- Shopping Bag ( 0 items )
Ships from: Enumclaw, WA
Usually ships in 1-2 business days
Ships from: Enumclaw, WA
Usually ships in 1-2 business days
Awareness and Education.
Business Impact Analysis.
Plan Development: The Myers Process.
Maintenance, Education, and Testing.
Guidelines for Internal Consultants and Consulting Firms.
If economics is the "dismal science," then contingency planning must be "abysmal science." No one likes to look into the abyss. But given the critical dependence of businesses on technology, facilities, and specialized processes, contingency planning for disasters is a rising priority on the agenda of senior management.
Who should do the planning? Who can ensure that the plan is actually workable? The most serious mistake is to have a plan that exists only on paper, without the understanding or support of line managers who would have to use it to stabilize operations following a disaster. The most costly mistake is to have a plan aimed at keeping computers running instead of keeping the business running. The most common mistake is a plan that focuses on computer disasters but ignores potential physical disasters that can render vital buildings inaccessible or critical operations inoperable.
HOW MUCH MARKET SHARE WILL IT COST YOU?
A disaster could happen to you, for whatever reason-- fire, explosion, sabotage by a disgruntled employee or former employee:
PROTECT AGAINST WHAT?
For many years, the only concern for contingency planning seemed to be the temporary loss of data processing capability because that was the area first targeted by outside auditors. In fact, the real threat to business continuity is in the loss of vital buildings or critical production or distribution operations resulting from natural causes, sabotage, or environmental conditions. Outside auditors and internal auditors are pressing management to extend their contingency plans for computers to include protection against the temporary loss of access to buildings. The problem is that the mindset, policy and strategy, and approach that were successful in addressing contingency planning for data processing are not appropriate for facility contingency planning.
Facility contingency planning is an exercise in long-range strategic planning and, as such, should be conducted by a "neutral" facilitator, not someone in a line organization or information systems staff. The detailed specifications and procedures required to back up and restore computer data are not needed to ensure business continuity in operating departments. It is difficult to keep information systems personnel from unconsciously gravitating to more and more detail because that is the way computer systems are designed. Information systems should be responsible for identifying data processing restoration strategy; a staff planner or outside facilitator should be responsible for developing facility contingency plans.
Mindset is also different between protecting computer processing and protecting against loss of facilities. If computer equipment is damaged or destroyed, restoring operations requires precise, systematic, tightly controlled and disciplined detailed procedures. The solutions are technical and highly structured; there are few options. This is not true for administrative departments or manufacturing operations or distribution activities. In administrative departments and production operations, there can be several different options that might be used to ensure business continuity, depending on the nature of the physical disaster, the amount of damage, and the prognosis for reentering the building. Implementation of specific actions should be left to the judgment of department managers to decide at the time a disaster actually occurs.
In addition, senior management intuitively understands that a detailed plan covering multiple combinations of types of disaster just does not make sense. They understand that highly skilled individuals head up key departments and that those individuals do not need detailed instructions on how to carry out their responsibilities, they only need to agree on strategies.
CONTINGENCY PLANNING REQUIRES SPECIALIZATION
In determining who might develop a plan, be leery of turning the assignment over to a consulting firm that offers a broad range of services. There can be several problems. Consulting firms shuffle staff between assignments, many times without much hands-on experience in facility contingency planning; this can result in confusion, false starts, time delays, and excessive costs. They usually charge per diem fees, which are counterproductive, tie up key personnel in lengthy meetings, encourage unnecessarily lengthy " weigh it by the pound" reports, and produce "politically correct" reports, all of which drive up contingency planning costs unnecessarily. Most consulting firms are trained in a problem-solving process that emphasizes detail, detail, and more detail; exactly the opposite of "what if " strategies that are the key to cost-effective contingency planning.
INCREASED TECHNOLOGY DEPENDENCY
Today's children are more comfortable with automation and computer technology than their parents are. Is it any wonder that a "generation gap" is a constant in dealing with computers? In but a short time, data processing has advanced from electronic accounting machines, for which each individual step of logic had to be programmed by connecting a wire from one "hub" to another, to technology enabling computers to speak and understand verbal expressions.
In the business world, computer technology has skyrocketed from tabulating historical accounting transactions to the real-time assimilation of complex analog and digital data and the formulation and execution of process control procedures with unheralded quality assurance. Computers have the capability to consistently assimilate variable data, to develop solutions, and to apply that capability to a multitude of business problems.
If we are not careful, this will lead us to a conclusion that all computer systems are indispensable, even for short periods of time. Nothing could be further from the truth. Although computerized "process control" systems may be indispensable in specific production environments, most management information systems are not.
For instance, most people assume that airlines are so dependent on computer systems, particularly passenger reservation systems, that they have already arranged for off-site redundant processing capability in the event of a disaster. Most major airlines do not have off-site redundant computer processing capability, and their most critical system is not passenger reservations, butairplane maintenance.
Redundant off-site processing capability has been rejected because of its cost. They are also confident that computer processing capability will be restored before it causes significant long-term loss of market share.
Why are businesses convinced that computerized management information systems are indispensable, even for short periods of time? For most organizations, computer dependency during a disaster recovery period is a myth precipitated by these factors:
An educational process and the exploration of viable alternatives with the right people are the key to cost-effective contingency planning.
Foreign Corrupt Practices Act
The Foreign Corrupt Practices Act, probably more than anything else, increased awareness of the lack of contingency planning in corporate America.
