ERP systems and business continuity management

Michael Gallagher outlines the key considerations.

An ERP (Enterprise Resource Planning) system is a multi-module computer application which is designed to support all of the key activities of an enterprise in an integrated fashion. This includes managing the key elements of the supply chain operation – product planning, purchasing, production control, inventory control, interaction with suppliers and customers, delivery of customer service and keeping track of orders. It may also include HR modules which maintain a central database of the organisation’s people, which is critical to production and staff scheduling functions, and to staff payments.

An ERP is regarded as central to an organisation's ambition to survive and prosper in today’s business environment. It often replaces a myriad of individual systems including accounting systems, and production planning and inventory control systems. Its predecessor systems were often a mix of custom-built systems and package software. They frequently were based on a variety of computer hardware and software platforms and database management systems where significant work had been put into developing and managing the interfaces between them.

The use of ERP allows for greater efficiencies in many ways. It can be a much more effective way of providing computer support to the business functions. It is particularly relevant in the case of large complex businesses or where it is necessary to rationalise and integrate systems and operations in situations where mergers and acquisitions have given rise to a mixed bag of systems and computer platforms. It also allows for significantly greater efficiencies in managing the supply chain. Customers have become more dependent on faster delivery of product and tighter lead times. Safety stocks can almost disappear and JIT (just-in-time) philosophies dominate. In effect ERP has the effect of making an enterprise more time-sensitive and consequently more vulnerable to the impact of time delays.

While there are undoubted benefits, an ERP also poses significant challenges in the areas of information security and business continuity planning. For most businesses the implementation of an ERP is a major, complex project. As such it is not without its risks and this in itself is a business continuity issue. There are many examples of ERP projects that have gone wrong – failed, finished well over budget, or simply failed to achieve the benefits which were anticipated.

Prior to ERP a business tended to have multiple points of failure of computer-based systems and facilities. There were potential breakdowns with individual systems and with the many interfaces between systems. However there tended to be workarounds available and in some cases it was even possible to revert to manual procedures. With ERP there are fewer points of failure but if there is a failure the impact can be very significant. One of the major advantages of ERP is that it allows an organisation to totally redesign its operations rather than just computerise further the existing ways of doing things. This means that there is no real alternative available if problems arise. If it takes time to recover the implications can be very serious and business may grind to a halt. Production may stop, selling, inventory management and other key functions may find it impossible to continue. Time and production records may be unavailable and it may not even be possible to pay staff on schedule.

In the systems environment that tended to exist before ERP, a company’s IT disaster recovery plan might allow for the recovery of different systems and databases at different times. Some could be recovered in parallel using different teams of computer support personnel but there would almost always be a priority sequence which aimed to restore the key systems and computer platforms first. With ERP the usual approach to recovery is to restore the environment as a whole and to have all systems modules available simultaneously.

Another factor which can impact on the recovery of ERP systems is the lack of sufficient in-house knowledge of the intricacies of the ERP. Because of the range of facilities available, and the resultant complexity inherent in an ERP, the detailed knowledge frequently resides with supplier personnel, consultants and freelance experts in the product who were involved in implementation and then moved on. Sometimes the knowledge transfer to in-house staff may be insufficient to provide adequate expertise when problems arise. In theory anyone should be able to effect a recovery from a business recovery plan regardless of who customised, built and implemented the system. With systems as complex and as integrated with the business processes as an ERP this may not always be the case. This should be considered early in the process of implementing an ERP and adequate time must be allowed in the implementation plan for documenting these aspects comprehensively.

Consider business continuity at the ERP planning stage
ERP implementation is an expensive exercise. Apart from the cost of the application and the hardware and software platforms a considerable amount of expensive input will be required from the suppliers and consultants in design, build, data loading, implementation and training activities. Despite the benefits that will be expected to accrue, the cost of installing such a system will be such that there may be a temptation to trim costs by omitting expenditure required to address the business continuity issues. It may be difficult to get board approval anyway without adding further to the bill. The attitude may be ‘let’s get it up and running and we can address the business continuity issues in the next phase’. The history of ERP implementations indicates that the budgets for this initial phase are often exceeded. Consequently it becomes more difficult to get money allocated to continuity aspects during subsequent phases.

Considering the vulnerability of the enterprise in the event of problems this is false economy. If left till the ‘next phase’ it will probably never happen. If planned and provided for from the start the costs are likely to be considerably less than when the facilities are provided later on.

There should be active involvement of the business continuity function from the planning stage onwards. Some of the benefits of this approach and the issues to be addressed in these phases of the project include:

* Potential outages can be considered and thought given to what alternative processes can be designed in at the same time.
* Resilience can be considered more realistically at the point when keeping the costs to a minimum is not the overriding viewpoint.
* How does the planned infrastructure meet the recovery requirements? For example if a SAN (storage area network) is involved have the recovery and resilience aspects been fully thought through?
* Will all of the eggs be in the one basket? Should the computer facilities be split over multiple sites? If this is done does it overcome the need to have arrangements for access to a business recovery site from a recovery facilities vendor?
* Sometimes the funding for recovery sites comes from a designated business continuity budget. This means that the project does not have to carry the costs but it can result in a greater overall cost. Like any other project the overall costs should include the cost of the continuity aspects.
* If there is only a single-site computer system how is it proposed to test and implement subsequent upgrades to the systems? Moving to new releases of an ERP system with significant new facilities can be a major issue.

The implementation of an ERP is usually associated with very tight and often immovable deadlines. For example it may be related to key activities happening during the holiday period or at a slack time of the year. It may be a question of having to have certain aspects of it live from the start of the financial year. In the headlong rush forward BCM issues can be sacrificed to more immediate and, at the time, more urgent tasks.

Michael Gallagher MBCI is a Fellow of the Institute of Chartered Management Accountants. This article is based on an extract from his book ‘Business Continuity Management’ published by Financial Times / Prentice Hall in their Executive Briefings series. For more information and to buy it use the Amazon link, left. Michael can be contacted at gallagml@iol.ie

•Date: 19th September 2003 •Region: Worldwide •Type: Article •Topic: IT continuity
•Rate this article or make a comment - click here