DISASTER RECOVERY
JOURNAL

Return to the Winter 2001
Index

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276
Fax: (314) 894-7474
Internet www.drj.com
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

EDITOR
Michelle Saab
michelle@drj.com

COPY EDITORS
Edward H. Pearce, CBCP
drj@drj.com
Richard Sandhofer
richards@drj.com

INTERNET /
ADVERTISING
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
ww.drms.com.br

Click Here for a Printable Version

Outsourced Business Functions…. Are they Part of your Business Continuity Plan?

- by Wayne E. Goelz, CBCP

Over the past few years, in a very competitive market place, businesses have narrowed their focus to business functions that are critical to the survival of their company. In the struggle to stay competitive, companies are constantly looking at ways to reduce the cost of their operations. To accomplish this, some companies have turned to outsourcing business functions to vendors as a way to reduce costs.
Companies that have outsourced business functions rely heavily on the vendors to supply these services at the same or higher level so that change is not noticeable to employees or customers. If your company is currently outsourcing business functions, how do you account for these business functions in your Business Continuity Plan? Does the outsourced vendor have a Business Continuity Plan? If they do not, do you require the vendor to write a plan and provide you with a copy of that plan? Is their continuity plan also updated in a timely manner? How does their plan interface with your Business Continuity Plan? Who provides the oversight and coordination for these outsourced functions? How can you be assured that these outsourced functions will continue during the disaster recovery process? Are they, or could these outsourced functions, be critical to your recovery process?
These are just a few issues facing Business Continuity Professionals today as they write continuity plans. As business functions are being outsourced, more and more time is required to coordinate, manage, write and maintain your Business Continuity Plan. Integrating these functions into the continuity plan requires knowledge of how these outsourced functions work and how they would affect your entire company at the time of a disaster. Trying to ensure that these outsourced business functions will continue in the event of a disaster may be a critical part to your company’s survival.
How to avoid this possible oversight in your Business Continuity Plan.
During the process of selecting an external vendor for a particular business function, questions regarding whether they do or they do not have a Business Continuity Plan should be included. Receiving answers to these questions will demonstrate how the vendor views the business continuity planning process and what kind of response you might expect from them in the event of a disaster.
After you have completed the selection process you need to incorporate the vendor and the outsourced business function into your existing Business Continuity Plan. This can be accomplished by asking a few questions.
The questions that need to be asked are:
1. What is the name of the outsourced vendor?
2. Who is the contact person for that vendor?
3. When did the contract take effect?
4. What are the business functions that have been outsourced to the Vendor?
5. Which of your systems does the vendor need access to in order to perform the outsourced functions?
6. Are any of the outsourced functions that the vendor performs critical in your recovery process?
7. What is the impact of not performing these outsourced functions on:
a) Customer Service.
b) Cash Flow.
c) Market Share.
d) Operations.
8. What support staffing and facility requirements does my company provide to the vendor?
9. What equipment, supplies and forms does my company provide to the vendor?
10. What requirements in the reconstruction process will the vendor require of my company?
The answers to these questions will provide you with information to analyze the criticality of these outsourced business functions and where they fit into your overall plan. While the analysis of the outsourced business functions is progressing, you may find that the interface of these outsourced functions will play a critical part in your recovery process.
Let us take for example the outsourced business function of building and installing your desktop PCs.
Do you have a plan to have your alternate-processing site set up with PCs? Who is responsible for writing such a plan, you or the vendor? Will your recovery teams be up and running in an effective time frame that will allow you to continue business?
This is why your continuity plan and the vendor’s continuity plan MUST be in agreement to keep the recovery process going forward. Most contracted vendors understand that if a disaster should strike your business, it will affect them as well. Vendors are well aware that they have as much to lose financially as you do. Knowing that your outsourced vendor is as prepared for a disaster as you are must be a critical part of any recovery plan.
Another item to examine is the emergency contact procedures for the vendor. These procedures should be consistency updated and tested on a regular basis. The question to ask is: Are there RED TAPE procedures that may block critical recovery time frames during a recovery process? Sounds unlikely, but is it? This is why the review of the vendor’s continuity plan should be a part of your Business Continuity Plan review and update process. Don’t take it for granted that your plan can be executed effectively if you do not test all the parts of the recovery process, which includes the outsourced business functions.
For the most part, dealing with the outsourcing of a business function is not a critical process. It can become critical without paying attention to how the recovery pieces fit together. Without that attention, you may be left with a picture missing an important piece or a piece that is not the shape that you will need.
Thinking of the recovery process as a chain, I am reminded of this saying “A chain is as strong as its weakest link.” Take some time and examine the links of your recovery chain. Are all links tested and sound? Are they ready to withstand the stress of a recovery? Give the chain a test pull, and see if it breaks.

Wayne E. Goelz, CBCP, has been the Business Continuity Planning Manager for Lincoln Financial Groups Annuity division in Ft. Wayne, IN for the past four years.