Nurturing a culture of continuity

Great business-continuity plans need the help of everyone in the company, not just IT.

A management must-have The extended team Step by step

If you find yourself constantly asking upper management to devote more resources to business continuity, then your company needs a cultural makeover. Today’s best-prepared organizations have constructed a culture of continuity, one that results from every business unit taking ownership of business-continuity planning, budgeting and strategy, leaving IT to do what it knows best – operations and logistics.

Such a culture ensures that continuity plans work for the entire business, not just the technology, although that is crucial. Evergreen Investments built such a culture, says Mitch Hodus, vice president of technology operations at the Boston financial services firm.

“The old technical business-continuity plan said that we would restore everything from tape backups, which was fine and cheap,” Hodus says. “But even if all the equipment was at the disaster-recovery site – which it wasn’t – if we started loading from tape 5 minutes after the disaster, it would take us an entire week to get all the systems up.”

U.S. Securities and Exchange Commission (SEC) guidelines say firms like Evergreen need to have critical systems up and running within four hours of a disaster. “So our exposure became readily apparent. And we all worked to get the plan to be more business-driven,” he says.

A management must-have

As with any company-wide initiative, the first step to constructing a continuity culture is getting top management to sponsor the change. For some companies, the impetus comes from outside in the form of regulatory mandates.

“Many companies are faced with new regulatory requirements, like [the Health Insurance Portability and Accountability Act] in healthcare or new SEC rules in the financial industry,” says Suzie Ray, director of Ernst & Young’s Business Continuity and Availability Practice. Top management must inform the board and audit committee on how the company’s infrastructure is protected. “And that means business continuity is being elevated within companies to become a core initiative,” she says.

Recent events and the current business climate also serve to spur top management to drive business continuity throughout the organization. “With two major events in New York in just two years, people can’t put it off and say disasters don’t happen,” says Julian Morris, IT director at Draft Worldwide, an advertising company based in New York. “If you’re not prepared, you go out of business – period.”

Top-level buy-in makes it easier to get everybody involved in business-continuity planning, the ultimate goal. “Our chief operating officer basically told his direct reports that business continuity is important, you will participate or it will impact your bonus. Everyone got onboard,” Hodus says.

John Robinson, director of JR Consulting Partners, a business-continuity firm, agrees. “We write an executive mandate, give it to the chief executive and get him to sign it,” he says. “Then everyone can see it’s a corporate mandate and take it to heart.”

Once you have that mandate, you can ask each department to analyze its processes for risk and continuity contingencies, a key element in building continuity culture. “Every unit needs to think through critical business processes, identify them and decide what the tolerances are,” says Amy Carroll, business-continuity manager at Evergreen. “There are business processes you take for granted that are key. Unless you take the time to analyze that, they can get left out of the plan. But with departments taking an active role, and some prodding from someone like me, you can mitigate that.”

Getting the whole company behind business continuity also helps the budget issue. “In firms with a culture of continuity, the continuity budget is spread across business units,” Ernst & Young’s Ray says. “Everyone owns it, so everyone pays for it. IT shouldn’t bear the brunt of it.”

Gary Foster, CTO at Omgeo, a New York financial application and service provider, goes along with that. “The investment starts out with a technical weight,” he says. “But that changes as you start to spend more on training and crisis management, looking at it from a business point of view.”

The culture also works to get people to budget for continuity almost automatically. “We duplicate all of our mission-critical applications at a recovery site,” Evergreen’s Hodus says. “And so when any department thinks about bringing up a new mission-critical server on the production side, it actually budgets for two, taking continuity into account.”

The extended team

Companies with strong cultures of continuity tend to include business partners, vendors and customers in their plans.

“After 9/11, a lot of companies realized they needed to expand the scope of their plans beyond their own facility, to taking their suppliers, vendors and external customers into account,” Ernst &Young’s Ray says. She says a large Minneapolis retailer she works with was not physically affected by Sept. 11, but it hadn’t planned on U.S. Customs being affected, borders being shut down, its bank being unavailable and customers sitting at home in front of TVs, not shopping in its stores. “They were OK, but everything else wasn’t,” she says.

Foster says that although Omgeo’s New York office was up and running on generator power and was only minimally affected by the blackout in August, many of its customers weren’t prepared. “And frankly, if our clients can’t carry on, we’re not doing much business,” he says. “So 90% of our continuity efforts then were put into assisting our clients.”

Some companies include customers in continuity testing. “We work with our strategic partners, our clients, to design our continuity tests,” Draft’s Morris says. “It gives us a competitive advantage because our clients know they’re getting the best of service and know they can count on us. They take an active part and have a voice in the plan.”

But perhaps the best way to build a culture of continuity is to communicate the importance of continuity analysis and planning on a daily basis to everyone within the company.

The simple things make the difference, such as adding continuity to the regular executive strategy speeches, Morris says. “So the top exec has a speech where he says, ‘This year, we’ll make X amount of revenue, we’re going to increase our training program, be more family-oriented,’ and so on. And part of it also needs to include business continuity as something that’s great, a plus and a benefit, a core competency.”

Step by step Keeping business units engaged in business continuity takes some work, according to John Robinson, director of JR Consulting Partners, a business-continuity consulting firm. >>More

Companies should address business continuity at the point of hire, so that from Day One, each employee knows the priority. Draft delivers a continuity presentation to new hires, includes a continuity handout in the employee handbook and posts the business-continuity plan on the backs of doors and cubicle walls, Morris says.

Another way to keep the idea in the forefront is to give employees a card with a toll-free number to call to get company-specific information during a disaster or continuity situation. “When they call, it tells them whether to come into work or not, and what’s being done at the company at various stages of the recovery,” he says.

Morris concludes, “It’s a lot easier to push continuity into the everyday business culture now because we’ve seen evidence that these things can happen and anything is possible. You might not be able to plan for everything, but you can ensure the key parts of your business, and your people, know what to do in the event of disaster and know how to respond and recover. That’s what’s important.”

Cummings is a freelance writer in North Andover, Mass. She can be reached at jocummings@comcast.net .