Tough Problem, Simple Solution

By Joseph Flach

I am a disaster planner, who, like most all other disaster planners, has a tough time getting management committed to performing the tasks necessary to adequately address disaster planning within my organization.
Why is it, that all these managers who attend my sessions on the whys and wherefores of Business Continuity Planning, those same individuals who agree so whole-heartedly on the need to develop contingency plans when I talk to them one on one, fail to put forth any effort to actually create these plans?
You can give me all the excuses you want from:

They don’t have the know-how;
They don’t have the time;
They don’t have the resources;
to:
It has a low priority;
They don’t think a disaster will occur;
They don’t understand the need.

The real reason, in my opinion, is that, in most organizations, managers are not a part of their job descriptions, and, it is not accounted for in their job appraisals.
In most organizations, there is only one individual or one group of individuals with any mention of disaster planning responsibilities in their job descriptions, MBOs, objectives, appraisals, or whatever other tool is used to document or measure an individual’s performance. Usually, these individuals are really only responsible for assisting others to develop their plans. As a disaster planning expert, I am responsible for assisting the MIS managers, communications managers, and business unit managers, in creating plans for their areas of responsibilities. I do not tell these individuals how to conduct their day to day affairs in a normal environment, likewise, I cannot tell them how to perform their jobs after a disaster has occurred. I can, however, make sure that they have addressed the proper issues; act as liaison between IS managers and business managers; act as liaison between my company and recovery vendors; perform risk analysis; etc., etc., etc.
If we look at our job descriptions, it is obvious that I cannot perform my job without the cooperation of many other managers. These other managers, however, have no reference to business continuity planning in their job descriptions, and, therefore, do not need me to satisfy the objectives for which their performances will be measures.
I have yet to meet a manager, at any level, that did not agree with my assessment of the need for contingency, recovery, or continuity plans in their areas. The only incentives they have for creating these plans, however, are to close an exposure to a risk which is unlikely to occur during their tenure, and to get me off of their back.
In some organizations, auditors are writing up functional areas for not having plans, in companies where managers are appraised on how well they satisfy audit requirements. This environment, however, creates the incentive of doing what it takes to satisfy the auditor, no more, and, no less. This is what is currently happening in the banking and insurance industries.
So how do we remedy this situation? Put the responsibility of creating (maintaining) business continuity plans in every manager’s job description? Sure, why not? If senior management is truly committed to creating these plans, why not specifically spell it out in everyone’s job description? Reward managers for creating plans by adding this issue. The weight given to this item will determine just how much attention managers give to it. Companies may even want to give it different weights for different responsibilities. For example, IS operations, communications, and accounts receivable managers may have a higher weight given this responsibility regardless of one’s understanding of the need or how convinced they are that a disaster will actually occur. It is only human nature.
As a kid, I wasn’t likely to run out and cut the grass even when I agreed it needed cut. Mom, however, could make me cut the grass with threats of punishment or rewards of payment. In our current business environment, the threat is obscure (you won’t be prepared if a disaster occurs!) and the reward non-material (you will survive the disaster!) for creating disaster plans. No wonder it’s not getting done. Having your disaster planner as the only individual being appraised on this responsibility is like rewarding (or punishing) the lawn-mower but not the kid pushing it.
“Boy, that grass is getting long. It sure needs cutting. Wonder why that lawn-mower isn’t getting the job done?”

Joseph P. Flach is an Internal Management Consultant with Union Camp Corporation in Wayne, NJ.

This article adapted from Vol. 6 #1.

Disaster Recovery Worldİ 1999, and Disaster Recovery Journalİ 1999, are copyrighted by Systems Support, Inc. All rights reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.