With the passing of the anniversary of the Sept. 11, 2001, attacks on the World Trade Center and the Pentagon, corporations continue to come to terms with the fact that they, and the capitalist system as a whole, are now being regarded as terrorist targets.
        In past conflicts, a country's means of industrial production were common and accepted strategic military targets. Today's situation, however, frames a broader target: That target draws corporations, innocent and indiscriminate populations, and the capital behind the economy as a whole into armed conflict with a hard-to-identify, ill-understood and difficult-to-track enemy. 9/11/01's assaults have obviously left behind the appalling human impact and the deep wound that the attacks made on the American psyche and the nation's perceptions of public safety.
        In addition, though, the business community was forced to examine the effects of a radical terrorist attack on its everyday activities.
        Business continuity in many cases was lost in the wake of the strike. And in some cases, entire firms were lost or severely damaged by the events of an attack at a single location. As a result, many companies have begun to explore location strategies to preserve business continuity and to reduce their risk of exposure to catastrophic events.

Redefining Catastrophic Events

Traditionally, corporations planned for catastrophic business disruption from natural hazards - earthquakes, fires, floods, hurricanes, blizzards, tornados, etc. In a natural-hazards scenario, planning for operational redundancy or business recovery typically involved the customer-facing and operations entities (call, contact and data centers, warehouses, and supply-chain concerns).
        In those cases, dispersion of facilities and redundancy across locations - coupled with additional operating capacity at each location - won the company the capacity to level-load activity between or among facilities. That gain, though, came at the added cost of carrying underutilized capacity in the form of facilities, personnel or infrastructure.
        A cost-effective solution to that problem seemed at hand: outsourcing - with external vendors supplying resources in the form of facilities, personnel, equipment and infrastructure in the event of loss of operations.
        The attacks on the World Trade Center, however, caused a different kind of disruption altogether. In fact, the word disruption hardly seems of adequate scale to describe the impact of the attack on businesses located in the area that absorbed the brunt of the attack.
        Locations for which no backup had heretofore seemed necessary - headquarters, front-office and trading floors - were lost outright. And immediate backups were in some cases located within blocks of primary operations. Accordingly, those backups were also directly affected by a combination of transportation restrictions, telecommunications and power outages, and direct damage.
        Companies that had outsourced business recovery to third parties then suddenly found those plans dashed, or at least less than acceptable.
        Most outsource providers found themselves quickly overwhelmed by the sheer volume of requests. Those providers had to prioritize which of their customers would actually get the services for which they had contracted. Even in the many cases where capacity was available, transfer of operations and data was impossible due to the destruction of local infrastructure.

Concentration vs. Dispersal:
A New Model for Business Continuity

Business continuity planning has, as a result, started to adopt a new model - one that can adapt to both natural and man-made catastrophes. Central to this new standard is a re-examination and prioritization of the functions that need to be made redundant.

Chris Steele, Ernst & Young Senior Manager, Corporate Real Estate Advisory Services, is based in E&Y's New York City office.

        Several regulatory agencies (including the U.S. Securities and Exchange Commission) have begun to dictate standards and guidelines regarding the provision of redundant operations - or at least to require companies to be present to defend their continuity plans. These plans must now accommodate primary and long-term data storage, trading operations, front-office and other operations that had previously been largely ignored.
        The method for continuity has also changed. Physical and geographic remoteness once seemingly assured that operations could be safe and restarted. This new set of operations, however, requires that management, personnel and, in some cases, equipment must have the ability to relocate to backup operations to restart the business.

Are Outsourcers the Answer?

Hot or cold sites located proximate to the existing operations and accessible to the residences of key employees and management can fulfill these needs. Those sites, however, can fulfill those needs only if they are located on diverse telecommunications and power infrastructure. Moreover, such sites need to be in locations where transportation infrastructure impacts will not impede access to the second site.
        Outsource providers may be used for some backup operations. There is a new realization, however, that complete faith cannot be placed in any one vendor, and that there is considerable risk in entrusting business-critical functions to third parties.
        Additional due diligence is required to determine a vendor's true capacity for absorbing outside functions. And there is another as-yet unexamined option: the establishment of outsourced business continuity facilities and operations developed, owned, and operated by a consortium of businesses with similar operational needs, but with different risk profiles.

A New Model for Configuration and Location Strategy

The revised business continuity model has a series of inherent implications for business configuration and location strategy.
        Key among these is the question of concentration vs. dispersion of operations. Here, a balance must be struck. That balance must be established between the cost and efficiency savings gained through consolidation with the attenuation of business continuity risk that comes with spreading operations across a wider geographic area.
        It seems logical that companies would use the emphasis on risk mitigation, coupled with the current economic environment, to re-examine the co-location of headquarters or front-office functions with other operations. Where previous thinking would immediately see the cost benefit of moving back-office or support functions to lower-cost areas, the business continuity benefit should start to tip the cost-benefit balance toward reconfiguration for many companies. But once configuration issues are resolved, the company must decide another key issue: How far away is far enough?
        Here again, there is a balance. If management can easily access all sites, including both primary crisis sites, the need for redundant management teams may be reduced and the additional cost avoided altogether.
        That scenario, however, may require the crisis site to be too close to other company operations, exposing it to the same set of risks. This is especially true in the case of most environmental risks. Location at greater distances will increase the chances for business survival. At the same time, though, greater distance will preclude employing most or all resources from the primary site.

The Landmark Location Question

Lastly, there are a series of site-specific location issues specific to the selection of space in landmark facilities, cities or submarkets. Those locations, due to their image, may draw heightened attention from terrorists. The economic, market access, recruiting and image factors for having a landmark address remain extremely compelling when considered apart from risk considerations.
        The calculus of market exposure, central location, access and image, weighed against exposure to hazard and risk, is a difficult and emotional one.
        Each company will need to make informed choices. And those choices will be based on each company's own corporate values, operational needs and the needs of their employees.