|
|
|
BCP, Where "P" Is For People by Michael Seese, M.S., M.A. Article Overview: This article is for business contingency planners who already have sold management on the importance of BCP, and now must convince everyone else. BC planners may find that the average employee is hesitant to help out because of several (unfounded) fears. But by explaining how BCP improves job security, how the lessons of BCP can be applied to their personal lives, and how certain BCP activities can enhance their work experience, the planner will get the workforce on board. Job seekers looking for a position in business contingency planning probably will, more likely than not, start their search in the "Computer Systems" or "IT" section of the classifieds. To some degree, this ad placement makes sense. For a business to get back on its feet after some disastrous event, mission-critical data—customer files, internal applications, and HR information—must be restored to a point as near to the event as possible. The strategies to accomplish this recovery—RAIDS, mirrored databases, and even regular backups—do fall under the general IT umbrella. However, it takes more than a successful data restore to put a business back in business. It takes people. And in the event of a true disaster, these people may be under duress, fighting personal distractions, and performing a job function other than their own. So, just as an IT manager must plan for, implement, and test his data backup strategy well in advance, a BC manager also must plan for, implement, and test his people backup strategy well in advance. In recent years, numerous articles in the trade journals have discussed tactics to "sell" contingency planning to management. Although there no doubt remain some skeptics, I believe that by this time management by and large has been sold. Now comes the hard part: Selling BCP to everyone else.
Employees may have a variety of reasons for resisting a corporate-wide BCP effort. Three which stand out are:
In order to break down this resistance, management must counter with an education program which emphasizes:
A successful BC program needs more than data recovery strategies. An unexpected event may require a response as complex as the corporate headquarters being relocated, or as simple as the backup tapes being delivered from the off-site storage facility. While either of these steps is taking place, the business still has to limp along, doing its best to continue serving its customers or making its widgets. Often, that means employees will have to operate in "manual" mode, whether that involves taking orders literally using pen and paper, or simply working offline while connectivity is being restored. Either way, these manual procedures must be devised, documented, tested, and revised. That takes effort, and in no place I have ever worked has "I have too much time on my hands" been written on a piece of paper and stuffed into the suggestion box. Further, employees might feel a certain sense of apprehension documenting in minute detail their job functions as, in theory, management could use that information to train their entry-level replacements after an unceremonious (and unwarranted) dismissal. And finally, employees may see the BC exercise as a waste of time, since the chances of a large-scale disaster affecting them or their work location are slim. To counter these perceptions, the BC planner must sell BCP. Perhaps the biggest challenge is fighting the "it can't happen here" mentality. Certainly, most American businesses will never face a disaster on the scale of the September 11 terrorist attacks. When preaching BCP, I do not lean on 9/11/01. Instead, I talk about 11/12/01. That was the day American Airlines flight 587 crashed into a Queens neighborhood shortly after takeoff, killing 260, including nearly a dozen people on the ground. Do planes crash very often? No they do not. However, anyone whose place of employment is within the flight path of a major airport has to be at least somewhat concerned about a similar event. Of course, terrorist attacks and transportation accidents are not the only concern. No area of the country is immune from some form of natural disaster. But who needs a "disaster," in quotes? Those of us who live up north have snow. It is not unexpected, but sometimes it surprises us. This winter saw a storm which dumped three feet of snow on Boston, though cities as far south as Texas also were affected. I personally have not seen any figures on the dollar cost in terms of lost productivity. However, I would imagine it is significant. So one of the messages that employees must get is that any event—large or small, completely random or commonly occurring—will impact the organization's bottom line. The BC planner can cite some well-known worst-case statistics: According to a University of Minnesota study, 80% of companies having an extended outage are out of business within five years ("Inside The Numbers," Continuity Insights, May/June 2003), or the American Power Conversion Corporation's estimate that the average cost of downtime, across all industries, is $1,000,000 per hour ("Inside The Numbers," Continuity Insights, May/June 2003). Then, the planner can turn to the common sense argument. Say the event is not catastrophic. Say the business loses $1,000,000. For a large, multi-billion-dollar company, that loss might be a drop in the bucket. For a smaller firm, a $1,000,000 loss might translate into reduced benefits, or perhaps a reduction in staff. In short, the employees must be convinced that any business loss has the potential to trickle down to them. The BC planner also should paint the creation of detailed job function documents as a positive exercise. Employees are overworked. But cataloguing the minutiae of their daily activities—while requiring an up-front investment of time on their part—could result in long-term reductions to their work loads by uncovering inefficiencies, redundancies, or even tasks that should belong to someone else. People like to feel helpful, useful, and needed. A key point is to emphasize that good BCP is a real, tangible way for employees to contribute to the success of their business. Saying "We need your help here" is not some kind of "leveraging our synergies / working smarter not harder" corporate-speak. It's the truth. Another selling point is that business contingency principles can be applied to their personal lives. For what is BCP, but foresight and good organization? These basic tenets of BCP can be incorporated into daily activities, whether it is vacation planning—"What would we do if we lost your glasses or my prescriptions?"—or family emergency preparedness. In fact, the American Red Cross provides a number of resources to help families ready themselves for emergencies. These materials are available on the web at http://www.redcross.org. Post this URL on the corporate web site, and encourage people to download and review them. Or better yet, see if the local chapter of the Red Cross would send a representative to your company to address the employees. Send a clear message: We care about you and your loved ones. A more radical step that businesses may take is to institute work-at-home days. Though not practical for every business—or every department within a business—letting employees work from home on a regular basis might prove to be a beneficial long-term strategy, both from a BCP and a morale perspective. If practical, mandate that 1/5 of a team's members work from home on any given day. Or, if that arrangement is not feasible, perhaps employees could work four 10-hour days, likewise rotating days at home. The idea is to have 20% of your workforce somewhere else each day. The underlying rationale does not have to be as dramatic as thinking, "If the facility is destroyed, at least one-fifth of our workers will survive." The reasoning can be more mundane: If there is a gas leak or an electrical outage which slows or stops us, people will still be working. To illustrate, I can share a personal anecdote. On the morning of September 11, I had a doctor's appointment, and decided to work from home. Shortly after the attack, my office was evacuated. From what I have been told, many people did not take the time to shut down and un-dock their laptops. Instead, they (understandably) grabbed their personal effects and left. I was able to stay online. Can I say that because of me, we stayed in business that day? Not even in my most heroic dreams. But I was able to monitor the system and report during our several teleconferences that afternoon that everything was operating normally. Work-at-home days also afford employees the luxury of being sick. Often, an employee who feels a cold coming on nevertheless may go in to the office to avoid burning a sick day. But if working from home is not frowned upon, that person may choose to stay put, which will both speed his recovery and prevent him from sharing his cold with anyone else. Likewise, when the weather turns bad, employees can work productively from home, rather than waste their energies on a white-knuckle commute. Again, the bottom line: More people working, and fewer corporate dollars trickling needlessly down the drain. In conclusion, despite the growing use of information systems and data to make our businesses hum along, it is still the people who do the work. Well-developed, well-tested business contingency plans help organizations minimize losses from adverse events of any type. The challenge is convincing employees—truly, an organization's most valuable asset—that BCP is in everyone's best interest. About the Author: Michael Seese is an information security consultant and freelance writer in the Cleveland, Ohio area. He holds a Master of Science in Information Security and a Master of Arts in Psychology. With over 15 years of experience as an IT professional and journalist, Michael has had numerous articles published in professional journals. He can be reached at mail@MichaelSeese.com.
|