The Foreign Corrupt Practices Act points out that computerized management information systems contribute to the decision-making process and management's control of operations, and as such, represent the life-line of an organization. It further indicates that management planning related to the continued availability of these decision-making systems has, for directors and high-level officers, an impact on the standards of care. Moreover, these standards would be applied in determining potential liability if, for example, lack of a contingency plan resulted in avoidable business losses. Therefore, management can be held liable for inadequate contingency plans. For highlights of the Foreign Corrupt Practices Act, see Exhibit 1.1.
Unfortunately, the most prestigious auditing firms made a mistake in communicating their interpretation of the Foreign Corrupt Practices Act to clients. The mistake was the context in which contingency planning was addressed in annual management letters. Management letters are traditionally written at the conclusion of an audit to, among other things, highlight internal control weaknesses discovered as a result of their " test of transactions," and recommend corrective action to address those weaknesses.
In management letters, auditors criticized clients for "lack of a computer disaster recovery plan." This was wrong! What should have been criticized was "lack of a business continuity plan in the event of an interruption in data processing capability." Putting emphasis on computer technology rather than on business continuity was the error. Exhibit 1.2 illustrates the impact of the Foreign Corrupt Practices Act on business.
The results of that mistake were compounded by senior management's assigning responsibility to data processing for what should have been a business continuity plan. The problem is that business continuity planning is a type of long-range strategic planning, and results are optimized when orchestrated by a skilled, neutral facilitator. Most data processing personnel are neither skilled in facilitating a long-range planning process nor independent from the solution.
Because disaster recovery and business continuity planning involves long-range planning considerations, it must support the business plan. There are generally three areas of exposure to be addressed:
Although administrative responsibility for functional areas may be controlled by individual departments, contingency planning must be centrally coordinated. Interdepartmental interfaces, dependency of one system on others, and the need to reduce duplicate planning point to the need for a well-coordinated corporate-wide contingency planning process.
DISASTER LIFE CYCLE
In deciding what should be included in a facility contingency plan, it is helpful to understand the different phases of a disaster. Although a complete disaster life cycle consists of four time periods (see Exhibit 1.3), only three deliverables should be included in a contingency plan:
Long-range restoration strategy will depend on the specific nature of the disaster that occurred, damage assessment, and prognosis for re-entering the building. You might be back in the building in four weeks or you might need to construct a whole new facility. So until a specific disaster happens, it does not make much sense to try and anticipate where, when, or how you will resume normal operations. That will be decided later by senior management, and a statement to that effect should be part of the corporate contingency planning policy and strategy.
Risk Management Program
Because most organizations will never experience a serious facility disaster, a risk management program is the only part of a plan that will ever be used; there will never be an opportunity to actually exercise an emergency response plan nor will there be a need to call business continuity strategies into service. However, a sound risk management program is indeed important because it consists of ongoing activities that help prevent the likelihood of a disaster, such as sound physical security measures, and minimizes impact of a disaster, such as storing duplicate computer records off-site so that they can be recovered. Risk management programs should be institutionalized, that is, key responsibilities should be integrated into job descriptions and included in annual performance evaluations. A risk management program consists of all activities and responsibilities, the purpose of which is to reduce the likelihood of a disaster either to a building or to the business functions located in that building.
A risk management program is procedural in format because its purpose is to document ongoing responsibilities.
An emergency response plan is only called into action at the time a physical disaster occurs and covers the first 24 to 48 hours following a disaster. For purposes of this book, it includes primarily issues that demand immediate attention and/ or are prerequisites to maintaining business continuity; however, it does not include strategies for maintaining business continuity during a stabilization period as they appear in the Business Continuity Strategies section.
The most essential issues to be included in an emergency response plan are:
Detailed commentary about treating injuries, healthcare procedures, or other services normally provided by government or municipal agencies, departments, or institutions, are not recommended for inclusion in an emergency response plan. It should be assumed that these agencies, departments, and institutions will perform as expected, although not as quickly in a regional disaster.
An emergency response plan has a checklist format because it consists of issues that should not be overlooked in the excitement and trauma immediately following a physical disaster.
Business Continuity Strategies
Business continuity strategies are pivotal " what if " strategies for maintaining business continuity following a disaster and are developed through highly structured discussions with department line managers and key supervisors. If they are not developed with the right mindset and expectations; are not facilitated by an individual experienced in synergistic problem solving, and do not focus exclusively on basic business functions (not computer systems), they will be part of the problem instead of part of the solution. In a worst-case scenario, one in which a building is assumed inaccessible for as long as six weeks and computer processing may not be restored for up to 10 working days, two strategies need to be addressed:
Developing practical business continuity strategies with line managers is where many otherwise sound plans have foundered. It involves the sensitive encounter of first-line managers and supervisors. Discomfort, insecurity, and even fear are mixed in with their logical and professional responses. If these factors are not acutely understood and carefully dealt with, they can quickly harden into resistance or evasion.
Specialists facilitating development of these "what if " strategies must respect the department managers as well as the delicate structure of an organization's policy. Only then will department managers perceive that their opinions count. It is the one part of developing a contingency plan that it is worth the expense of using a specialist skilled in this highly sensitive process because it involves a different mindset and a unique problem-solving technique.
Business continuity strategies are documented as guidelines because they only represent options. Department managers will determine precisely how they will proceed based on the nature of a specific incident combined with an assessment of damage.
When the economic climate is favorable, contingency planning is last on the list of things to do; when profits are down, contingency planning is the first item to be cut from the budget. Like elective surgery, contingency planning is a discretionary expense. This means that the more costly a contingency planning project is, the more likely it is that it will be repeatedly deferred.
Given that contingency planning is a discretionary cost-sensitive issue, there are two areas on which to focus in such planning:
For a representation of plan building blocks, see Exhibit 1.4.