Creating A Global Recovery Program:
With Limited Resources

By A.J. Gonzalez and Scott Ream

Imagine this…
You are responsible for business recovery planning at your corporate data center. You have a staff of one. Your job is to properly maintain and test the recovery plans for the mainframe and mid-range computer systems.

Occasionally, you are invited to provide business recovery consulting to an interested affiliate. However, this is rare, because outside the data center, the need for business recovery planning is not recognized, not a priority, not mandated, or, in many cases, thought of as purely an Information Systems responsibility.

Your Chief Auditor has made Business Recovery Planning a high priority item for all audits, worldwide. Your company has hired a new Chief Information Officer. He believes proper Business Recovery Planning should go beyond the traditional "glass walls" of the corporate data center. Together they have a clear understanding of the importance of this issue for the company.

This is a business recovery manager’s dream come true! Not only do they believe in what you do, they want you to develop a global business recovery program in the next four months! The program should address business process and client/server technology recovery. It must be easily delivered, enforceable and manageable (with no addition of staff).

Warner-Lambert Company has about 45 business units/facilities in North America and over 80 other sites throughout the world employing more than 40,000 people. The objective from the beginning was to provide business process and technology recovery training-as well as the appropriate tools-to all colleagues needing this help. The ownership and responsibility for implementing and maintaining recovery programs would be placed squarely on the shoulders of local management worldwide.

To accomplish this challenging task, a consulting partner was selected to help us develop a corporate "business recovery methodology" which would include a corporate policy, an organizational tool which would guide the planning process, a training vehicle, and a method for tracking the program.

THE METHODOLOGY

Step One
Develop a Corporate Business Recovery Policy

The first order of business was to write a clear and concise Corporate Business Recovery Policy to which all management would be accountable. Because of their involvement in policy compliance, Corporate Internal Audit and Quality Assurance departments were enlisted to help.

Before being finalized, the policy was reviewed and approved by a representative group of divisional vice presidents. While the policy was under review, we developed the Business Recover Methodology materials and program delivery techniques.

Step Two
Build an Organizational Tool

We needed a "cookbook"--clearly written and easily understood by all. This User’s Guide contains the corporate policy, customized training materials and seven phases that detail the methodology:

1. Organize the Business Recovery Plan
Justify and outline the scope, goals, and objectives.

2. Collect Business Recovery Data & Information
Identify relevant business processes, the technical infrastructures that support them and existing business recovery practices.

3. Perform Business Impact Analysis
Quantify impact and prioritize mission-critical business functions and technology platforms.

4. Design Business Recovery Strategies
Develop process and technical recovery strategy details and prepare a report to management with recommendations.

5. Write Business Recovery Plan
Design recovery organizations, document tasks and responsibilities after receiving management approval.

6. Test Business Recovery Plan
Develop test scenarios, facilities, success factors, auditing, reporting, etc.

7. Maintain the Business Recovery Plan
Implement periodic reviews and change management, update policies and procedures, etc.

Each phase contains an introduction, a summary of key considerations, and examples of actual tasks addressing those considerations. The User’s Guide includes appendices with examples of business recovery planning project tasks, recovery organizations and team definitions, data collection questionnaires, and recovery plans.

Step Three
Establish a Training Program

Once a draft of the methodology was completed, we developed a two-day training class to deliver the information and provide hands-on training. We then conducted multiple two-day training classes to pilot the methodology.

Pilot Program
A key objective was to ensure that we had a good cross-section of backgrounds. We invited colleagues from manufacturing sites and corporate departments. We invited representatives from Internal Audit and Quality Assurance to ensure long-term compliance. Feedback was collected from each class and adjustments and modifications were made to the training materials, class format and User’s Guide where indicated.

Step Four
Design a Global Delivery Vehicle

We faced a significant challenge--how could we develop an efficient and economical way for two persons to deliver this training throughout the company? We needed a plan that would not require excessive travel or inconvenience clients at our headquarters location or abroad.

The Solution:
One training class per month was scheduled at Corporate Headquarters. Classes were open to anyone based at Headquarters or an affiliate visiting on business. For all other North American and international locations, we designed a regional training approach. For example, we scheduled one class at our facility in Michigan that was open to affiliates in surrounding states. We also conducted a training class in Kuala Lumpur, Malaysia, which was attended by representatives from all our Southeast Asian affiliates. The same approach was taken in Latin America and Europe. Our mission was to take the training to them.

Marketing Strategies Used
1. The company’s global newsletter published a motivational article describing our program.
2. The headquarters closed circuit TV system broadcast news about the program.
3. A business recovery video was purchased and made available to our colleagues.
4. The corporate Intranet home page listed information on our program.
5. The Corporate Disaster Recovery department paid for training materials, software licenses, and travel expenses for instructors during the first year of the program.

Step Five
Track the Program

Attendees of our business recovery class are issued a numbered copy of the User’s Guide and software package. Their names are logged in a tracking file so that we can track their progress and know where to send program updates. When colleagues from a specific location call for business recovery information, we refer them to a person at their location who serves as site coordinator or has already taken the training.

Numerous roadblocks stand in the way of recovery planning--time, availability of resources and funding, business priorities, and lack of awareness. We were fortunate to have a CIO who believed in and supported the need for business recovery planning, a Chief Auditor who helped focus local management attention to this requirement by making it a standard audit review item, and a consulting partner whose knowledge and expertise moved us toward our goal.

Together they challenged us to create a program that would eliminate all excuses AND they empowered us to make it happen!

About the Authors
A.J. Gonzalez, CDRP, is Manager of Client Administration for the Corporate Operations & Technology Group of Warner-Lambert Company.

Scott Ream is President of Virtual Corporation, Inc., a New Jersey-based process consulting firm. For more information, please contact Michael Leyden, at (973) 927-5454, at: mleyden@virtual-corp.net or visit their web site at www.virtual-corp.net.