Business Continuity Management

CASE STUDY: BUSINESS

CONTINUITY MANAGEMENT

COCOA-SASSAFRAS CORPORATION

ASSIG NME NT OVERVIEW

Summary: As a team, students should present their proposed solution to the case. Your

presentation should lay out clear recommendations for how management should

address the problem.

Presentation

Deliverable1:

Case study presentation (in Microsoft PowerPoint format).

Executive Briefing

Deliverable:

Single page case study executive briefing (in Microsoft PowerPoint format).

BACKGRO UND

Hurricane Sandy caused significant damage to major businesses across the United States. Cocoa-

Sassafras Corporation (CSC), a large company operating in the food and beverage industry was affected

by the incident. Some of the major products of Cocoa-Sassafras include chocolate, candies, snacks and

coffee. Headquartered in Oak Brook (an industrial campus on the outskirts of Chicago), Illinois, Cocoa-

Sassafras has manufacturing plants, distribution centers and data centers through-out the US, Canada and

Mexico. But the real damage was cause to CSC’s major distribution center and a data center in the

northeast region where the hurricane hit. While the impact to the New Jersey distribution center was

contained, the Business Continuity (BC) and Disaster Recovery (DR) managers were requested to evaluate

the company’s business risks related to potential disasters in their various facilities and the level of

preparedness to respond to and recover from these disasters. CSC would like your team to prepare a

business case for the Chief Risk Office and BC DR executive steering committee to increase investment in

Cocoa-Sassafras’s Business Continuity and Disaster Recovery initiatives.

COCO A – S ASS AFR AS CORPORAT IO N

Cocoa-Sassafras Corporation (CSC) is a US-based food and beverage company. Their products include:

chocolate, candy, snacks, baking products, coffee, fruit drinks and soda. Two years ago, CSC acquired

Snack World Inc., a medium-sized food company, whose main products are: potato chips, tortilla chips,

dried vegetable chips and seeds. This resulted in a new division within the CSC organization named

“Snacks”.

1 Presentation Deliverables are due only if your team is assigned this case. All others should read the case and complete the

Executive Briefing Deliverable assignment.

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 2 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

In last year’s filing, CSC reported $3 billion in revenue. The biggest share of the product revenue came

from chocolate and snacks. Please see the chart below for distribution of revenue amongst different

divisions. Exhibit one also contains CSC’s financial statements for the past three years.

Since the acquisition, the company has operated two main data centers; one is located in Illinois, within the

same industrial campus as corporate and the second one is located in Philadelphia, PA. The latter is Snack

World’s original data center, which now also serves as an alternate disaster recovery site for the Illinois

data center for CSC. Since the acquisition, CSC maintains two ERP systems: legacy CSC runs on SAP

and Snack World operates on JD Edwards. While most corporate modules have been migrated into SAP,

JD Edwards still handles the manufacturing and supply chain modules for the Snacks division. The table

below is a location chart for CSC’s main manufacturing plants and distribution centers:

Manufacturing Plants Distribution Centers

Plano, TX Main Snack W orld plant

Amarillo, TX Snack W orld plant

Large Sized Compton, CA

Terrell, TX

Cranbury, NJ

Ft Pierce, FL

Vancouver, Canada

Oak Brook, IL CSC chocolate and coffee plant

Deerfield , IL CSC chocolate and baking products plant

Medium Sized Aurora, CO

Eugene, OR

Oak Brook, IL

Toronto, Canada

Tulsa, OK CSC soda, drinks and candy plant

Small Sized Tucson, AZ

Boise, ID

Chocolate 37%

Snacks 25%

Coffee 14%

Soda and Drinks 14%

Candy 7%

Baking 2%

Other 1%

Current Year Revenue (by product line)

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 3 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

Manufacturing Plants Distribution Centers

Bentonville, AR

CSC soda and drinks plant Wichita, KS

CSC candy plant

Newbury, MA

North Platte, NE

Anderson, SC

Bessemer, AL

Saskatoon, Canada

Mexico City, Mexico

Monterrey, Mexico

San Juan, Puerto Rico

BUS INESS CONT INUIT Y AND DIS AST ER RECOVERY

In the past, the Business Continuity (BC) and Disaster Recovery (DR) planning had been ad hoc activities

performed in silos by the different divisions. Through an audit performed six months ago, the Business

