USING A PC-BASED ORGANIZATION RECOVERY PLANNING SYSTEM

By Joseph C. Rocheleau

Hurricane Hugo’s appearance on the East Coast in September, 1989, and the earthquake on the West Coast in October, 1989, reminds us all of how vulnerable we are to various threats that mother nature can bestow upon us. The widespread devastation to life and property emphasizes the need to plan for recovery and loss prevention in case of a disaster. This planning applies not only to personal property, but also to the property of the organization.
In the event of a disaster, various organizations play a key role in the recovery process. However, before an organization can assist others in the recovery process, it must first recover itself.
Some organizations, such as financial institutions, are faced with a regulation that requires the an organization recovery plan. Many other organizations do not have this regulatory requirement. Whether mandatory or not, the development of a comprehensive organization recovery plan results in the following benefits:

* Minimizes economic loss
* Reduces disruptions to operations
* Provides organizational stability
* Achieves an orderly recovery
* Reduces legal liability
* Limits potential exposure
* Lowers the probability of occurrence
* Minimizes insurance premiums
* Reduces reliance on key personnel
* Protects assets
* Ensures the safety of personnel and customers
* Minimizes decision-making during a disaster
* Reduces delays during the recovery process
* Provides a sense of security

Organization Recovery Planning Approaches

An organization has many options available in the area of organization recovery planning. One is to develop the organization recovery plan internally, using personnel and resources from within the organization. Disadvantages to this option include 1) lack of expertise and awareness of planning considerations; 2) lack of time and/or commitment on the part of the individual(s) assigned the project, and 3) disruptions to normal organization operations.
A second option is to hire an external consultant to assist in preparing the organization recovery plan. Potential disadvantages to this option include lack of knowledge of the organization and internal operations by the consultant and higher cost.
A relatively new third option, a PC-based organization recovery planning system, has recently surfaced. A quality PC-based system combines the main advantages of options one and two: it allows the involvement of individuals from within the organization who are familiar with internal procedures in completing the plan, and also provides the necessary structure and content of a viable organization recovery plan. A PC-based system includes several other advantages:

* Significantly reduces the time and effort in the planning and development process
* Provides an effective method for maintenance
* Utilizes predesigned methodologies
* Provides a systematic approach to the planning process
* Uses a proven technique

This third option may be the best approach and requires further discussion and analysis.

Selecting a PC-Based Organization Recovery Planning System

Several PC-based recovery planning systems are available on the market today. Typically, these systems emphasize either a database or a word processing application. Others are based on a combination of integrated applications. Some systems are industry specific and others are “generic,” meaning that the system theoretically can be used by all industries.
PC-based organization recovery planning systems usually include instructional material which addresses issues the organization must consider during the planning process. Other material includes “fill-in-the-blank” and data gathering capabilities. Another typical attribute of many PC-based systems is a sample or generic organization recovery plan. This plan would need to be tailored to the specific requirements of each organization using the PC-based system.
Some of the key considerations for an organization to consider with the selection of a PC-based organization recovery planning system are as follows:

* Ease of use
* Ease of installation
* Thoroughness of training and implementation
* Amount of time required to prepare the organization recovery plan using the PC-based system
* Ease of maintenance and updating (a list of the detailed features, functions and capabilities of a comprehensive PC-based organization recovery planning system is attached).
* Availability of a specialized consulting firm to provide installation, training, and consulting on various disaster recovery planning issues. This also will help to assure that the software is successfully and efficiently implemented.

As a final consideration, the system should be comprehensive enough to provide added benefits to the organization that are obtained through the planning process. These benefits might include operations analysis, staffing analysis, insurance analysis and inventory completion.

Installation and Training of a PC-Based Organization Recovery Planning System

Effective implementation of a PC-based organization recovery planning system starts with proper installation and training on how to use the system. Experienced consultants can facilitate this process. The organization should decide who needs to be involved in the installation and training process. This should involve the key person(s) responsible for organization recovery planning, along with a backup or alternate for that person(s).
It is also beneficial to include individuals representing all functional areas of the organization in the installation and training process. This helps to ensure that the resultant recovery plan is comprehensive. Representatives from upper management may be involved in the installation and training process as well, at least in an overview basis. This should help to obtain their support and commitment for the project.
The installation and training should address the following issues:

* How to operate the PC-based system
* How the PC-based system applies to the organization
* What areas need to be tailored in the system for the organization recovery plan to be completed
* What time frame and specific steps are involved in the completion of the organization recovery plan using the system
* What unique recovery planning issues confront the organization

The success of the installation and training depends to some extent on the responsiveness and cooperation of the organization. Therefore, to maximize the benefit received from the installation and training process, the organization needs to devote the time and necessary resources to this process.

