Why is contingency planning such an alienated concept? Now, some of you may be thinking, “Alienated, but we have our business continuity plans in check, our disaster recovery exercises were completed, we built redundancies, we have conducted and completed risk assessments and business impact analysis, and implemented a defined contingency program. How can he think contingency planning is an alienated concept?”
Well Let us consider the term alienated. How many contingency planners have felt isolated, cut-off from participation, possibly incompatible to the project scope, excluded from budget projections, unsure as to what line of business they belong to, the last member to be included in project development after its been launched, and often their proactive message of insight is overlooked or stifled by management?
While you and I can feel confident and proud for the aforementioned accomplishments, what did it take for us to get this far in attaining that comprehensive contingency plan? What organization woke up one morning and stated, “We need to develop a business continuity program!”
Was it due to some bad dream or overindulgence the night before that caused the heavens to open and angels singing a hymn of “Ode to Redundancy?”
No. We placed our optimism in the planting of the “seed of continuity” on the deluge of news reports, terrorist warnings, weather watches, the recession, cyber attacks, identity theft, and so on, that the harmonious anthem of “Ode to Redundancy” might eventually echo the hollow halls of corporate boardrooms across the world that contingency planning is not just a “buzz word,”, it is a mindset and a culture.
For thousands of years mankind has been inundated with disaster upon disaster – and over the centuries our proactive nature to prepare for the “battle of the disasters” has been displaced and redirected to the mode of a “reactionary culture” towards events; even though we have the foresight and insight to mollify the most common, threat-related events within our time.
Over the past 30 years in the United States (US) alone, humanity continues to be outwitted by disasters. We have been given the data that tells us that disasters are eminent within the vast regions of the globe, but as to when they will occur is an unknown. The Centre for Research on the Epidemiology of Disasters (CRED) Annual Disaster Statistical Review 2009, including supportive data from the National Oceanic and Atmospheric Administration (NOAA) exemplify that from 1980 to 2009 the US has experienced 97 meteorological, hydrological, and climatological disastrous events totaling $719 billion dollars in damages and over 22,850 deaths. The Varolii Corporation from 2007 to 2009 A vendor surveyed various businesses from 2007 to 2009 to determine what threat-related influences are considered in determining contingency planning preparation. Natural disasters (figure 1) ranked the highest in which to manage preparations to outflank nature’s relentless infuriation.
Figure 1 – Disastrous Influences
Yet, as we continue to gather credible data of disasters “most wanted list”, we continue to build cities, resorts, and businesses in disaster prone areas for the sake of commercialism, capitalism and freedom. Believe me, I do not think this is wrong – I used to live in earthquake country for half a century waiting on the BIG ONE to result in “beachfront property” for San Bernardino county residents; now I live in tornado alley. So in order to live, breathe, and continue the pursuit of happiness, in either location’s, preparation in knowing your adversary was and still is always a top priority, as should it be with those who operate businesses in these locations, both large and small.
The Noah Insight Analogy
How many business continuity planners have included in their contingency presentations the great flood of Biblical reference – Noah and the Ark? Selling to management that even Noah was given a plan to prepare for what would be of catastrophic proportion, yet, he followed those plans – because he was given Insight - case closed
His plan was simple. After a recover time objective (RTO) of forty days and nights, his notification alert system presents him with an olive branch indicating that the waters were receding and he will eventually be able to reestablish daily operations as before. Noah opens the doors to the Ark and lets the animals run free to migrate and settle to all the corners of the earth, and he goes on about his life; great story and happy ending. There was no after action report (AAR), no debriefing, no lessons learned (or maybe some); along with a guarantee this will never happen again. Don’t we wish that we were also offered this type of guarantee from our surroundings? Unfortunately, we are not that lucky, and humanity continues to battle disasters of catastrophic proportions.
Therefore, we can surmise that Noah did not move beyond the primary scope of the plan as many businesses do. Can we image just for a moment perhaps Noah’s thoughts after the flood, “Well we managed to ride out this storm, if another flood comes along, I still have the Ark, and we can gather all the animals within proximity, - we should be fine.” How many times have we heard similar types of response from business management? However, this time, Noah’s RTO is unknown, data as to how long the next flood will be sustained may not be provided. What provisions would be needed, how much, and for how long? Was the Ark maintained and sailable? What about all the other resources that would be needed, and in what priority – people, animals, family, craftsmen, vendors, and so forth? What would be his alternate recovery site, therefore, what direction will he sail? Who will manage the operation should he become ill, injured, or succumb to death?
