As I reflect on my first year as a business continuity professional, I contemplate what has made me successful to date. In my previous role of being an officer in the U.S. Army, I lived and breathed risk assessments and contingency planning (addressing a loss of resources). When I first started in the military, my focus was very tactical, ensuring that there was always a plan to replenish our basic supplies (e.g., bullets, food, gas, and water). These plans were very basic and more reactionary than anything else, but I always knew that as long as I had these resources, I could continue the mission.
As I grew in competence and understanding, I began to see a more strategic picture. And, as I developed a deeper understanding of how each resource integrated into operations on a larger scale, I realized that my plans were often lacking in totality; the plans were too focused, unable to account for downstream impacts and forecast issues. Once I began to apply both tactical and strategic level knowledge, I was able to build plans highly resistant to disruption. These plans were no longer solely reactive – they included proactive risk mitigation measures as well. As I departed the Army for the private sector, I took the skills the Army had taught me and applied them, with slight alteration, to the private sector. As it turns out, the ability to view resources at the strategic and tactical level are not only keys to success in military planning, but also in business continuity.
Over the past 12 months in the private sector, I’ve noticed that most organizations tend to focus tactically on resource requirements (typically only a single resource at a time), often failing to establish context (how the resource contributes to the ‘bigger picture’ strategic needs of the organization). In other words, I find it common for those charged with performing business continuity planning to lose sight of the resource requirements necessary to produce or provide products and services – a disconnect that often results in failure to appropriately design and implement business continuity strategies to protect the resources necessary for the organization to be successful.
In order to illustrate the issue, let’s look at a fictional organization called Green, which provides call center services for insurance companies. Green’s Florida call center handles approximately 75% of the workload and the other two call centers are often near or at max capacity. Green identifies that the Florida call center generates approximately 60% of revenue. Due to these facts, Green’s executive leadership has deemed the Florida call center as critical and is concerned about disruptions to customer-facing operations at that facility.
Initiated by executive leadership, the business continuity team focused on building resiliency for the Florida call center – mainly taking a tactical level approach to identifying resource requirements for the call center personnel. The team identified that call center employees could work from home – using applications that provide remote desktop access and/or VPN connection to Green’s applications and telephony resources – mitigating impacts from facility downtime or loss. The business continuity team updated the Florida Call Center business continuity plan to include this remote work strategy.
Three months after updating the Florida Call Center’s business continuity plan, the call center was impacted by a tropical storm that caused flooding and prevented access to the facility. As the Crisis Management Team (CMT) began to implement the Florida Call Center’s business continuity plan and remote work strategy, they ran into several issues. The VPN was overloaded by traffic, some employees were unable to successfully work from home due to wide-spread power outages, and the two other call centers were being overloaded with redirected calls, which greatly increased customer response times. Green was able to continue operations, but they were not able to deliver the same quality of service that customers had come to expect. As a result of breaking SLAs and customers leaving, Green experienced heavy reputational and financial impacts.
Unfortunately, Green’s business continuity team experienced some of the same issues and obstacles as other business continuity newcomers. Specifically, by focusing solely on the loss of the facility, the team overlooked other necessary resources, as well as downstream impacts from losing the resource. My time in the Army taught me that it is necessary to view the mission – in business terms: the delivery of products and services – from both a tactical and strategical view in order to capture all the necessary resources and potential risks. As an example, here are some questions that should have been answered at each level prior to strategy selection:
- What else (i.e. resources) do call center employees rely on?
- Do all employees take home their laptops?
- Are the calls private enough from home?
- Do employees have an appropriate internet speed at home?
- Do employees have the appropriate equipment at home?
- Is there specialized equipment stored at this facility?
- What is the VPN capacity?
- What do we feel is the customer’s view on an acceptable level of call center performance?
- What other teams work from this facility?
- Do any teams working from here provide outputs to the Florida call center?
- How (or does) this impact the other call centers?
- Can other call centers handle additional call volume?
- What other services/internal operations does this disrupt?
- What other resources are needed to deliver services?
By looking at the resource at a purely tactical level, Green’s business continuity team identified resource requirements and risks related to the Florida call center facility itself, but they missed the other required resources to ensure a successful remote work strategy and risks across the organization.
By viewing the resources at a purely strategic level, the team would have identified all services and internal operations the resource supports, but they would have overlooked the downstream risks (e.g., VPN capacity and power issues).
By remaining only at the tactical or strategic level of thinking, business continuity professionals, more than likely, will overlook some resource requirements required to continue operations at an acceptable level during a disruption. As a result, it is impossible to develop appropriate strategies without the knowledge from both the tactical and strategical views.
Over the past year, I have found that connecting resources to products and services allows me to connect with executive management and implement the strategies necessary to protect the business at a more tactical level. By understanding these connections, I can maneuver from strategic level thinking to tactical thinking, encapsulating and prioritizing all dependencies based on their importance to the organization (and its customers). This knowledge allows me to understand all resource requirements and develop strategies that, when implemented, allow organizations to operate at an acceptable level during a disruptive incident.
Business continuity and IT disaster recovery planning is all that we do. If you’re looking for help with building or improving your business continuity program, we can help.