Do reciprocal agreements work? The answer to this question is a definite yes--maybe! To see if they will work for you, first ask yourself the bigger question--what do you mean by “work”?
In my conversations with people in a variety of business endeavors, one of the most frequent responses I hear is “We’ve got a reciprocal agreement with another (bank, savings and loan, credit union, business, etc.), we’ve tested it, it works, and it satisfies the regulators, so we’re not interested in a formal disaster recovery or hot-site contract.”
On the other hand, I sometimes hear this response: “Yes, we have a reciprocal agreement but we know that ultimately, it is not our best option for alternative backup.”
The most common method of “testing” in the reciprocal agreement world appears to be transporting a tape(s) to the reciprocal site after hours, loading the database tapes onto the other computer, and determining if they can be read. If so, the “test” is declared a success and recorded as such to “prove” to the regulators that compliance has been achieved. This is a relatively easy and definitely inexpensive answer to the disaster recovery quandary. The harsh reality of this arrangement is that the disaster recovery plan is worth nothing more than an attempt to satisfy regulators and convince ourselves that we do have a plan.
There is a wide variety of companies and software programs providing disaster recovery solutions with a wide range of features and costs. Whatever option a firm chooses, it needs to take into consideration such factors as data communications, personnel, equipment replacement, facility repair or replacement, etc.
If I were a party to a reciprocal agreement and had the privilege of “hosting” my reciprocal partner, I can imagine many uncomfortable feelings that would arise. The idea of having two or three unknown people in my computer facility from eight o’clock in the evening until three in the morning would be very unsettling. And because I would have one of my own people there during that time to assuage my uneasiness, I would have to work shorthanded.
Each night my database of customer files, parameters, and system software would need to be unloaded and reloaded. The additional time required to do this is significant but relatively minor compared to the possibility of something going wrong during the load/unload process. I must back up ALL of my software and files daily to be completely covered.
Another point of vulnerability in a reciprocal agreement is the possibility of my reciprocal partner upgrading his hardware or software, going to another hardware or software vendor, merging with another institution and changing to the acquirer’s system, or even going out of business. If any of this comes to pass, I have to go find another partner and conduct another “test.”
Imagine that I am using the computer during the day and my partner is using it at night. If we have an equipment breakdown, we are both going to be in a very difficult situation. Under normal circumstances, I may be able to work around such a breakdown if an engineer can’t respond quickly. However, with two firms on the system for twenty hours a day, a routine breakdown becomes a crisis. Operating for these extra hours may bring about more equipment failures. Each partner in a reciprocal agreement will incur some significant costs in the event of a disaster. These include overtime for your staff who sits up with the reciprocating organization, extra personnel costs to cover for those not available because of night work, additional maintenance costs from your hardware vendor because of after-hours operation, and additional utility costs for air conditioning, light, heat, and power.
I can easily envision the disaster situation causing a lot of frayed nerves and short tempers among the staffs of the reciprocal partners as time goes on. Conflicts over time windows, supplies usage, equipment breakdowns, or simply general resentment can all begin to wear as days stretch into weeks.
A disaster recovery center or hot-site location should be able to assist you in avoiding these drawbacks found in a reciprocal agreement. With the possible exception of a multiple disaster, you should have the equipment and facility to yourself. This fact alone should eliminate a great deal of the problems found with the sharing aspect of reciprocal agreements. In some cases, the disaster recovery center may provide assistance by having personnel available to load tapes, change printer paper, etc. This would allow you to operate the disaster recovery center computer remotely from your home city and keep your key data processing personnel at home to help rebuild your data center. This would be very difficult, if not impossible, for a reciprocal partner to provide.
Inexpensive reciprocal agreements are a poor alternative to a dedicated disaster recovery center. As long as the partners are aware of the risks and limitations to such an agreement, they can get by. However, if their goal is a truly effective disaster recovery plan, they need to go further.
It is clearly becoming the trend that regulators and insurance companies are going to demand more from companies. It may very well be that insurance carriers will soon insist on having disaster recovery plans on file in order to obtain business continuation coverage. Regulators will also probably insist on a more significant test than the mere process of reading a tape. Disaster recovery planning is easily pushed down to a low priority when the day to day deadlines draw nigh, but don’t ever believe it will go away!
Richard Snyder is the Director of Marketing at Oklahoma Hotsite, Inc.
This article adapted from Vol. 3 No. 4, p. 54.