Written by Fiona Raymond-Cox
Working in business continuity there is no getting around the fact that you are going to need someone else’s data. That data won’t be perfect. The question is, what do you do when it’s not? How do you make it manageable?
The business continuity program office works with every critical department in the company putting you – the business continuity practitioner – in the enviable task of working cross functionally. Further, you are often the crossroad where data from those departments intersects. You have a great opportunity to promote data alignment across platforms!
Human Resources has employee contact information needed to implement the emergency notification system
Today’s the day your team is working with the vendor to implement an emergency notification system. The vendor has asked for the contact information the system will use to send messages to the folks in your response teams. You have two options:
- Allow staff to enter and maintain their own personal records directly in the emergency notification system. The challenge with this is that you are taking on a big training effort as well as the responsibility for ensuring the ongoing integrity of the data.
- Leverage the human resources information system (HRIS) which likely contains some (and possibly all) of the employee contact information needed to populate the emergency notification system database. You will still have to ensure that this data is accurate and can remain up to date.
In any event, you opt for the latter choice because HR already has a process to gather and maintain sensitive employee information that you can leverage (e.g., employee name, home address, personal and work contact details, department, work location).
An initial analysis of the HRIS data shows inconsistencies that must be resolved before it can be used in the emergency notification system. City names have been spelled differently. Department names have sometimes been abbreviated. Phone numbers are entered with or without spaces or parentheses.
These issues must be resolved before you can leverage the benefits of your emergency notification system to disseminate automated messages for an improved response.
Corporate Real Estate has location and building data that is needed by response teams
The business continuity program office will encounter situations where reliable location data is needed:
- Recovery plans (e.g., emergency response, business continuity, crisis management) need to capture not only the country where the organization has operations but also the buildings where specific business activities are undertaken. This will ensure resources can be allocated efficiently when incidents occur.
- The emergency notification system must accurately reflect staff in a specific country, zip code(s), or building, depending on the scope of the emergency.
There can be so many inconsistencies with this type of data:
- Countries are spelled differently or misspelled (e.g., Viet Nam, Vietnam, Veitnam)
- Building monikers are not uniform (e.g., 001 Building A, 001-Building A, Building A, building a, Bldg.. A)
- Specific addresses are an assortment of possibilities – there’s simply no uniformity to street name, city, county, state, zip codes
These issues prevent you from using the data “as is”. While you had initially expected to consult Corporate Real Estate to help with rectifying issues with location data, you also recognize Finance and HR have location data in their systems. This presents the perfect opportunity for everyone to work together to ensure that the data can be used consistently throughout all these systems.
IT has data about applications & systems that is needed by the business
You have been asked to improve business continuity plans so management has better visibility of which business activities are impacted during a system or application failure. Gathering this key data during the upcoming business impact analysis review process, you rely on:
- IT to provide a list of systems and applications and their recovery time frames from their IT disaster recovery plans
- The business to provide its list of prioritized activities along with the systems and applications needed
The main challenge is that IT and the business often use different terminology to refer to the same system or application (e.g., the order management system is sometimes referred to as “IBM Sterling OMS”, or “OMS”, or “Zeus” and many other variations on the theme!).
While the list that IT provides can serve as a good baseline for the BIA interviews, it may not be as easily understood by the business. It is best to establish a system or application naming convention so the business can accurately identify the systems and applications they use, and IT can correctly embed busines recovery needs into their disaster recovery planning protocols.
You are at the crossroad where IT is using a name that doesn’t resonate with the business. Resolving this must be done if you’re going to have meaningful data to work with.
So how do you move forward? The good news is that there’s one path for each of the three examples cited above. The solution is to partner with the owner of the data to implement data quality standards that you can both use. When common fields are identified and the method of input is clearly agreed upon, as well as making sure the data is scrubbed, and maintained, then suddenly many departments benefit from the use of the data.
In conclusion, we business continuity practitioners need to use others’ data and are aptly placed to help improve that data for everyone’s benefit. I recognize the desire to drive consistency can be a rather arduous task and perhaps outside the realm of what you might consider to be your typical day job, but it can lead to significant improved efficiencies company-wide for which you will be thanked.
If you have any questions about these ideas, reach out to info@raymondcoxconsulting.com.
