When it comes to business continuity, your plan might actually be the least important piece of the puzzle, according to an IT executive with The Dominion of Canada General Insurance Company.
“The plan doesn’t matter,” said Jie Chao, assistant vice-president of technology services at the Toronto-based insurance company. “It becomes quickly outdated.
“From a business continuity perspective, planning is everything.”
Speaking at last week’s IT360 conference in Toronto, Chao headlined a panel discussion about the importance of organizational buy-in when protecting your company against potential disasters. The first place to start, he said, is making sure your organization has a business continuity oversight committee, with dedicated lead members throughout various business units.
“You have to replace your business continuity plan with business continuity management,” he added. “Remember, business continuity is just one part of your operational risk.”
In order to gain support for this governance model, Chao said a strong line of communication between IT and other C-level executives is needed. Major triggers such as the 2003 East Coast blackout will surely peak interest, and opportunities will arise when organizations periodically look at risk management.
“When they do, you can lead that conversation and give yourself the mandate,” he said.
But whether or not you have that open line of communication with the business leaders, cold hard numbers will always do the trick.
“Look at quantifying the cost of downtime in areas such as productivity loss, recovery loss, sales loss, and reputation/customer loss,” Chao said. “To quantify productivity loss, for example, look at the total revenue of the company and the amount of people you have working.”
This allows you to calculate the revenue per employee and work out how much you stand to lose if a disaster forces 50 or 60 per cent absenteeism, he said.
“Add up all the categories and you have an aggregated number of potential losses.”
David Ing, the IT manager at Elections Ontario, also spoke on the business continuity panel, bringing a public sector angle to the proceedings. For Ing, his business continuity plan only has to work on Election Day.
“If we can’t get into the head office on an average day, it’s not a problem, but during an event, it would be a major disaster,” he said. Elections Ontario has backup site, if something were to happen on the polling day, Ing added.
To try to limit the impact of a pandemic, Ing said that Elections Ontario has also hired consultants to shadow highly specialized senior technicians and financial experts.
“Basically we were engaging in a person-to-person knowledge transfer,” he said, adding that many highly specialized workers fail to keep documentation about their daily work.
On the topic of pandemics, David Morris, a senior consultant at Mississauga-based business continuity management firm eBRP Solutions Inc. who was in attendance at the panel discussion, offered up his own piece of advice for business continuity planners – stop using the “P” word.
“If you start planning for a ‘pandemic,’ it sounds like something out of a Stephen King novel,” he said. “Because people think it will never happen, you are limiting your ability to convey the message.
“Try using ‘severely reduced workforce’ instead.”
Morris added that planning for the consequences of an incident, rather than a specific incident itself, should also be considered a best practice.
“A hurricane might not occur, but the effect of one could happen in another circumstance,” he said.
At Elections Ontario, Ing said, the organization has gone so far as to embargo all digging and gas work in the City of Toronto on Election Day to ensure everything runs smoothly. But not every potential disaster is foreseeable, he said.
“We arrived at the offices one morning to find all the lights shut off. Our power transformer was destroyed by some raccoons,” Ing said. One day after rebuilding the transformer, another pack of raccoons wreaked havoc on the power supply.
“This gave us a valuable lesson,” he said, adding that a diesel generator was later purchased, along with a battery backup.
But for Chao, the lessons will never stop.
In the event of a large scale power outage, such as the one that occurred in 2003, the access to diesel fuel becomes a primary concern.
“We could never get priority for diesel fuel, so we looked at getting someone who could,” he said. “IBM’s co-location services happen to be fairly close to us and they didn’t lose a second during that 2003 outage.”
Chao remembers a line of trucks outside of IBM Corp.’s facilities looking to pay a high price for the IBM’s stash of fuel.
“After that East Coast blackout, we realized that we can’t do everything ourselves,” he said, adding that having the right service providers in place is also a key aspect of business continuity management.