A Broader View of Disaster Recovery
- Published on October 1, 2009
- Written by LEE YEATON
The current recessionary economy is putting tremendous pressure on businesses. Management has slashed capital expenditures and operating costs as organizations trim redundancies. Companies face increasing pressure for compliance amid a more demanding regulatory environment. But without redundancies, businesses are finding themselves without the in-house printers, inserters and postal processing equipment they need to keep operating in the event of an unexpected interruption. And without the ability to ensure business continuity, they also run the risk of not complying with state and federal regulations.
In other words, the need for business continuity and disaster recovery services has increased just when in-house capabilities are disappearing. This is why the business continuity plan is receiving new focus in many corporations, becoming a key concern at the highest corporate levels.
Planning Beyond Data Loss
In many companies, disaster recovery planning is data-centric, but the goal of recovery is business continuity, starting from the data but going all the way through to hard copy output. Therefore, wider concerns must be addressed beyond data recovery, such as:
- How much cash does your organization have on hand to continue operations if cash flow were disrupted? How will cash flow be recovered?
- How can compliance with federal and state regulations be maintained?
- How soon will market share start eroding after losing touch with customers?
- How could a business interruption impact Wall Street valuations?
It is absolutely critical to review your company’s business continuity plan in the context of these issues. If your company doesn’t have a truly comprehensive plan, you should begin creating one now. Business disruptions are beyond your control, but your response to them is not.
Developing the Business Continuity Plan
DRI International’s 10 Professional Practices for Business Continuity Practitioners provide key overall guidance, as does the Business Continuity Institute’s (BCI’s) Good Practice Guidelines. Here are some important areas to focus on to create an effective solution.
First, determine where to put your efforts. What a business continuity plan encompasses will vary. The breadth of applications requiring business continuity services can include:
- Transaction-based bill and statement processing
- Payroll, treasury, travel & entertainment, and healthcare reimbursement checks
- Insurance policy production and ID cards
- Explanation of Benefits in the healthcare industry
- Financial transaction reports, brokerage statements and trade confirmations
- Utility cancellation, shut-off and treatment notices
- Other personalized documents such as privacy statements
- Internal financial reports
- Coupon and payment books
Then, pay close attention to the following practices:
Compare the business recovery services needed with the available in-house capabilities to provide such services. Look for gaps between your expectations and the recovery solutions in place. Examine business guidelines and determine what gaps exist in your company’s ability to meet them if an interruption occurs.
Assess the risk your company could face in the event of an interruption in business and resulting penalties. Determine the financial implications of revenue loss from cash flow disruption and the cost of borrowing funds to continue operations. This is particularly important because cash is now more valuable than ever. Also, assess the financial implications of fines and penalties that may be incurred. Regulatory issues covering documents and communications must be reviewed for all federal and state regulations your company operates under, such as Gramm Leach Bliley, HIPAA, and Sarbanes Oxley.
Cost Benefit Analysis
Determine how to plug the gaps. A precise evaluation of each risk will size its benefit. This helps determine what level of business continuity plan makes sense for your business and what kind of capabilities you need to put in place.
Service Provider Solutions
Today, because of cost considerations, most companies do not want to invest in and maintain internal redundancy to ensure business continuity. In this environment it makes sense to use third party service providers, who can provide leverage, metrics and transparency without adding to real estate or capital investments. Some service providers can give you a dedicated third-party “hot” site that offers the necessary people, processes and technology on a 24/7 basis. They typically offer service level alternatives at different price points. And their broad range of experience often helps them better understand what the key risks are in your business.
A service provider should have a comprehensive knowledge of disaster recovery and business continuity services, along with the technology, testing resources and the ability to respond quickly to any situation. Business recovery demands expertise in print, mail, postage and quality assurance, and service providers can have extensive experience in these areas. Also, the provider should execute with proper documentation and controls, taking responsibility for some of the best practices you want to have in place. Finally, you want a service provider to ramp up quickly and seamlessly when an interruption occurs, with capabilities and processes that are tested and validated.
It should be emphasized that regular testing of the business continuity plan is vital to determine if holes have opened up. Business environments are ever-changing. Process modifications can have unintended consequences that negatively impact disaster recovery. Testing is the only way many of these problems can be detected. Telecommunication systems should be tested monthly, while the entire recovery process should be tested one to four times per year.
Enterprise Risk Management
When developing and implementing a business continuity plan, try to think in the broadest possible terms. Enterprise risk managers should consider that if a business interruption were to occur, what could bring the company down?
Data recovery is important, but once you have that data, look at what you’re doing with it. Think about what people aren’t considering, such as the importance of printing, collating and postal processing capabilities in ensuring business continuity. Take a holistic look across business silos.
Remember, most business interruptions aren’t caused by natural disasters, but by man-made events. For example, diesel fuel escapes through a leaky valve while no one is in the building; a forklift crashes into an electrical box and wipes out billing operations. A thoroughly thought-out business continuity plan will provide more ways to respond while maintaining cash flow, compliance and your competitive edge.
Lee Yeaton, vice president of business recovery services, has accountability for developing and growing the Pitney Bowes business recovery and transaction mailing operations. In this role, he is responsible for securing channel partners that integrate Pitney Bowes technology, software and services into their core offerings to support transaction mail and business recovery operations. During his 34-year career with Pitney Bowes, Yeaton has held senior management positions in many of the company’s business units, and is co-founder of the company’s business recovery center.