As a leading continuity-consulting firm to major private and public entities over the last thirteen (13) years, we have worked across many industries and seen varying levels of organizational preparedness in the event of an unplanned disruption due to natural, man-made or technological events.
We have written many times over the years on the lack of preparedness across our private and public entities that have a proven need to have robust continuity plans to continue operations following a catastrophic event. Financial institutions, in the USA, are traditionally leading in having the most robust and proven continuity programs due to their criticality to our financial well-being. Consumer and supply chain based organizations also work hard to have sound continuity capabilities. But to many peoples surprise, our health care system is seriously lagging and has one of the poorest continuity maturity levels when it comes to ensuring resiliency of critical patient information technology and data. Our city governments are also lacking in having sound continuity programs and strategies to maintain key services and operations to their constituents.
Why? In many cases, organizations will espouse the lack of a robust budget as the major deterrent in developing a sound continuity program. However, based on our study of our customers over the last thirteen (13) years, the key criteria for success of continuity programs is:
- Management Support -How effective is the management support to the program? It is regular, effective and business driven?
- Management Direction – Is management providing the team with the right direction at the right time? Is the direction consistent with short and long term needs of the organization?
- Steady Progress – The race does not always go the hare but to the turtle who makes steady progress over time. Does your program have the proper support and direction to make consistent progress that leads to a higher level of sophistication and maturity over time?
- Budget – Yes, you must have the financial resources to implement a successful program. However, without the right support, direction and steady progress, the size of the budget does not guarantee success. We have seen programs with large budgets that cannot recover their business and others with small budgets that with the support and direction make the steady progress to a “best of class” program.
In Hurricane Sandy in 2012, we worked with clients who were well prepared and others that were at the lowest levels of readiness. Here is what we found as key issues during our support of their response and recovery:
- Management was poorly prepared to serve as the Crisis Management Team and strategically lead the company back to normal business operations due to lack of training and exercises.
- Technology without electrical power does not provide any value.
- Companies declaring to their key customers that they have continuity plans and strategies for key processes and systems, when in fact, they were making them up as they recover.
- Lack of viable recovery plans or strategies that could recover the business and its technology in a timely manner to meet customer and stakeholder needs.
- You will have other events occur that will impede your recovery and have nothing to do with the event that caused the initial disruptions.
- No manual or automated processes/systems to easily notify and update employees, contractors and others throughout the event.
- Employees ill prepared to deal with a disaster at home; if employees and their families aren’t safe they are not coming to work.
- Employers lacking guidelines on how to deal with paying for employees during an extended outage; how long should the company be obligated to pay them for until business operations are restored?
- The fragility of the supply chain for food, fuel and other critical commodities and the impact to employees and companies.
- Companies not educated on the need to move critical business and technology operations out of the region to minimize impact of a regional event.
- Even the best-prepared companies struggled in recovering their business and technology operations.
Now, on the flip side, we found many stories of employees going over and beyond to meet the needs of clients and fellow associates. And yes, the companies recovered. But, in many cases, if the company had planned ahead, employees would not have had to expend superhuman efforts to meet the needs of the event.
It is MHA’s opinion that continuity planning must be a mandated requirement for all companies, not just highly regulated industries. More importantly, companies plans and strategies for critical industries must be thoroughly vetted and validated. If you rely on a critical vendor or supplier to keep your company running, its time you validate that their continuity-planning program can deliver as stated. Lastly, as Americans, we must be better prepared to deal with an event at home and take care of our families for an extended period of time without help from outside agencies. The time to better prepared is now.