Had Noah had a contingency planner, that person might have ensured the Ark was functional, obtained an inventory list of provisions, a call tree (oops, the phone wasn’t invented), a succession plan, and even a map. We may not have the luxury of advance warnings that Noah once had, but we have the technology and knowledge to provide insight in preparation.
Avoid Second Guessing
Challenging Risk Risk submitted a publication entitled “Integrating Theory into Practical Emergency Management to the International Association of Campus Law Enforcement Administration” (IACLEA) in which they argue that “As long as researched-based theoretical knowledge is omitted from planning, avoidable disasters will continue to occur.”.
In other words, research on behalf of the planner on the ever-changing paradigm of disasters provides for optimum creation of synergetic-driven recovery plans for the client. For years, contingency planners have the use of sound and proven best practices such as those from the Disaster Recovery Institute International (DRII), which have gained a place of distinction within the National Fire Protection Agency (NFPA) 1600, which is one of the three adopted standards Homeland Security and FEMA has recognized as standards for businesses under the Private Sector Preparedness Accreditation and Certification (PS-Prep) program.
Contingency planners should be “riding this wave” of support in the effort to discount the alienation apparition of our reputed transparency. The US and other regional governments, as well as non-profit organizations, have open their doors to a plethora of insight for businesses and humanity to consume and digest in order to regress to our natural origin of a proactive society. In simpler terms, as my algebra teacher asked me to embrace within the following concept many years ago, “We have done the math to avoid second guessing, therefore, follow the path of least resistance and you will be fine”. Don’t we wish this were true in the case of contingency planning? By applying the foundations of insight, continuity planning and planners apply a series of methods, theorems, and practices to mitigate and reassure that the organizations overall sustainability can meet the demands of their core values: customers, reputation, shareholders, revenue, and let’s include sanity. It is because of insight that second guessing is often avoided.
The Renaissance Planner
Certified contingency planners are somewhat like Noah, we have been issued a message to provide guidance or insight to those who will listen and take heed to the knowledge, tools, methods, and advice we provide to our clients to gain the most optimum recovery continuum. The question is “where does the renaissance planner fit in?”
We can often be perceived as the alien, or as I have been told by a fellow planner, the “large elephant” in the room, for we are somehow feared and are seldom accepted or included in any type of business planning. While management saw a benefit of having a contingency planner on board, they seldom find the right fit of beneficial value. Many professionals were placed either within facilities, human resources, security, it, or finance. With that came limited access to other operational entities or barriers imposed upon under the guise of the proverbial “need to know,”, “it’s not within my budget,”, “I don’t have the resources available,”, or “it is not part of the department’s roadmap.”. Under the foundation of contingency best practice, we are directed as contingency professionals to seek the placement of a steering committee that is biased to the interest of their own personal department or division and take a more holistic view in preparation companywide. Similar to a jury, they are to review the facts, the data, and the evidence to offer management the verdict of contingency expectations. Moreover, even within the most predominating industries this is often wishful thinking that further places the organization on a fast track to non-completion. So how might we overcome this situation?
First, let us recognize that contingency planning is not just IT and its recovery; it is the business that needs to be sustainable. It is the employees and other resources that need a structure in how to manage the operation during disastrous events. It is our customers and their perception of our credibility and reputation to provide the services they are paying for. It is our shareholders that have placed their investments in the company and its future. It may be regulatory and governmental specifications which monitor our ability to function as a business. It is the board of directors, CEO, company president, or principle owner that sees all this as the foundation of their business – as does the contingency planner.