Continuity and Disaster Recovery Program was re-initiated and formalized within CSC. The Chief Risk

Officer (CRO) was given the accountability for the BC and DR Program. Since his appointment, he has

formed a BC DR executive steering committee, with representation from the different business divisions,

corporate and IT. This committee provides governance and overall direction to the BC and DR program. In

the first committee meeting, the members defined the objectives of the BC and DR program as:

1. Keep employees safe.

2. Keeping CSC products available and on the shelf.

3. Keep critical supplier, employee and client data secure.

As one of their first work orders, the steering committee created a Business Continuity Management (BCM)

framework (please see Exhibit One). The framework proposes the lifecycle of a BCM program and has

been developed to guide the structure of the overall program.

The CRO hired a BC Director and DR Manager to manage the day-to-day activities of the program. The

BCM framework will be leveraged (as applicable) by the BC Director and DR Manager to implement the

objectives of the program. Below are three initiatives that the BC Director and DR Manager have completed

or started in the past quarter:

1. BUSINESS CONTINUITY PREPAREDNESS

Site risk assessments have been conducted in the larger manufacturing plants and delivery centers.

Threats of natural disasters (e.g. tornadoes, snowstorms, etc.) and man made threats (e.g. proximity to the

airport/chemical plant, etc.) in the respective geographic regions have been analyzed.

A Business Impact Analysis (BIA) was conducted three years ago on select business divisions (Chocolate,

Coffee and Baking Products). However, a BIA has not been conducted since the acquisition of Snack

World. The outdated BIA results identified that highest financial impacts are caused by disruptions to the

following areas of the business:

 The delivery of products from the manufacturing plants to the distribution centers, from the

distribution centers to the delivery branches, and from the delivery branches to the clients.

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 4 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

 The next highest financial impacts come from disruption to the procurement (of supplies to make

the products) and manufacturing of the products themselves.

The BIA also identified which products would have the most negative impact to CSC’s brand image if they

were not available to the clients and their customers. In addition, the BIA identified their peak season

between the months of October and April (starting with the Halloween season through Easter). Through the

BIA, the key dependencies in people, process and technology were identified and a recovery prioritization

was defined.

From the manufacturing side, the plant managers have defined a BC plan for a number of manufacturing

plants to have a split-production recovery strategy should one facility have a disaster. Typically,

manufacturing plants have available capacity that enables a plant to ramp up production levels for specific

products and absorb another facility’s load. For example: the Tulsa plant can absorb the Wichita candy

plant’s load. There are also plants that manufacture different products but have similar equipment and

ingredients. In this case, one plant’s processes can be transported to another plant, with or without some

modifications, to enable continuous product manufacturing. For example, the Oakbrook plant, with some

modifications to its chocolate production lines, can absorb the Deerfield baking product plant’s load.

As a requirement for each facility, facility managers have defined and built pandemic plans. The pandemic

plan defines the action plan to address a significant loss of people (due to illness, injury or unforeseen

circumstances) for an extended period of time.

2. IT PREPAREDNESS

Currently, the two data centers are not integrated. However, the IT resources working at the two data

centers have been cross-trained to support applications and infrastructure in both data centers.

The Philadelphia data center is the primary recovery site for the Illinois data center and the maximum

acceptable recovery time for the SAP system is 14 days in the event of a disaster. However, there has not

been any testing performed to validate the ability to fully recover the SAP system in 14 days.

Based on the BIA, five days without SAP would result in significant adverse impacts to CSC’s revenue. A

system downtime of SAP for five days could potentially result in a 10% loss in revenue for CSC. Moreover,

this would result in several legal ramifications. Similar sized companies who have not effectively recovered

from disasters have been known to be targets of large lawsuits – in some cases class action lawsuits. Apart

from all the above, ineffective disaster recovery would tarnish their brand image.

