Fail to prepare and prepare to fail

Coop Systems’ Chris Alvord discusses business continuity strategies for today’s global organisations.

“Older BCM software is not designed to manage the diversity of group level activities managed with decentralized processes”
-Chris Alvord

How has the issue of disaster recovery and business continuity increased in significance in recent years?
Chris Alvord. The biggest change is that many organisations are reviewing business continuity management (BCM) practices at the group level. This is a clear reversal of the past, where these programs tended to fragment along geographical, functional and business lines. There were many reasons for these past practices. Disaster (IT) recovery and business continuity reported to different people. Individual business units had enough power to go forward alone. Various country-specific units had special needs. There was no C-Level executive responsible at group level for the whole BCM program. Software wasn't commonly available to pull all the pieces together. Powerful new forces have caused a review of these old practices. Global supply chains can't tolerate weak links in the enterprise.

Overall BCM administration costs are too high if programs are uncoordinated. An appreciation for the benefit of risk management at the group level has arisen. A new generation of software can now pull it all together. There is also a new C-Level officer who can enforce and fund necessary changes, the Chief Risk Officer. For whatever reason, the result is the same. Group level wants all BCM practices in the organisation to coordinate their activities for a comprehensive organisation-wide view of operational risk.

What challenges do they face?
CA. The biggest difficulties are organizational resistance, local standards, information requirements and supporting software. Most large organisations have never centralised all BCM authority. As with most fundamental changes, there is organisational resistance. Executives are threatened by a reduction in their authority. Existing staff is not used to crossing corporate boundaries. More funding is needed to support central staff and infrastructure. BCM at group level may lack expert BCM staff used to working across business and functional lines.BCM standards can vary widely. A global survey in March 2007 showed several commonly used standards. Depending on the country and professional focus of the respondent, these were BS25999, NFPA 1600, HB 221:2004, HB 292-2006, BS ISO/IEC 17799:2005, and SS540

Local differences in key data in one market may be useless in another. A small example would be the Social Security Number, crucial in the Unites States, where the United Kingdom uses the National Insurance Number instead. Even more problems are created by language, currency, time zone and data convention differences. Older BCM software is not designed to manage the diversity of group level activities managed with decentralized processes. Their central data or process model means that all changes need to be done by an expert central group. Inevitably such a group runs out of time, money and/or expertise as they try to accommodate the endless number of local and regional group needs.

What are the common mistakes with business continuity?
CA. First, BCM is like other large, complex projects, often viewed as all-or-nothing efforts and creating great risk. The Standish Group International is a well-known firm based in Boston that for years has tracked large scale project successes and failures. Their most 2009 CHAOS Survey found that 24 percent failed, 44 percent were challenged and 32 percent were successful. The antidote is to organise a large project as a series of efforts over time, with incremental deliverables and measurable success. Paired with agile implementation methods, putting a premium on speed and flexibility, this segmented view of projects has a better chance of success.

Second, procuring software with a rigid central data model to manage decentralised group BCM needs makes no sense. Instead, use software that can enforce a central set of organisational requirements while permitting the addition of local aspects (data, design, languages) by local administrators. This also avoids the 'boil the ocean' tendencies of older methods.Third, look for an existing support network from vendors and their partners that allows for group-wide needs at any time of the hour or day. After all, users can never tell where or when a disaster will strike.

Chris Alvord, CEO of COOP Systems, has designed a global BCM software package, been a Certified BCM teacher and Adjunct Professor at NYU, and has published widely. He has a BA from Harvard College, MBA from Harvard Business School and has done doctoral course work at Virginia Tech.