The average investment in business continuity management (BCM) now stands at six per cent of an organisation’s annual IT budget. However, while 87 per cent of enterprises expect to either increase or maintain their current spending on IT, most are under pressure to reduce costs. It is therefore critical for CIOs to know that their investment in BCM is being allocated in the right place.
All too often, however, BCM spending is directed in its entirety towards centralised data back-up and technology recovery solutions, which fail to mitigate the risks faced by front-line business units.
Efficient – and cost-effective – BCM understands the needs of critical business units in high-risk areas and strikes the right balance between technology recovery solutions and local resilience strategies. This pragmatic approach allows local business units to respond effectively during times of business disruption.
In response to recent high-profile terrorist attacks, economic fall-out from the Lehman Brothers default and worldwide disruption following the 2011 Japan earthquake, a number of companies turned to PA for advice on effective BCM.
Our post-event analysis frequently showed that the needs of local business units, which are sometimes located in the most high-risk geographies, are frequently neglected on the assumption that technology recovery alone will be adequate to ensure business continuity. In fact, this assumption often means that, in the event of a major disruption, critical business units:
are left unable to access systems as they do not have the correct desktop technology
must try to work with systems that have been provided by vendors without adequate recovery plans for the users’ geographical requirements
expect recovery to be much quicker than the IT organisation has planned.
The importance of giving equal weight to technology recovery solutions and local resilience was demonstrated following the major earthquake and tsunami in Japan. According to Keiko Tamaki, COO of Schroder Investment Management in Japan, the company’s BCM focus had always been on data back-up sites and back-up office space utilising remote computing. While this approach enabled Schroder’s central business systems to withstand the crisis, the company suffered from communication problems with its local offices. As a result, Schroder now plans to create a distributed cloud computing servicewhich can provide regional offices in high-risk areas with greater connectivity options.
Immediately after the crisis in Japan, companies also reported issues with voice communication over traditional mobile networks. This meant that communication over Blackberry’s email servers became much more reliable than Japan's domestic mobile telecommunication networks. Reports suggest that those using third-party messaging applications were more successful at communicating with each other than those relying on traditional communication methods. However, only a local recovery strategy would identify the need for change in these areas before it was too late. Similarly, it is worth remembering that every local business unit will have its own challenges: while it is important to learn from the events in Japan, it does not follow that the same response should be applied ubiquitously across global operations.
PA has a wide range of experience providing BCM for organisations in transport, IT, energy, finance and the public sector. This has included producing and testing an improved business continuity plan for the Office of National Statistics. We also conducted a diagnostic of Dublin Airport Authority’s business continuity plans and environment across all its airport divisions.