DISASTER RECOVERY 
JOURNAL

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276 
Fax: (314) 894-7474
Internet www.drj.com 
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

MANAGING EDITOR
Jon Seals
jon@drj.com

ASSOCIATE EDITOR
Ed Pearce, CBCP
ed@drj.com

COPY EDITORS
Richard Sandhofer
richards@drj.com
Pamela Clifton
pamelaclifton@hotmail.com

ADVERTISING 
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President 
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

EXECUTIVE COUNCIL
Jeff Dato, MBCP, KPMG
John Jackson, IBM
Edward S. Devlin, E.S. Devlin & Associates
James Hammill, CBCP, JMH Consulting Inc.
Pat McAnally, SunGard Availability Services
Brian Turley, Strohl Systems
Belinda Wilson, Hewlett-Packard


INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity 
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
www.drms.com.br

Click Here for a Printable Version

INDUSTRY

The BCP Role:
Employers May Want You To Wear A Few Different Hats

By TODD YOUNG, CBCP

Whether it is due to Sept. 11, the Northeast blackout of 2003, SARS, regulatory/audit requirements or a lesson learned from a disruptive incident, many organizations are now actively seeking business continuity expertise in order to safeguard their critical business functions and IT infrastructure.
A visit to any of the major job boards or recruiter sites is likely to yield various opportunities for qualified BCP professionals. However, more and more, one is also likely to encounter postings that seek to integrate the traditional BCP role with other streams of expertise, or (as is often the case in small to medium organizations) treat BCP as a part-time duty. While this may be an attempt by organizations to do “more with less” (something most of us understand all to well), it may also represent some level of misunderstanding toward the role of the BCP practitioner and the valuable service it provides.

Most business people would likely agree that a sound business continuity program is a critical component in any organization. However, in their efforts to obtain expertise and establish such initiatives, some organizations may not be completely clear on what they require or what is realistically available. As a result, BCP-related job postings now advertise positions such as “Analyst – IT Security/Business Continuity” or “Business Continuity/Disaster Recovery Planning and Storage Specialist.”

While no one would dispute the fact that many BCP professionals are technically inclined and possess additional skills, it is also a fact that BCP is an area of expertise unto itself, just like IT security, storage, networking, software, or any other support function. While a BCP professional will certainly have some understanding of these areas as they relate to recoverability, they are not likely to have the same level of technical expertise as those who typically provide such skills. In fact, a BCP candidate such as this would not only be difficult to realize, but would most likely be an expensive redundancy of expertise within an organization’s support infrastructure.

Graeme Jannaway, a Toronto-based business continuity consultant and immediate past chairman of the board of DRI Canada, has noticed this change in perception within the current job market. He is concerned that some organizations may not have a clear understanding of what the BCP professional brings to the table.

“When I started in this profession the emphasis was on the recovery of IT infrastructure,” said Jannaway, “so it was quite common to have business continuity (or disaster recovery) people who were also technically experienced in other areas, such as IT security, hardware, or software. However, with the accelerated pace of the technological evolution and the increased complexity of the business continuity role, it is no longer realistic to expect a BCP practitioner to have an equivalent level of expertise in technical areas or other business specialties. The business continuity project will be one of the most important projects an organization will ever undertake. In order for it to be successful, it requires a specialist’s knowledge and experience.”

Recruiters encounter the other side of this dilemma when they attempt to bring qualified BCP candidates to their clients. When organizations insist on “marrying” other areas of expertise to the traditional BCP role, they can severely limit, if not eliminate, the ability of a recruiter to provide suitable candidates (to everyone’s frustration).

In such cases, the candidate search often continues indefinitely, causing the position in question to lose appeal within the job market, and ends in failure. Job postings that advertise at length, disappear, and then resurface months later with the same exact wording are often an indication of this situation. Ultimately, organizations start searching for the proverbial “unicorn.” In doing so, they never address their BCP requirements. In fact, recruiters and employers alike, despite their best intentions, may not even be aware of the unrealistic nature of their search.

Cheyene Haase owns and operates a recruiting firm in Newport Beach, Calif., that specializes in the field of business continuity. Over the last few years she has encountered a significant number of clients who seek to integrate the BCP role with other support skills, and admits that this expectation poses its share of challenges.