CSC is looking not just to improve recoverability but also to build more resilience into its systems. The BC-

DR steering committee is looking into cloud as a means to strengthen Business Continuity and IT

Preparedness. Cloud-based solutions will also offer CSC options to integrate the data centers or allow for

real-time fail-over capabilities. Currently, the committee has identified the following concerns and

considerations with the cloud strategy:

1. Costs vs. value for moving to cloud

2. Hybrid (on premise and cloud) vs. complete cloud approach

3. Required design changes (for example, automation of certain applications) to ensure that cloud

solutions can be implemented

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 5 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

3. SUPPLY CHAIN CONSIDERAT IONS

CSC is looking to hedge the risks associated with its suppliers and plans to account for potential supply

chain failures or disruptions in its business continuity plans. The steering committee would like the new BC

Director and DR Manager to be involved in the procurement process.

A majority of CSC’s suppliers for its raw ingredients include cocoa and coffee farmers in South America

and potato growers in the Midwest. Although hurricanes do not occur in South America, there has been

some political unrest in the coffee and cocoa farms that supply to CSC. Worker strikes in Nicaragua, where

CSC gets majority of its coffee beans, has led to a 15% decrease in the country’s overall coffee production

and many farmers abandoned their land and their crops. Meanwhile, CSC also has coffee and cocoa

suppliers in Costa Rica, Guatemala and Colombia.

Back in the states, many of CSC’s corn supply comes from the western and eastern Corn Belt region of the

Midwest. Currently, Midwest farmers face an agricultural production challenge because of the tornadoes

that hit the region during the late spring and early summer months. Strong thunderstorms produced large

hail and damaging winds to many crops. The heavy rainfall and localized flooding soaked soils that caused

planting delays.

The industry in which CSC operates is highly competitive and every minute that its products are not on the

shelves means that CSC is losing market share. In some cases, if CSC leaves the shelf space empty for

too long (1-2 days), a store chain may decide to: temporary fill it with other products, permanently fill it with

other products or drop the CSC brand altogether.

KEY ST AKE HOLDERS

JOHN SMALLING, CHIEF RISK OFFICER

John Smalling is the Chief Risk Officer of Cocoa-Sassafras Corporation. John has overall responsibility for

the Legal, Compliance, and Supervision departments of CSC. His responsibilities include design and

implementation of processes to identify and mitigate legal, regulatory, and all other risks facing CSC. He

has over 20 years of experience in the domain of organizational risk.

John played a significant role in the acquisition of Snack World. He lead a team conducting due diligence

of Snack World’s IT Controls. This was instrumental in providing support to a different team working with

CSC’s CFO conducting financial due diligence. Being close to retirement, John believes this will be a

significant portion of his legacy at the company.

Prior to joining CSC, John was the Senior Vice President in Corporate Risk at Royal Automotive, a car parts

manufacturer with offices nationwide. Before that, he was in Risk Advisory with a Big 4 firm in Detroit, MI.

John holds a B.S. in Finance from Arizona State University and M.B.A. and J.D. degrees from the University

of Denver.

KATIE PENA, BUSINESS CONTINUITY DIRECTOR

Katie has worked at CSC for a little less than a year. She has been a business continuity practitioner for 7

years. She started her career in consulting as a business continuity management advisor for Fortune 500

companies. During her time in consulting, she assisted clients in the review and enhancement of business

continuity management programs, development of Crisis Management plans and facilitation of Business

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 6 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

Impact Assessments (BIA). She has also received a Certified Business Continuity Professional (CBCP)

certification from the Disaster Recovery Institute International.

Before joining consulting, Katie received an undergraduate degree from Florida State University. She

majored in Business Process Management.

JAMES MILLER, DISAST ER RECOVERY MANAGER

James has 2 years of experience in Disaster Recovery. Before joining CSC six months ago, he was an

Enterprise Architect in another food and beverage company for 10 years. In his previous company, James

had the responsibility of developing and testing the disaster recovery plan for the company’s ERP system.