Hold on a moment, did we just indicate that the contingency planners know just about as much of the business operations, its limitations, its vulnerabilities, its needs to sustain supportability, as those whom are in charge? Business continuity management can or does spend a lot of time with just about each department within the organization to understand the necessities of sustainability; it resiliency of operations. Think about it! Through various analysis profiles of the company’s business and system attributes, we have gathered just as much total knowledge of the organization than the CEO and other principle members. Therefore, why would there not be a contingency C-level executive in alignment with other similar level executives exclusively for administering contingency development? Contingency best practices clearly resonant that there is a much required executive buy-in and support, along with a business continuity governing policy in-place in which to guide and manage the organization contingency program. To determine what needs resiliency, we must understand what needs protection. Thus goes the same as being true about those who run the business; in order to maintain business they must understand the market to remain a viable entity.
A Level Playing Field
To increase focus and attention with business continuity, the ideal concept would be for the placement of a business continuity senior executive dedicated to contingency planning. Not a CIO or COO; for their agenda and roadmaps often place contingency planning at the end of the line. Having a defined business continuity officer (BCO) or a VP of business continuity would allow for the individual to be on the same playing field with other organizational executives, thus providing knowledge, balance, and fortitude in the placement and development of contingency planning. A recent Business Continuity Management (BCM) Inc. program maturity report clearly supports this concept. Approximately 67% percent of those surveyed indicated an increased program visibility and maximum maturity when under the guidance of the BCO.
Therefore, with a BCO in place corporate objective can attain higher visibility with the placement of a roadmap of contingency project that have been defined and agreed upon by the department senior management. The BCO improves the mobility to complete critical targeted corporate objectives. A pool of subject matter experts can then be assigned to departmental entities, clearly focusing on the directive and establishing partnerships between business and operations. Included within the roadmap is a commitment by management to empower and place an individual within the steering committee who can make business decisions beneficial to the cause. No more volunteers or attempting to recruit a department representative who had no clout or the ability to provide approvals. Operational contingency expenditures will be managed under this executive, thus reducing push back by other departments due to a lack of funding.
This position also allows for defining a key focal structure of managing the declaration of business continuity, reducing the red tape that can hinder and burden the inexperienced individual, thereby ensuring a dedicated contingency resource team is ready to response 24/7 and direct the recovery process.
Nonetheless, we must return from the Land of Oz, for in order to apply insight the seed must be firmly planted into the mindset and the culture of the company’s board of directors, shareholders, and senior management; selling the proactive culture and benefits of business continuity. It may be or sound unfortunate that for some organizations, they have opted to accept that as disaster displacements occur and are overshadowed by the need for profit and expansion, sustainability or “durable resiliency,”, contingency planning is perhaps a “once in a organization lifetime” itinerary that can be off set by force major, safe harbor laws, or accepting the cost of the risk as an actuarial condition of doing business.
Others may believe that contingency planning is overrated and managed by the “what-if” cartel. The cartel spreads its fear of doom with the hopes of one day stating “we told you so!” We can then grab our fifteen 15 minutes of fame, perhaps a book or movie deal, or travel the lecture circuit. Sounds good; but that is not our job.
Some believe contingency planning has reached its apex, and might eventually become extinct. However, we do not foresee disasters becoming extinct. Volcanoes that were perceived as dormant are erupting resulting in extensive damage and injuries, and shutting down our airways. Political rhetoric has caused numerous radical factions to boldly emerge, placing everyone in a state of fear and confusion about what or who will be next in the crosshairs. Governments around the world are playing a mindboggling game of chess to see who can outwit its opponent with threats of war or retaliation. Cyber infiltration is increasing and our ability to protect confidential information is a constant stressor. Even Mother Nature does not want to be left out of the three-ring circus of disaster laden calamities.
Nonetheless, we professionals in the business have a pride and ethic similar to the 300 Spartans during the Battle of Thermopylae. We have the tenacity, intelligent, experience, and the tools to mitigate many of these foes; so we ask you to make the best possible use of our insight for your benefit. Because, we are neither aliens nor the large elephant in the room; we are your partners in sustainability.
You know, I think Noah would be proud.
About the Author
Richard A. Jurado, CBCP, is a project manager consultant for IBridge Solutions, based in St. Louis, MO., servicing business continuity and disaster recovery planning for a Forbes 500, privately own organization. With over more than 25 years experience in facility/property/construction management and 10 years contingency planning, Richard Jurado is a hands-on, frontline producer of contingency planning design and developments for organizations from California to the Mid-West, as well as governmental agencies.