The Corporate Physical: Understanding the risks of your company may be easier (and more important) than you think

“Good Health” can be measured in a variety of ways. Some choose to count calories, others count weight – both their own and that of the gym equipment they push, pull, lift, and pedal. By engaging in healthy behavior, the logic goes, one will be healthy.

The other method of measurement is to be proactive in finding and eliminating the risk of “Bad Health,” in monitoring conditions that may be harmful. In other words, monitoring one’s health and reducing the impact of the highest risks will lead to good health. Fortunately, this trend is gaining ground. Doctors are encouraging patients to check themselves regularly for cancerous tumors, sphygmomanometers (devices used for measuring arterial blood pressure) are popping up in local pharmacies and malls, and the yearly physical is gaining popularity. There is also the new phenomenon of Executive or Presidential Physicals (so named because it is the same given to the President of the United States semi-annually) which are designed to give a comprehensive look at all aspects of the patient’s health. Identifying and attempting to mitigate the risks of poor health before the sickness comes is an effective method for staying healthy. Corporations should use this strategy as well.

Granted, corporations are not the same as people. Only a cartoonist can naturally portray a corporation on an elliptical with monitoring devices clipped to its fingers or waiting patiently at the doctor’s office. But the analogy rings strangely true. Like a person, a large corporation is comprised of a multitude of smaller parts: the sales force (the feet), production (the hands), Public Relations (the mouth), and of course management (the brain). Also like a person, the management team “brain” is unable to be consciously aware of the health of all its parts on its own. While individuals have and use physicals so that experts can identify their health risks, corporations have a multitude of tools. Of these tools one is surprisingly underutilized: the Business Impact Analysis.

A well executed Business Impact Analysis (BIA) is the first step in performing a “Corporate Physical.” The BIA is a component of a Business Continuity Program which identifies a company’s processes, the resources needed to perform them, and the interdependencies between them. Once all processes are identified, they are prioritized in terms of criticality to operation of the business. This provides an excellent macro view of the business and answers questions such as: How long can I shut down manufacturing without affecting operations? What products should I begin producing first, in case of an extended shut down? How long can I go without paying employees? The end result is that management will have a clear picture of what processes are most critical and therefore most important to shield from risk.

A well-developed BIA will tie all process criticality back to the organization’s Core Value Chain, which will segment processes by their value to providing for the customer: Create (Marketing and R&D), Produce (Production), and Distribute (Logistics). Like the circulatory, musculoskeletal, and nervous systems each is vital and interdependent.

In this sense, the BIA provides a picture on what the organization looks like. Executives, especially if they are new to the business or consider themselves out of touch, can benefit immensely from this x-ray of their organization.

A Risk Assessment (RA) is the second part of the Corporate Physical and is usually included as part of the BIA. This critical report identifies significant risks to the business. This includes top exposures (for example, socio-economic risks if in a 3^rd world country, regulatory risks if in a heavily regulated industry, and physical risks such as if located on a fault line or in hurricane areas). The RA will also identify the impact of the loss of certain key aspects to the business such as locations, personnel, suppliers, and technology. Single Points of Failures (SPFs) will be identified and if properly written, recommendations for improving redundancy of SPFs are included. The end result is a picture of what is most at risk in the organization.

The Business Impact Analysis / Risk Assessment is a valuable tool because it provides a comprehensive view of the organization’s ability to recover from an event and how well it may mitigate the event in the first place. Findings and Observations (which MLC & Associates Inc. and other companies provide in their BIAs) provide a roadmap for achieving better health by further mitigating risk and identifying potential areas of weakness in terms of recoverability. When an organization’s C-level executives are presented with the BIA; they are oftentimes shocked by the breadth of coverage. Each and every aspect of a corporation can be organized in terms of the impact its disruption would have on operations.

Leaders have a multitude of tools and metrics available for checking the pulse of their organization. They should not only look at the ubiquitous share price, profits, and market cap for measures on how much money they have, but consider the incredible value of a Business Impact Analysis. In any case, a more complete picture is the best. As the old adage goes, “your health is your wealth.”