Business Continuity Strategies

Protecting Against Unplanned Disasters

Kenneth N. Myers

• Publisher: Wiley
• Year: 2017
• Print ISBN:
  9780470040386
• Edition: 3
• eBook ISBN:
  9781119461135
• Topic: Business
• Subtopic: Leadership
• Index: Business

Cost-efficient business contingency and continuity planning for a post-9/11 and Katrina world


Disasters can happen. Contingency plans are necessary. But how detailed and expensive do your contingency and continuity plans really need to be?

Employing a thoroughly practical approach, Business Continuity Strategies: Protecting Against Unplanned Disasters, Third Edition provides a proven methodology for implementing a realistic and cost-efficient business contingency program. Kenneth Myers--an internationally recognized contingency planning specialist--shows corporate leaders how to prepare a logical "what if" plan that would enable an organization to retain market share, service customers, and maintain cash flow if a disaster occurs.

Completely updated throughout to reflect lessons learned from 9/11 and hurricanes Katrina and Wilma, Business Continuity Strategies, Third Edition helps cost-conscious senior management:
* Establish a corporate contingency program policy and strategy that ensures timely completion of a plan, with minimal disruption to operations
* Minimize plan development costs
* Understand the importance of conducting briefings to communicate the proper mindset before the program development process begins
* Save time and money by avoiding a consultant's traditional approach of extensive information-gathering that contributes little to the development of practical solutions, but much in the way of consultant fees

Addressing countless hypothetical disaster scenarios doesn't make good business sense. Business Continuity Strategies, Third Edition helps companies focus on what is necessary to survive a natural catastrophe, workplace violence, or a terrorist attack.

1
DEFINING THE PROBLEM

BUSINESS CONTINUITY CONCERNS

Common areas of exposure to a disaster for a business include:

• Telephone communications
• Computer processing
• Vital facilities
• Critical operations

Telephone Communications

Telephones are often taken for granted; they are seldom out of service except for brief periods, such as immediately following a storm. Older electromechanical telephone switching equipment was extremely reliable. However, consumer demand for more sophisticated service has resulted in a conversion from electromechanical to software-controlled switching systems. The advantage of such systems is that they are easily modified to provide more sophisticated options to customers. The downside is increased vulnerability to periodic interruptions in telephone service owing to software malfunction. Every time computer software is changed, the risk of error increases—error that may lie dormant for months until the weakness is exposed. Moreover, it is unrealistic to expect all software changes to be sufficiently tested to preclude failure. Many of the features are new, and models for testing are, by definition, incomplete. Therefore, it is appropriate to prepare a contingency program that will provide minimum voice communication capability during a stabilization period.

Computer Processing

Financial service organizations cannot operate for more than a day or two without computer processing, as they need this capability to service transactions.

Yet for many other organizations, this is not the case. Although many businesses are dependent on computers for day-to-day operations, it is incorrect to assume that they could not operate without this support during a relatively brief disaster recovery period that might last a week or two. The difficult part is focusing on the right issue—keeping the business running, rather than keeping the computer running.

Operating without Computer Processing Capability

Manufacturers can be exposed to several problems if computer processing is inoperable. However, careful analysis usually concludes that although inefficient, product still can be manufactured and shipped without normal computer processing support. Alternate interim processing strategies and prerequisites for manufacturing without normal computer support need to be negotiated with functional managers. Prerequisites, such as starting points, need to be included in the contingency program to ensure that they will be available when needed. For example, it is not that storeroom inventories cannot be updated without an on-line computer; the problem is lack of a “starting point” or, in other words, a record of what the inventory file looked like when the computer outage occurred. So if a prevention program includes daily responsibility to store off-site a duplicate copy of the storeroom inventory file, immediately following a computer disaster the file could be printed at another location and delivered to manufacturing as a snapshot of inventory locations and availability. Receipts and disbursements could easily be updated with a simple personal computer (PC) spreadsheet until normal computer processing is restored. See Exhibit 1.1 for vital manufacturing support functions.

Headquarters operations can also be exposed to problems if computer processing is suddenly inoperable. However, careful analysis again usually concludes that although inefficient, business still can continue and customers can still be serviced without normal computer processing support. It helps to look at administrative business functions and what alternatives are available to get the job done without computer processing.

