a low level, the probability and likely impact of the
    building's destruction or lack of access will be sufficiently high
    to necessitate alternate site planning as a risk-control measure.

```{=html}
<!-- -->
```
c.  Scenario development (primarily for plan testing) is addressed in a
    **subsequent session.**

```{=html}
<!-- -->
```
4.  Establish **priorities for processing and operations** (BAIA
    function covered in previous sessions).

```{=html}
<!-- -->
```
a.  The emphasis here is on **prioritization of functions and
    processes** (the article emphasizes information-processing systems)
    by the maximum amount of time they can be disrupted. Not every
    function and process needs to be restored immediately.

b.  A key point made later in the article (step 7) is, **"The structure
    of the contingency organization may not be the same as the existing
    organization chart"** (Wold p. 18).

```{=html}
<!-- -->
```
(1) It is important to remember that effective business contingency
    plans **focus on the critical business functions and processes
    first.**

(2) The goal is not to resume, recover, and restore all business
    functions and processes immediately, but to **resume those**
    necessary for conducting operations at a predetermined acceptable
    level.

(3) As time progresses and the emphasis shifts from **resumption to
    recovery to restoration,** **lessons learned** through plan testing
    and/or actual crisis management might result in organizational
    changes aimed at improving day-to-day operations as well as crisis
    operations.

```{=html}
<!-- -->
```
5.  Determine **recovery strategies** (risk management function covered
    in previous sessions).

```{=html}
<!-- -->
```
a.  The emphasis of the article is primarily on controls designed to
    lessen the consequences and impact of hazardous events during the
    recovery phase of operations. Although the article focuses on
    information processing systems, **all aspects of the business should
    be considered.**

```{=html}
<!-- -->
```
(1) Terms such as "**hot sites," "warm sites," "cold sites," and**
    **"reciprocal agreements"** are introduced in the article. These
    terms will be covered in a subsequent session.

(2) The criticality of and expenses associated with **information system
    restoration** and recovery following a crisis are generally a major
    concern in the overall crisis management and business continuity
    planning cycle.

```{=html}
<!-- -->
```
b.  It is also essential to step back from recovery and look at
    **response strategies and actions** as part of the overall plan. In
    the response immediately after or even during a crisis, the areas of
    concern/actions below should be addressed in this order:

```{=html}
<!-- -->
```
(1) **Personnel life and safety issues.**

(2) Minimize the continuation of damage **(damage control).**

(3) Commence the **primary notification** of personnel as called for in
    the plan.

(4) Conduct a **damage assessment.**

(5) Determine the **appropriate response** for the crisis; if
    appropriate, formally declare a crisis (disaster).

(6) **Mobilize personnel and resources** based on the decided upon level
    of response.

```{=html}
<!-- -->
```
6.  Perform **data collection.**

```{=html}
<!-- -->
```
a.  The article provides a **list of materials and documentation**
    essential to business continuity.

> b\. These materials and documents **should have been identified** in
> the risk assessment, BAIA, and risk management functions. As a **check
> to insure completeness,** it is a good idea to direct a specific
> effort at identifying those materials and documents essential to
> business operations and to specifically list them in the plan.
> Additional coverage of this topic (an essential records program) is
> provided in the next session.

7.  **Organize and document a written plan/s.**

```{=html}
<!-- -->
```
a.  **General guidelines** for plan/s development:

```{=html}
<!-- -->
```
(1) A business contingency plan is **not complete in every detail** for
    dealing with every possible crisis.

> \(2\) A business contingency plan is a written document that provides
> a **general methodology** to deal with a general crisis. The impact
> (on a business) of the destruction of a facility due to natural,
> technological, or human-induced disaster, is generally the same. It is
> the **consequences and impact** that require response, restoration,
> and recovery planning and **not the cause** of the disaster.

b.  **General contents** of the plan (answers to who? what? when? where?
    and how?):

```{=html}
<!-- -->
```
(1) **Who?** -- Assigned responsibilities to key personnel and
    alternates.

(2) **What?** -- Resources required to resume, recover, and restore
    business functions and processes.

(3) **When?** -- Time frames for resuming, recovering, and restoring
    business functions and processes.

(4) **Where?** -- Location/s for resuming, recovering, and restoring
    business functions and processes.

(5) **How?** -- The policies and procedures necessary to guide the
    resumption, recovery, and restoration of business functions and
    processes.

```{=html}
<!-- -->
```
c.  **Plan/s development.**

```{=html}
<!-- -->
```
(1) Earlier in the session, a number of component plans were mentioned
    (emergency response plan, incident management plan, corporate crisis
    management plan, corporate crisis communications plan, disaster
    recovery plan, business continuity plan). They can be developed
    **separately or in one overall planning effort.**

```{=html}
<!-- -->
```
(a) In a small business, **one plan may suffice.**

(b) In **large businesses,** it is generally more efficient to **divide
    the plan** into specific functional or process areas and assign
    responsibilities consistent with organizational positions.