“The current economic state has really put a lot of pressure on companies seeking to hire qualified BCP personnel,” said Haase. “However, due to cuts in budgets and staff, companies are being forced to accomplish more with less. They are feeling the pressure from auditors and regulators to have fully functional contingency programs in place across their business and technology sectors. There is more work available now than ever before in contingency planning. However, our hiring managers are not receiving the approval to hire the necessary number of professionals to accomplish the surpassing work.”

“In response to this restriction, many client companies are seeking professionals with multiple skills. However, locating and placing resources with such expertise can pose problems. The candidate search is typically longer and more difficult because recruiters must attempt to identify resources that meet the multiple skills criteria. In addition, such resources are not always available and if found can prove costly to acquire. Depending on the size of the company and the amount of work that needs to be accomplished, professionals being placed may find themselves stretched too thin with multiple responsibilities. As a result, BCP may not get the attention it requires.”

So what should an organization take into consideration when searching for a BCP professional?

While specific continuity requirements will be as unique as the organization itself, the factors that typically define a successful BCP professional are a clear understanding of BCP concepts and methodologies supported by strong project management skills. More often than not, attempts to “home-grow” a recovery capability without the benefit of BCP expertise will inevitably cast light on the multi-dimensional nature of the process.

An organization may have devoted a great deal of diligence toward setting up a recovery capability for its critical IT infrastructure, but then realizes that proper documentation and effective testing and maintenance policies need to be created. With the recovery of the IT infrastructure, the need to address recovery requirements for the critical business functions is also raised, along with the issues of emergency response and crisis management.

On top of all this, the entire recovery process now needs to be managed on an ongoing basis to ensure that it continually addresses the needs of the organization. All of a sudden the task at hand takes on a much larger scope, and when an organization reaches this crossroad, the value of an experienced BCP professional can be truly appreciated.
Through the use of recognized methodologies such as business impact and risk analyses, the BCP professional will confirm the recovery scope for the organization on an enterprise-wide level and will identify and categorize potential risks. Once the recovery scope and actionable risks have been identified and confirmed, the optimal recovery strategy (or strategies) will be determined to recover the critical infrastructure and mitigate the identified risks.

Ultimately, the recovery strategies will be developed into coordinated plans, which will be properly tested and maintained on a regular basis. While both the IT and business expertise within the organization will be (and should be) extensively involved in the development of such plans, the BCP professional is responsible for managing the overall approach to the initiative. This will ensure that all recovery requirements and issues are effectively addressed while avoiding the pitfalls that are often encountered. Training and backup of key personnel, consideration of BCP with regard to new production and business initiatives, off-site storage, change control, and proper plan maintenance and testing are just some of the factors that need to be considered. With the proper diligence and expertise, the end result will be a dynamic, comprehensive business continuity program, which will address all critical aspects of continuity and recovery within the organization.

BCP professionals use their acumen and understanding of the principles of enterprise-wide response, recovery, and continuity planning to bring value and credibility to their employers and clients, regardless of the nature of the business. In fact, it is this universal applicability of BCP skills that makes these individuals among the most valuable in any organization. These people are ultimately charged with ensuring that effective plans are in place to keep the critical infrastructure running in the face of adversity, disruption, and even catastrophe. This is not a part-time duty by any means, but rather, a critical responsibility that coordinates and works in concert with the other support functions within the organization. Given the nature of BCP and the issues it addresses, it must be regarded as nothing less than a critical support function that cannot and should not be compromised with respect to qualified resources.

Business continuity is now accepted as a critical component in the modern business infrastructure. However, if it is to be successful, it must be considered as nothing less than a fundamental element of the way an organization does business, and qualified BCP expertise is the first step toward that success. Just as ISO standards defined the best companies of the 1990s, resilience through BCP will continue to emerge as one of the key corporate benchmarks of the new millennium.

In today’s world of increasing complexity, service demands, and competition, organizations can ill-afford to do anything less.

Todd Young is based in Toronto, Canada, and has been actively involved in the business continuity profession since 1993. He holds a CBCP certification from the Disaster Recovery Institute (issued 1996) and has performed BC/DR planning activities for the public sector and various industries, both internally and in a consulting capacity.

©Copyright 2004 Systems Support Inc. All rights reserved. Reproduction in whole or in part in any form or medium without the express written permission of System Support Inc. is prohibited.