---

EXHIBIT 1.1 Vital Manufacturing Support Functions

• Take orders
• Schedule production
• Order material
• Receive and store material
• Control inventory
• Pick items
• Manufacture
• Ship
• Invoice

---

Insurance providers are concerned about issues such as new business underwriting; determining “in force” for claims adjudication; beneficiary information; and exposure for coverage that would have been canceled under normal circumstances. In each of these instances, there are alternative strategies that, although inefficient and cumbersome, can be used to ensure business continuity until computer processing is restored.

Distributors need strategies for taking and processing orders that are normally entered into computer databases, identifying kitting requirements, producing picking documents, inventory management, producing shipping documentation, and handling returns. The question to be asked is not “What problems would you have?”; it is “If confronted with this situation, what would you do to maintain market share and service customers until normal operations resume?”

Associations and agencies are concerned about membership services, legislation and public policy, publications, research, education and training, call centers, and government regulations. In most instances, the overriding consideration is to seek solutions for operating temporarily without normal computer processing capability that will not require continual funding, such as a computer hot-site agreement, but would ensure continuity in servicing members, volunteers, and staff during a stabilization period.

Interim processing strategies for meeting administrative responsibilities without normal computer support need to be negotiated with department managers. The window of expected outage must be determined. For the most part, information systems managers consistently agree that they could restore computer processing capability within 10 working days (14 calendar days). So the question to be asked of department managers is not “How long can you do without …” or “What do you need …”; managers tend to understate and pad the first question, and in response to the second question tend to ask for more than they need. Both questions beg answers and initiate thought processes that are not conducive to cost-effective contingency programs and invite discussions and deliberations that require further documentation and maintenance expense. The only question to ask line managers in relation to doing without normal computer processing is “What alternate strategies could be used to continue functioning for approximately ten days without computer processing capability?” When that question is asked, 99 percent of the responses are positive, that is, department managers are willing to accept operating at less than 100 percent efficiency and admit what could be done to meet the challenge of temporarily working without computer processing.

The simple psychology and willingness of contingency planners to “stick their necks out” and insist on establishing a reasonable limit to an expected computer outage will, in turn, have the positive effect of persuading line managers to admit how they could survive. Establishing this “window” up front is the key to a collaborative solution. But also remember that in establishing the window, information systems managers must also accept some risk and not pad their expected recovery capability. The question is not “When are they absolutely positive beyond any reasonable doubt that computer processing will be restored?”; rather, it is “Given emergency conditions, working 24 hours a day, seven days a week, with adequate resources, when is it likely that computer processing could be restored?” On-line connectivity can wait because there are other solutions available, but being able to process data is the important requirement. See Exhibit 1.2 for a list of typical administrative business functions.

Computer processing problems could be caused by a myriad of conditions. Power grids could fail due to unanticipated drops in demand (as users of questionable systems delay initializing operations, either because corrective work has not been completed or because of other concerns) which are so severe that the power companies must bring down and reconfigure power systems grids nationally. Failures of satellite communications, HVAC (heating, ventilation, air conditioning, and cooling) systems, automated processing equipment, and computer hardware or software are all possible. The broad and diversified nature of this potential problem is such that testing cannot ensure that some systems might not fail.

---

EXHIBIT 1.2 Typical Administrative Business Functions

• Inventory management
• Order processing
• Scheduling
• Billing
• Receivables
• Payables
• General accounting
• Payroll
• Human resources
• Data processing

---

One-time potential problem issues have two dimensions. The first is to identify steps that need to be taken to reduce the likelihood of computer-dependent operations from being interrupted and monitoring compliance with those programs, within reason. Without careful oversight by informed senior management, this approach can wind up being a boondoggle for consulting firms—fear tactics, an inordinate ...

Table of contents

• Cover
• Table of Contents
• Title
• Copyright
• Dedication
• ABOUT THE AUTHOR
• PREFACE
• 1 DEFINING THE PROBLEM
• 2 WORKPLACE VIOLENCE
• 3 FINAL REPORTS OF THE FEDERAL BUILDING AND FIRE INVESTIGATION OF THE WORLD TRADE CENTER DISASTER
• 4 NEW CONTINGENCY PROGRAM PARADIGM
• 5 DEVELOPING A CONTINGENCY PROGRAM
• 6 GUIDELINES FOR DEVELOPING CONTINGENCY PROGRAMS AT MULTIPLE LOCATIONS
• 7 CONCEPTUAL BUSINESS CONTINUITY STRATEGIES FOR LOSS OF COMPUTER OPERATIONS
• GLOSSARY
• INDEX
• End User License Agreement