Completing the Organization Recovery Plan using the System

A PC-based organization recovery planning system typically provides an organization with a predetermined approach to completing the organization recovery plan. The scope and structure of the plan are often completed in a “generic” fashion in PC-based systems. The organization must customize the approach to correspond with the specific requirements of the organization.
Determining the scope of the organization recovery plan includes an analysis and identification of the critical functions performed by the organization. The critical or essential functions are those that have to continue in the event of a disaster in order for the organization to recover and maintain its existence. Another aspect of determining the scope is the decision of whether or not the organization recovery plan should cover the main facility only or also remote offices.
One issue in organization recovery planning that any PC-based system can not resolve is determining backup strategies for facilities, computer communications and other critical equipment. These decisions are perhaps the most challenging and complicated in the planning process because of costs, feasibility and “testability” of various backup strategies.
To ensure proper and timely completion of the plan, the organization should involve individuals representing all functions of the organization in the planning process. If the system includes data gathering forms that need to be completed, those forms should be distributed to each respective functional area for completion. If the system includes a generic or sample organization recovery plan that is divided into functional areas, each respective area should be responsible for completing their part of the sample plan. The involvement and participation of “experts” from all functional areas of the organization in the planning process not only ensures that the plan is accurate and comprehensive, but it also helps to ensure a successful recovery. This involvement results in educated employees who understand the plan and how it should work.
Since an organization recovery plan is a living document and constantly impacted by changes in the organization, it is extremely important that the plan is maintained and current. One of the most important benefits of a PC-based organization recovery planning system is that it facilitates easy maintenance and updating. The organization should establish a formal schedule for updating and maintaining the completed organization recovery plan. The use of control numbers for plan copies along with a “plan maintenance” form also helps in maintaining the plan.
In summary, the key aspects for successfully incorporating a PC-based organization recovery planning system include the following:

* Effective installation and training.
* Involvement of individuals representing all functions of the organization.
* Support by upper management of the organization.
* Determination of the scope of the plan by the organization.
* Timely completion of all aspects of the plan.
* On-going maintenance and updating.

FEATURES, FUNCTIONS AND CAPABILITIES OF A COMPREHENSIVE PC-BASED ORGANIZATION RECOVERY PLANNING SYSTEM

1. Is menu driven
2. Provides a systematic method for developing an effective plan
3. Is flexible and easy to use
4. Includes a complete user manual
5. Is designed to facilitate maintenance
6. Contains contingency procedures for all aspects of the organization
7. Describes various backup strategies
8. Provides for multiple levels of disaster
9. Includes insurance analysis techniques to reduce premiums
10. Contains a comprehensive disaster prevention/preparation questionnare
11. Provides methods to determine critical functions and prioritize operations
12. Includes contractual considerations for backup/alternate site arrangements
13. Can be used with any backup strategy
14. Contains records retention guidelines
15. Describes records salvage techniques
16. Includes a comprehensive sample plan
17. Contains disaster gathering forms
18. Contains disaster tracking forms
19. Provides user defines forms
20. Provides password protection
21. Includes backup and restore procedures
22. Addresses the following equipment considerations:
-Main computer system
-Microcomputers
-Data communications
-Voice communications
-Other critical equipment
23. Addresses the following facility considerations:
-Main building
-Remote facilities
-Off-site facility
-Backup facility
24. Includes the following areas:
-Department procedures
-Team responsibilities & procedures
-Distribution procedures
-High priority tasks
-Manual processing techniques
-Emergency accounting procedures
-Functional area procedures
-Notification procedures
-Disaster policies
-Temporary operating procedures
-Risk assessment procedures
-Procedures for establishing a command and control center
25. Uses a clear, concise writing style
26. Uses a standard format
27. Includes testing methods and procedures:
-Testing schedule
-Scope
-Scenario
-Simulated disaster
-Structured walk-through procedures
28. Interfaces to word processing system

Joseph C. Rocheleau is a Senior Consultant with McGladrey and Pullen, a National CPA and Consulting Firm.

This Article adapted from Vol. 3 No. 2, p. 18.

Disaster Recovery Worldİ 1999, and Disaster Recovery Journalİ 1999, are copyrighted by Systems Support, Inc. All rights reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.