It’s the people, stupid…
In 1992, Bill Clinton and George Bush, senior, were running for the presidency of the United States . Drawing on consumer research, James Carville, Democratic Party strategist, decided that the push for presidency needed focusing and he came up with three simple straplines. The paraphrase of one of these has remained in the public consciousness ever since: "It's the economy, stupid." Continuity Central is now three years old, having been launched in March 2003 and, during the intervening years, I have spoken to many business continuity managers following the invocation of their BCPs. These off and on the record conversations tend to focus on what went well and what went wrong, as well as the lessons that were learned as a result of the invocation. Time after time the same responses crop up: the fly in the ointment tends to be unanticipated people issues. So, maybe now is the time for a Clinton-like war-cry: "It's the people, stupid." Here are some examples of people issues which have genuinely caused unexpected problems during a business continuity plan invocation: • A crisis manager could not locate any of the crisis team following a forced evacuation of the company’s headquarters building due to a bomb explosion. Crisis team members had left the vicinity and could not be contacted by mobile ‘phone because the network was over-loaded. This meant that the recovery started over an hour late, after some members of the team had been finally tracked down. • A company could only manage to fill around 50 percent of the work area recovery places it had contracted from a third party supplier because the supplier’s nearest facility had been impacted by the same incident as their customer. This meant that staff were being asked to travel approximately 30 miles to attend a second recovery facility. Many staff refused to travel due to childcare and other family reasons. • A company could not fill its complement of work area recovery seats because some staff were too scared to travel to the site following a serious terrorist attack. • A company could not meet its recovery time objectives because various key members of staff were either unable or unwilling to give time to the business because they were dealing with personal housing, health and bereavement issues following a Caribbean hurricane. The list could go on… and on. But there are enough examples to highlight the point: that however good your business continuity plan is; however well protected your data; however well you have covered your mission critical processes; if you don’t have the right people, in the right place, at the right time, then your recovery is at best compromised, at worst totally debilitated. Much more research needs to be conducted into the people side of business continuity planning, but some suggestions for ways to improve in this area follow: • Honest exercises One relatively effective way to explore some of these issues is to create a very ‘safe’ discussion environment, where people can be encouraged to be totally honest about how they might react under differing circumstances. Guarantee that nothing shared during the discussion will be officially recorded, or held against people. Using small groups, role play and one and ones with external and, therefore, neutral facilitators may help. A good time to hold such a session might be after a standard exercise has been reported upon. The results could be used as a discussion starter; with participants being presented with feedback on their behaviour during the exercise and being asked to consider questions such as: “In what circumstances would I put my family before my work?” “What personal risks would I take for the company?” How would their response to the exercise have differed if personal priorities were deemed to be more important than company priorities or if there seemed to be a high risk to their own safety? What could the company do to assist in these areas? • Predicting people’s response to a crisis Army recruits go through vigorous personal stress-testing to try and determine likely behaviour during times of extreme pressure and to train people to behave in a desired way. While such an approach is clearly not appropriate in a business setting; it can be used in a limited way. Many team-building courses are designed to bring out people’s crisis leadership skills and to highlight their likely response when under pressure and stress. Such people-exercises are as important as technology and process tests and should be run on a regular basis. They can be augmented by psychometric testing and by the use of occupational psychologists and other professionals to explore people’s character traits and their personal history, to predict how they are likely to respond to extreme stress and pressure. • Consider people’s needs during an invocation - Transportation to recovery facilities. Don’t assume that public transport will be available or that staff will be willing to use it. Don’t assume that staff will be able to drive to recovery facilities using their own cars. - Childcare and other family care requirements. If staff are required to travel to recovery facilities, or work longer or different hours to usual, what will their home needs be? How can the company help with these? - Personal and family security: if critical members are staff are required for a recovery during a wide-area incident, are there other members of staff who they would trust to focus on helping their family? - Crisis communications: staff need to quickly receive or have access to accurate information about what is expected of them during an incident. Information should be frequently updated. Staff should never discover information which affects them personally via non-official sources, such as a local newspaper or the company ‘grapevine’. - Rewards: if you expect staff to ‘go the extra mile’ during an incident; reward them afterwards. This creates goodwill and ensures that the next time a crisis occurs they are likely to put the same effort in. Goodwill is a tank that can only be drawn upon for a limited time without ‘topping up’. - Special needs: check whether staff using recovery centres have any special requirements. For example, ensure that people using wheelchairs will have appropriate facilities provided; and ensure that people’s religious needs are met. Can your recovery centre provide a Prayer Room to meet the needs of Muslim members of staff? - Payroll is a critical process: don’t neglect it in your business continuity planning. Staff need to be paid on time and accurately; if this does not occur your company will quickly lose the goodwill of employees. - Aftercare. An incident doesn’t finish when ‘business as usual’ is achieved. For some staff, their lives may be changed for ever by the incident; especially if friends, family or colleagues have been killed or injured during a disaster. Don’t under-estimate the long term impacts of stress and trauma: ensure that appropriate aftercare is given and don’t skimp in this area. Add to this list/ make a comment Reader comments Very apt article, very much in harmony with a presentation I did at a conference last year titled: ‘Double Whammy, or What Do You Do If You Gave a Disaster, and Nobody Shows Up?’ Your examples of actual events validate a premise some attendees seemed to find far fetched. Yet, as I am helping a client build a pandemic flu contingency plan, it's clearly the people where the impact will be most directly visited. This unique scenario helps to underscore a fundamental management tenet many in our profession have yet to recognize: it is PEOPLE who do the work of the enterprise; not the IT infrastructure. People execute tasks in various processes, using a variety of resources, but, without the people, things pretty much grind to a halt, whether sooner or later. Therefore, when addressing contingency plans, the very real prospect of a fair chunk of the team being unavailable or unreachable must also be planned for. Which does raise a subtle and seldom discussed issue of team building: Who do you put on recovery teams? The people who are best at the jobs they are chosen to recover? Or others, who enable the recovery so that key employees can more readily be brought back into productive work? Further, do you qualify team members as to their ability and willingness to commit to reporting when called upon? Do you seek out single staff members who may be more likely to be available when the phone rings? Again, this is one of those topics that get overlooked because people, like some other resources, are too easily taken for granted. Gregg Jacobsen, CBCP I wholeheartedly agree, it is the people, stupid, and I can add another anecdote. Some years ago, when I was the IT manager of a company, we had a fire in the middle of the night on the fourth floor of our administration offices. Instead of invoking the company's business continuity plan, the keyholder of the office, who had been notified of the incident by the Emergency Services, decided to respond to the incident in the way that he thought was best at the time. I was a member of the company's business continuity team, and found out about the incident via one of my operations staff who was in the building at the time of the fire. By the time that I managed to get to the office, at about 5am , the keyholder had already taken lots of decisions and initiated quite a few actions. Some of these were in line with our action plan, some not. The business continuity team eventually managed to convene at about 10am, and was faced with a "fait accompli". We had to undo some of the actions that had already been taken, and take others which had simply been missed. In the end, we coped quite well, and didn't lose too much time, money, or business, but we were lucky. Had the keyholder been less competent, things could have gone badly wrong! Mel Gosling
•Date: 31st March 2006 • Region: World • Type: Article •Topic: BC general |
