Disaster Recovery Journal

This article, using a Six Sigma tool – Quality Function Deployment (QFD) – builds up a framework that could be adapted to suit your needs of building resiliency in human capital. In this paper the real life observations are stated in rhetoric form.

Explanation of Terms Used Resiliency in Human Capital
Human capital comprises of knowledge, skills, health, education and physical ability. Resiliency is the ability to bounce back in face of adversity.

• Availability of the right people at the right place at the right time

Quality Function Deployment (QFD)
QFD is a comprehensive quality design method that:

• Seeks out spoken and unspoken customer needs from fuzzy Voice of the Customer (VOC) verbatim;
• Uncovers “positive” quality that wows the customer;
• Translates these into designs characteristics and deliverable actions; and
• Builds and delivers a quality product or service by focusing the various business functions toward achieving a common goal – customer satisfaction.

What a QFD basically does is translate customer requirements into an appropriate company program and technical requirements at each phase of the product realization cycle. The accompanying graphic depicts how the various house of quality is built.
We build the first House Of Quality based on the Voice Of The Customer.
Building resiliency in Human Capital depends on three dimensions: people, procedures, and culture existing within the organization. We explore each of them in detail.

1. Talent management

• Have we identified the critical resources for each business process that we perform?
• Do we know the skill sets of these critical resources? Have we created job descriptions for each resource that could be utilized if needed?
• Where can we get these skill sets and within what time frame in case we were to need them?

2. Backup availability

• Have we identified backups for the critical resources?
• What is the backup depth (how many tiers)?
• Have the backups been trained to assume the roles of the critical resources?
• Have the backups ever been tested?

3. Analysis of availability to function in case of disaster

• Have we analyzed how people will react to trauma especially the ones  that affect the loved ones? This is a tough cookie, but we can extrapolate based on our observations of how an individual has reacted previously in case of a personal tragedy. Generally a good manager will be able to count the persons he/she can rely on even in the face of adversities.
• What proactive measures have we instituted that will help the employees face a real trauma?
• Have we analyzed the what-if questions if resources have to operate from an alternate site? Questions to consider: What if a critical resource is a single parent? What if the resource has an elder at home who cannot be left alone for long durations? What about pets who cannot be left alone for long durations?
• What measures do we have in place if social distancing is to be observed and reporting to the primary / secondary location is not an option?
• Is tele-working an option? Have we defined and tested the procedures to make it work?

4. Ability to communicate

• How will the people be communicated in case of a disaster, especially if it occurs in post-working hours?
• Do we have a bulletin board? Questions to ponder on: How much information needs to be posted on it? Can a competitor take undue advantage of it in case the board is public? Will the customer be alarmed? Do we need to have content for the customer on the bulletin board?
• What if tele-communication networks are disrupted being a local disaster and the ability to call or text message a person is not available?
• Do we have a call-in number wherein employees could call to obtain instructions? Is this number going to be available if primary facility no longer exists? 
• How will the decision making process be affected because the Crisis Management Team is not able to communicate? Who will make the decision and inform the others?

5. Ability to travel

• In case of an outage in mass rapid transportation systems will people be able to travel to the primary location or the secondary location?
•  Is there more than one option to get to the desired location?

1. Documented

• Have we documented the following procedures?

• l    Backup
  l    Recovery
  l    Offsite shipment
  l    Batch jobs
  l    Print jobs
  l    Passwords for all systems
  l    Insurance reimbursement

2. Comprehensive

• Are the above-mentioned procedures comprehensive?
• Is everything that is vital also documented?
• In case of knowledge based on experience, e.g. partitioning of the LPAR, DADS settings on mainframe, etc., is the logic of allotment documented?

3. Validated

• Have the backup personnel validated the procedures for effectiveness?  

1. Top management involvement

• Is there a perception within the organization that the top management is involved in BCMS?
• Is the top management involved in formulation of the strategy and review of the various disaster related policies?
• Do the audit reports and exercise reports get reported to the top management?
• Has the top management participated in disaster recovery exercise?

2. Policies and systems
Have we defined and communicated the following policies or have the various components within a well laid out Business Continuity Policy

• Crisis escalation policy
• Disaster declaration policy
• Tele-working policy
• Leave policy
• Policy for individuals whose services would not be required in case of disaster for a certain duration
• Policy for individuals whose services are required but who are not able to report for recovery

Reimbursement policy

• For expenses related to administration arrangements for people to move to an alternate site and function from there for a given period
• What is the overtime policy? Is there a comp-off policy?
• What is the disaster pay?
• How are bills to be paid (by the individual or centrally)?
• Is there a company credit card? Who uses it, when and how much is the limit? Can the credit be increased (and how)?
• How are timesheets to be submitted from the alternate site and to whom? Who keeps track of the working hours?

• Insurance policy

• Emergency procurement policy for restoration of primary site after the             disaster
• Payroll policy in case of disaster
• Direct deposit
• Payment shipped to home location/alternate site
• Policy for notification of casualties (in case of accident/death on premises         or while in duty)
• Policy for disbursement of claims in case of casualty
• Policies for third-party service providers in case of a disaster
• Do we have systems in place that could provide support and implement the policies in case of disaster?
• Do we have systems in place to ensure quality of policies and the ability to monitor the updates?

3. Awareness and training

• How many tiers of employees have been defined to create a pool of resources for all critical job functions? 
• Have the employees been cross-trained in addition to their primary responsibilities?
• Is there a mechanism to monitor conduct of effective mentor/protégé trainings?
• Are employees including new joinees aware of their roles and responsibilities in case of a disaster?
• Have they been rehearsed on a regular basis?
• Is the disaster recovery education material available in an easy-to-use package?

Conclusion
Despite all technological advancements, employees are still needed. The problem in a disaster is the unavailability of the individuals. Building resiliency in human capital lays the foundation for a business continuity management system.

About The Author: Joseph McHugh is the executive deputy director operations for Judiciary Information Systems (JIS) of the State of Maryland Judiciary. With more than 30 years of IT experience, he is responsible for providing mission supportive facilities and infrastructure, ensuring security, and optimizing operations at JIS. He is the project champion for the business continuity management system implementation project at JIS. McHugh can be reached on joe.mchugh@mdcourts.gov.

About The Author: Freyae Jones is the senior manager of data center operations for Judiciary Information Systems (JIS) of the State of Maryland Judiciary.  She is the project manager for BCMS implementation project at JIS.  Jones can be reached at Freyae.jones@mdcourts.gov.

About The Author: Sandesh Sheth, MBCP, PMP, Six Sigma Black Belt, CISA, is lead consultant with the enterprise risk management group of Satyam Computers Services Limited, developing and implementing business continuity management systems for organizations worldwide. Sheth can be reached at sandesh_sheth@yahoo.com.