Is it warm in here, or is it just me? SAS Institute Inc.'s Pandemic Task Force is crowded around a conference-room table, packed with execs from the company's travel, security, health-care, and risk functions, among others. Its members are seated so close together that it wouldn't be hard to catch a cold—or worse. Which, in an eerie way, makes the point.
The scenarios on the table aren't imminent; there are no confirmed cases of human-to-human transmission of avian flu. But SAS, a $1.7 billion software company, has to acknowledge the possibility. Joanna D'Aquanni, the continuity of business program manager, keeps a mushrooming list of questions: How to persuade SAS's legendarily loyal employees to stay home if catastrophe strikes? How to pay people if the payroll system can't be accessed? Which decisions belong to the company's CEO, Jim Goodnight?
As the threats to companies proliferate, business-continuity planners like D'Aquanni are acquiring new organizational stature—and much tougher jobs. Amalgams of blue-sky thinker, military-style logistics guru, and professional worrywart, they're the folks who make your palms sweat when you see them approaching. "Sometimes people call us the 'doom and gloom people,'" says Marie Johnson, business continuation analyst at Target, "but we have to ask, 'what if?'"
These chief disaster officers are, in a way, the new corporate strategists of this post-9/11 era, intimate with all of a company's inner workings and interdependencies. They know that a power outage could make it impossible to pay vendors, or that the day-care center needs to have more than one exit. More than just about anyone, they actually work across traditional organizational silos, sometimes even reporting to the CEO.
There's good reason for this new cred, of course. In the past two decades, according to consultant A.T. Kearney, direct economic losses from natural disasters alone have quintupled, to $629 billion. Last year brought us Hurricane Katrina, the London bombings, millions of phishing attacks, and the specter of the bird flu. "The amplitude and velocity of change is such that companies are more at risk," says Paul A. Laudicina, author of World Out of Balance (McGraw-Hill, 2005) and managing director of Kearney's global business policy council.
By 2007, according to Gartner Inc., 75% of large companies will have business recovery plans in place. Such plans rarely target a specific disaster; there are too many possibilities to account for. Instead, companies like SAS anticipate the result—say, no IT access for three days, whether that's because of a bomb or a computer worm—and lay out a contingency plan informed by all the business units affected. For avian flu, the results could include sick or dying employees without proper ventilation, or a shutdown of customer support.
The object is a resilient organization that can respond flexibly in any number of situations. When disaster strikes, the preparation helps employees work collaboratively and efficiently—even if the primary emotion they're feeling is fear. "It's all about reducing the lizard brain," the fight-or-flight instinct that leaves people paralyzed in crisis, says Eugene Bridges, SAS's senior director of enterprise planning support. If that happens, SAS hopes, its workers will stay safe—and business will go on.