It was for this kind of experience that John hired him into CSC.

James is a Certified Enterprise Architect (CEA) and Certified Information Security Manager (CISM). He

graduated from University of North Carolina with a major in Informatics.

LE ARNING T HE LESSONS OF T HE PAST

The Hurricane impacted operations for almost two days since a number of employees were unable to go

to work due to the effects of the storm. This caused the distribution center to operate at 65% efficiency. The

pandemic plan was activated and the distribution center was back to normal operations after 40 hours.

Based on outdated BIA results, if the New Jersey distribution center had been affected and was out of

commission for three days, it would have had a big impact on the CSC market in the Northeast region.

Similarly, if the New Jersey distribution center were only 50% operational, the market impact would be

evident in 7 days.

On the IT side, the hurricane did not affect the Philadelphia data center. However, it became apparent that,

should the Philadelphia data center go down, no provisions would be made to recovery the JD Edwards

suite at the Illinois data center. As far as the CIO is concerned, their manufacturing and supply chain

logistics for Snack World will remain on JD Edwards for next 12 months, until a full assessment of a possible

migration has been completed.

CSC’s supply chain for raw ingredients is critical to the firm meeting its targets. Due to political unrest,

extreme weather and other regional issues, the suppliers have been facing challenges.

Katie and James have approached you to seek assistance in developing the business case for the CRO to

fund BC and DR investments.

YO UR T ASK FOR T HIS C ASE – PRESENT ING T E AMS

BUS INESS CASE

You have been invited by Katie, the Business Continuity Director and James, the Disaster Recovery

Manager to develop the business case to initiate and fund a series of Business Continuity and Disaster

Recovery projects. After the incident surrounding Hurricane Sandy, both Katie and James want to ensure

CSC is prepared and has the ability to respond and recover from disasters that may impact the company’s

operations. When preparing your business case for the CRO and the executive steering committee to

approve and fund, please consider the following:

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 7 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

1. What risks did you identify?

2. How would you conduct the BIA (Business Impact Assessment)?

 What is the approach and methodology you will use?

 Please consider the CSC team members who will participate in the BIA.

 Identify the criteria that will be used to analyze the impacts of a disruption to CSC’s business.

3. What potential recovery options would you present to reduce the impacts of a disruption and ensure

recoverability of manufacturing plants and delivery centers? Be sure to propose realistic RPOs and

RTOs.

4. What resiliency options would you present for the data centers and the ERP systems?

5. What solutions would you recommend to mitigate supply chain risks associated with coffee and

cocoa farmers in South America and potato farmers in the Midwest?

6. How would you use the results of the site risk assessment and BIA, along with the available

recovery options, to mitigate the risks and improve resilience with limited funds available for

Business Continuity and Disaster Recovery?

7. How would you ensure that the IT and resource capabilities can support the solutions provided

above?

When preparing the case, please ensure that the solution(s) you propose tie in with the risks and impact

assessment criteria identified. You will be presenting to John, Katie and James. Please ensure that you

carefully consider their roles and account for their backgrounds while framing your presentation.

You have been asked for a lot of detailed information to solve this case. The trick will be to package this up

into a digestible executive presentation your audience can understand. Detailed supporting information can

be included in an exhibit in the appendix of your presentation.

Your case study solution should also include:

 Citation of key sources in the form of end notes cited in your appendix.

 Application of standards and leading practices that help to inform your solution.

 Use of the tools from the IT GRC Toolkit found on Canvas.

A few tips and tricks for solving this case:

 Feel free to make assumptions that support your conclusions. Be sure to state your assumptions

in an exhibit in your appendix. Your assumptions should not significantly alter the facts of the case;

rather, they should support the recommendations by filling in the missing pieces of information in

the case.

 You should NOT simply copy/paste from COBIT or any of the other standards. The key is to use

the standards to help you solve the case. Remember: standards are NEVER the answer on their

own; they must be applied to the business problem.

 Incorporate the important aspects of your other MSIS core classes. For example, please

incorporate lessons from your IT strategy and case analysis class. This will be critical to your

success in all your MSIS classes.

