DRJ's Fall 2018

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 31, Issue 2

Full Contents Now Available!

The Stag Looking into the Pool

A stag, drinking at a clear pool, admired the handsome look of his spreading antlers, but was much displeased with the slim and ungainly appearance of his legs. "What a glorious pair of branching horns!" said he. "How gracefully they hang over my forehead! What an agreeable air they give my face! But as for my spindle-shank of legs, I am heartily ashamed of them." The words were scarcely out of his mouth when he saw some huntsmen and a pack of hounds making toward him. His despised legs soon placed him at a distance from his followers, but on entering the forest, his horns got entangled at every turn, so that the dogs soon reached him and made an end of him. "Mistaken fool that I was!" he exclaimed; "Had it not been for these wretched horns, my legs would have saved my life."

Since childhood, I have enjoyed the simple fables and underlying lessons of the famous Greek slave, Aesop. A while back, I drafted a book on management principles, using several different, mostly less well known fables, including the one above, to illustrate various principles of management. But having only recently entered the practice of business continuity planning, I began to find myself visiting these nuggets of wisdom again with a renewed point of view. The stag's story rang a particularly loud bell for me. Perhaps you may also find it useful as well.

It's too easy to conclude that the stag suffered from narcissism and merely got what he deserved for such a character flaw. But from the perspective of a contingency planner or risk manager, his fatal error was in wrongly prioritizing his resources. He admired his antlers and loathed his legs based on his apparently high valuation of appearance. The underlying issue is values: what things are most prized in the corporate culture and, more importantly, are they correctly prioritized? There is ample evidence that companies of all stripes embrace similar belief patterns: they place inappropriate emphasis on what they think are the critical vulnerabilities, processes or assets, while ignoring or shortchanging truly vital ones. One particular area stands out in this regard.

Most Valued Resources

Owing to the "roots" of the business continuity planning discipline in the information technology arena, an emphasis on recovering the information technology (IT) infrastructure is understandable. However, the high level of sophistication that has been developed in disaster recovery methods has resulted in the growth of a vast army of people with IT/DR-oriented skills, but this bias comes at a cost: the virtual exclusion of often more critical business process resources. Of these, people 'human resources ' are the most often ignored. It is easy to illustrate how an IT-oriented recovery plan would serve its master so poorly.

The Northridge (California) earthquake of 1994 devastated hundreds of buildings, killing 60 people in the San Fernando Valley area of Los Angeles. However, my employer at that time was located about 20 miles from the epicenter, and suffered no damage beyond a few items jostled from shelves. But the impact on our ability to operate grew more apparent in the next few days, when we began to resume business: scores of people didn't come to work. Why? Their homes were in various states of calamity, and they had to find shelter for themselves and their families, as well as deal with FEMA and insurance adjusters. A few employees were so traumatized, they never returned to work, opting to take medical retirement. Thus, even though the IT infrastructure, LAN servers and desktops, weren't impacted, many business processes stopped dead in their tracks because the people who operated them weren't there. The infrastructure didn't matter: absent employees do no work.

People = Process: A Common Vulnerability


Across the globe, a common condition among organizations of all kinds, whether for-profit or non-profit, is what I call "the person IS the process," especially true in small- to mid-sized firms. They lack any kind of documentation describing tasks, the performance criteria or how each task is performed. They are taught by OJT ' on the job training ' and left to their own sense of what and how to perform, with occasional inputs from supervision. As long as they show up and the work gets done, everybody's happy. But what happens when, for instance, they go on vacation? More often than not, nothing.

It is common for management to simply accept that, while Fred or Jane is out, their work will get backlogged a little, or that someone will step in to pick up the slack. Or, they may be so oblivious that it's as though they believe elves come in and do the work.

Regardless, the practice persists, perhaps due to managers' apprehension about or simply lack of awareness of mitigating measures. They may avoid even trying to address the problem, privately hoping that somehow, the job will get done. Maybe the elves will appear. But, of course, they don't. So what mitigating measures can enable managers to make their enterprise more robust?

Well, there are a few, surprisingly simple ones. For example, establishing the practice, where appropriate, of cross-training. Where a workforce is fairly homogeneous in skillset levels, this might be a good approach. On the other hand, it might not work, for example, by trying to get attorneys and legal secretaries to cross-train. In other words, one needs to think about what kinds of processes that are critical to business survival really need this mitigating measure, and the people that are likely to be available to support them.