(c) The business contingency planner may be assigned **responsibility
    for overall plan development,** but specific responsibilities for
    developing **plans for specific functional areas or processes**
    should be assigned to the managers having this responsibility on a
    day-to-day basis.

```{=html}
<!-- -->
```
(2) Regardless of the scope of the overall or individual plans, they
    **must be coordinated and integrated** to provide maximum benefit to
    the business.

```{=html}
<!-- -->
```
d.  **Plan content.**

```{=html}
<!-- -->
```
(1) Plans will differ in specific content and level of detail, depending
    upon the business, the resources devoted to the effort, and the
    business's culture. As a general guideline, the contents of an
    integrated business contingency plan should include (FEMA pp. 17,
    18):

```{=html}
<!-- -->
```
(a) **Overview and introduction** (executive summary).

(b) **Elements of emergency management.**

(c) **Emergency response procedures.**

(d) **Supporting documents.**

```{=html}
<!-- -->
```
(2) More **detailed explanations** of each of these types of content
    will be included in the next session.

```{=html}
<!-- -->
```
8.  Develop **testing criteria and procedures.**

```{=html}
<!-- -->
```
a.  The plan should be **tested periodically:** The article and other
    references recommend at least annual testing. Additionally, plans
    should be tested when significant changes occur to the business'
    internal or external environment.

```{=html}
<!-- -->
```
(1) **Ask the students,** What are some **changes that would necessitate
    a test of the plan?**

> \(2\) Some **possible answers** would include a high turnover of
> personnel; a new product line; new ownership; proximity of potentially
> dangerous materials, etc. The article by Randall A. March, "Is Your
> Recovery Plan 'Done'?" provides some additional ideas.

b.  **Objectives for testing** the plan include:

```{=html}
<!-- -->
```
(1) A check to ensure **completeness.**

(2) Determining the **feasibility and compatibility of backup**
    facilities and procedures.

(3) Identifying areas in the plan that **require modification.**

(4) Providing **training to personnel** in their specific
    responsibilities.

(5) Demonstrating to internal and external stakeholders the **ability to
    respond and recover.**

(6) Maintaining **organizational visibility** of and support for crisis
    management and business continuity functions.

```{=html}
<!-- -->
```
9.  **Test the plan.**

```{=html}
<!-- -->
```
a.  The test should be based upon a **realistic scenario** that does not
    overwhelm the participants but is comprehensive and challenging
    enough to **adequately meet these objectives.**

b.  The complexity and extent of testing should **start at a fairly low
    level** with walk-throughs of sections of the plan and minimal
    disruption of on-going business operations.

c.  Problems with the plan identified in the testing should be
    **documented and corrected.**

d.  Eventually, testing will rise to the level of **full exercises**
    with minimal simulation. Such exercises have significant costs in
    terms of dollars and hours but are necessary to prepare for future
    crisis events.

```{=html}
<!-- -->
```
10. **Approve the plan.**

```{=html}
<!-- -->
```
a.  Plans should carry the **stamp of approval of top-level management**
    in the form of a written statement that clearly acknowledges their
    support and responsibilities and assigns subordinate
    responsibilities throughout the organization.

b.  The plan should also include a **statement of top management's
    commitment to review, test, and refine the plan** on an as-needed or
    at least annual basis.

```{=html}
<!-- -->
```
II. This presentation of the overall business contingency planning
    process **starts and ends** with the necessity for **top level
    management's commitment.**

```{=html}
<!-- -->
```
A.  Direct the students to **individually complete** the following
    **written assignment** for the next class session. The next session
    will start with a class discussion of their work.

B.  You have just been hired as the "business contingency planner" for
    XYZ Company, a medium-sized (200 employees) manufacturing company
    located in the suburbs of Boston, Massachusetts, that produces fire
    detectors for home and business use. Your market is primarily the
    New England area, but you do ship some of your detectors (10%) to
    customers throughout the United States and internationally. The
    company's CEO and principal owner has read Wold's article and has
    directed you **to prepare a one-page statement expressing the
    necessity for "business contingency planning" for the business and
    his personal support for the process to kick off a planning
    initiative.**

```{=html}
<!-- -->
```
1.  **Prepare a one-page letter** addressed to "All XYZ Company
    Employees:" for the CEO's signature.

2.  **Be prepared to discuss your letter with the class** at the start
    of the next session. Make a second copy of the letter for your
    personal reference during the class discussion.

Supplemental Considerations:

Wold's article, the FEMA *Emergency Management Guide for Business and
Industry*, Lerbinger's text, and *Business Resumption Planning* all lay
out sequences for business contingency planning that are essentially
identical and are consistent with the crisis management and business
continuity model. Wold's article with its 10-step approach was chosen
for use in the session for no other reason than that it is readily
available on the internet and provides more detail than the other three
descriptions. If the difference among the publications causes confusion
for the students, the instructor should consider leading a discussion of
the similarities and differences of the approaches. A comparison of
Wold's 10 steps and of the 13 steps in *Business Resumption Planning* is
very straightforward.

The point made under step 2 concerning planning based on "worst case
scenarios" should be emphasized. Plans should be based on the results of
the risk assessment, BAIA, and risk management functions which consider
both the probability and impact of risks. Jumping to the absolute "worst
case" scenario can stop the planning process dead in its tracks or lead
to the over-commitment of scarce resources.

The written homework assignment should indicate if the students have
grasped the importance of business contingency planning. The strategic
goal of "ensuring organizational survival and economic viability," has
been stressed several times and probably should appear in the student's
letter for the CEO.