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 8 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

YO UR T ASK FOR T HIS C ASE – ALL OT HE R T EAMS

CASE ST UDY EXECUT IVE BRIEF ING

With the volatile environmental conditions surrounding CSC’s data centers, Katie Pena (Business

Continuity Director) and James Miller (Disaster Recovery Manager) is expected to present a one-slider to

the members of the Executive Committee (i.e.: C-suite) to promote discussion / insights around the planned

business continuity and disaster recovery approaches. Your task is to provide Katie and James with a single

slide depicting the following:

 The key benefits of business continuity and disaster recovery approaches for protecting CSC’s data

centers.

 Some anticipated challenges that maybe faced when managing and sustaining business continuity

and disaster recovery.

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 9 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

APPE NDIX

EXHIBIT ONE : COCO A-S ASS AFRAS PROPOSED BC-DR PROGRAM L IFECYCLE

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 10 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

EXHIBIT T WO: COCOA-S ASS AFR AS F INANCI AL ST AT EME NT S

THREE YEAR SUMMARY OF SELECTED FINANCIAL DATA (in thousands, except per share data and other information)

Current Year Last Year The Year Before

Statements of Operations Data:

Net sales $4,135,801 $2,853,238 $2,690,361

Gross profit 761,859 548,275 509,426

Restructuring and other charges, net -924 -63,977 78

Gain (loss) on divestiture 242 -7,223

Income from operations 117,542 39,215 105,837

Interest expense, net -38,306 -33,275 -33,940

Income before income taxes and cumulative effect of changes in accounting principles

87,094 9,848 74,824

(Provision) benefit for income taxes -12,286 -1,857 -18,001

Income before cumulative effect of changes in accounting principles

74,808 7,991 56,823

Net income (loss) 74,808 -2,799 -68,782

Basic earnings (loss) per share (a)(c):

Income before cumulative effect of changes in accounting principles

1.82 0.20 1.44

Net income (loss) 1.82 0.07 (1.75)

Diluted earnings (loss) per share : Income before cumulative effect of changes in accounting principles

1.79 0.20 1.43

Net income (loss) $1.79 $(0.07) $(1.73)

Weighted average common shares and common equivalents outstanding:

Basic 37,663 27,779 27,546

Diluted 38,168 28,144 27,839

Cash dividends per share $0.73 $0.42 $0.42

Capital expenditures 75,832 59,293 48,693

Depreciation and amortization of property, plant, and equipment

68,818 48,993 43,517

Amortization of deferred charges, intangibles, and goodwill

4,163 2,776 1,938

Balance Sheet Data:

Working capital 368,460 247,923 292,315

Total assets 2,760,551 1,910,876 1,792,642

Long-term debt 500,195 407,419 432,757

Stockholders' equity $805,917 $543,480 $477,970

Other information:

Employees 21,274 15,610 15,960

Backlog (in thousands) $1,072,171 $718,615 $649,949

Total debt as a percent of total capital 35% 31% 34%

Current ratio 1.22 0.95 1.03

Professors Matt Stoltz and Meera Kesari Case Study: BCM (Cocoa-Sassafras)

Page 11 Master of Science in Information Systems: IT Governance, Risk and Controls (IT GRC)

THREE YEAR SUMMARY OF SELECTED FINANCIAL DATA (in thousands, except per share data and other information)

Current Year Last Year The Year Before

Book value per share $19.30 $13.31 $12.05

EXHIBIT T HREE: COCOA-S ASS AFRAS SEGME NT AN ALYS IS

Segment analysis (in thousands) Current Year Last Year Dollar Change

Net sales:

USA $2,813,644 $1,333,358 $1,480,286

Canada 1,558,404 $1,342,565 215,839

Central America 428,159 294,038 85,114

Intragroup sales -164,406 -116,722 -28,230

Total 4,135,801 2,853,238 1,282,563

Income from operations:

USA $35,271 $32,913 $(3,128)

Canada 32,960 26,815 1,676

Central America 48,759 41,780 15

Total 116,990 101,508 (1,436)