Another measure is formal controls, that is, documented process descriptions, procedures and task instructions. This solution is often unpopular, and are strongly resisted by many managers in successful small- to medium-sized firms. When they are in a rapid growth phase, they see formal controls as bureaucracy and red tape, rather than process control measures with business continuity side benefits. "We didn't need them when we were struggling, lean and mean, why should we need them now?" Well, without delving too deeply into the organization theory behind it, let's just say that success in any organization means, among other things, growth in the sheer number of employees. With that comes added organization structure ' layers or levels of management and the necessary division of labor into functional units. In short, the complexity of the organization increases and, with this growth, comes complicating influences that interfere with process efficiency and effectiveness.

Harnessing the Team


In the absence of what are called "intervening variables," such as formal (written) control and communications practices, growth, especially rapid growth, actually diminishes overall organizational performance. Imagine a mob of folks just moving around and bumping into one another, each trying to get work done, but without anything to guide them along their way. When a firm is small, everyone knows their job and what everyone else's job is, and how they interact. But when dozens to hundreds are added to the mix, it just isn't that simple anymore. And what, you ask, does this have to do with business continuity? For large firms or those on their way to being large, everything.

Those bureaucratic-sounding things like policies, org charts and procedures are the "harness" that helps management control the direction and velocity of the "team" of staff members without having to constantly stand over them. These documents become the track on which the enterprise runs. This isn't to say that everyone does their job with one eye on the work and the other in the manual. Rather, it's that a thoughtfully planned set of process control documents can provide everyone enough guidance and control to keep vital business processes running smoothly. And when a disaster interrupts the smooth operation, those procedures are the guidelines for getting back on track. This is especially important in cases where the person(s) who normally perform a particular task are not available for duty. Some tasks are so critical that you may want to create a procedure sufficiently detailed that you could almost hand it to any reasonably literate person and at least get the process up and running. This approach requires consideration of something I call balance.

The Balance Model


Every process has certain, required skillsets, whether mechanical, mental or managerial. And your workforce hires each person for what skillsets they bring to the position; human resources folks refer to this as fit: "the candidate is a good fit for the job." What this means is that the candidate has a desirable combination of education, training and experience to become productive in the position within an acceptable period of time from hire. When a disaster strikes, some or many of those people, who were carefully "fit" into key positions may no longer be available to support critical business processes. It simply will not suffice to say: "Well, with Fred and Jane out, I guess we'll just have to shut down and go home." Whatever skillsets Fred and Jane brought to the workplace may be lost, but it is possible to span the gaps between what they had and what is available in those who are able to report for duty with more detailed procedures (than Fred and Jane would need). To illustrate this, consider Figure 1.

The solid, negative-sloped line is a theoretical balance between how much a person brings to a task in terms of skills and/or experience and how much detail an instructional document (procedure) would need to provide sufficient added direction to assure consistently acceptable performance. The "Training and/or Procedure Gap" consists of smaller detailed aspects of the task that are taught by formal or on-the-job training. Any given business process often has elements that differ from how things are done than in other firms, so these must be picked up by anyone new to the task. In a disaster response, there is little time for training, so business process resumption procedures must enable emergency replacement staff to quickly "get up to speed," wherever a task is critical.

Back-up Tapes for Staff Outages


The main application of the Balance Model for business continuity planners is to determine where loss of key staff for critical business processes can be offset by the development of more detailed instructions. Think of them as the equivalent of back-up tapes for staff outages. By interviewing those key staff members and fleshing out a step-wise procedure aimed at making the process clear to someone with little direct knowledge of its operation, a vital resource has a greatly enhanced chance to be recovered. To restore a process interrupted by loss of its key operator, identify an available replacement candidate, hopefully with at least some relevant skills and/or experience, hand them the procedure(s) and get them started.

In the information technology industry, millions are spent each year to enable recovery of the IT infrastructure, yet in many industries, computer outages are not as great a threat to a firm's survival than the loss of key staff. The development and maintenance of business process recovery procedures does require the expenditure of time and money, but, like the cost of back-up tapes, offsite storage and hotsite subscriptions, a sound business case can and should be built by planners where people are the most vital asset.

 



Gregg Jacobsen, CBCP, is Contingency Services Manager for Computer Sciences Corporation in Southern California, responsible for the DR programs of two major defense industry IT outsourcing clients. His previous experience as a quality project manager and in business process consulting has augmented an MBA in Organization Development to enhance his process-oriented approach to business continuity planning. His use of Aesop's fables is also the basis of a book on general management principles he plans to publish in the near future.

This article Printed in Volume 13, Issue 1