Be prepared

The worst may never happen, but can you risk it? Hewlett-Packard’s Brian O’Gilvie explains why business continuity’s star is rising.

The worst may never happen, but if it did could your business survive? More to the point, can you risk it? In fact, even the smallest disaster or disturbance could impact the provision of your customer services and your revenue-generating operations to a considerable extent. In an exclusive interview with FST, Brian O’Gilvie, Business Continuity and Availability Manager at Hewlett-Packard, EMEA, explains why implementing business continuity and availablity is a growing focus among European businesses.

FST. Why do you think it is now more important than ever for FSIs to implement a business continuity strategy?
BO. A growing number of customers are coming to HP for business continuity and availability, for a number of reasons. These are a combination of the changes we are seeing in environmental issues – such as the electronic security breaches that threaten a business’s information – and the continuous drive towards improvements in customer service and competitive advantage.

There is certainly a degree of understanding within FSIs that competitive advantage is to some extent reliant on IT, which places business continuity and availability (BC&A) as a core strategy for remaining competitive in the marketplace. Those that have it will succeed, and those that don’t will come in second best.

FST. So you’ve seen an increase in interest and demand for your solutions? What do you think is driving this?
BO. On one level, it is associated with globalisation. Companies that are driving their business across multiple European or global locations want the ability to manage all of those business units with the same level of confidence – replicable solutions and benchmarking are key. That’s being compounded by the pressure to adhere to compliance and regulations.

Another driver is the move to outsource or out-task areas of business not seen as ‘core business’, but recognised as vital for business survival. HP is helping companies understand how to implement cost-effective solutions for a variety of needs.

Add to that the growing maturity of smaller companies that are starting to realise some of the benefits that larger companies have traditionally seen. They are maturing and moving plans for disaster recovery towards a business continuity focus. This is something we are also seeing across Europe, with smaller countries now maturing and focusing more strongly on managing for disruption and disaster.

Another area we see driving demand for business continuity is the trend towards mergers and acquisitions. In such a situation, having the right information available at the right time, and ensuring that you adhere to policies for data protection and management, is essential. As such, a focus on business continuity is going to be increasingly important in demonstrating operational risk management.

FST. So what considerations should companies take into account when looking to implement business continuity and availability?
BO. HP recently invested US$100 million to further enhance its business continuity and recovery facilities. We have the ability to look after multi-vendor environments, which is critically important in a provider, because customers have different sets of technology within their environment. Look for a partner with demonstrable long term experience.

Secondly, customers want to know that their provider has the skills to deliver engagements using standards and processes with rigour. HP delivers projects and solutions using standards such as ITSM and ITIL – these are major standards for service delivery and support in the IT industry. Beyond that, we bring to the table the experience and methodologies to ensure we implement best practices. Best practice is now recognised as a way companies can drive down the cost of ownership and implementation by about 20 percent, so it’s vital to find a provider with the right skills in this area.

FST. What are the main business continuity issues facing customers in the financial services market and how have these changed in recent years?
BO. The risks are fairly well understood in the finance world. The first concerns revenue – clearly the impact of business continuity on current or future orders is something quite tangible for organisations to assess. The growing focus on enterprise and particularly operational risk management focuses both on business and IT to find a collaborative solution. HP’s approach is the integration of IT availability, security and business continuity services and technologies to make the strongest impact on operational risk reduction. What we are seeing today is that companies are no longer willing to accept that ‘as is’ is good enough.

At HP, we recently conducted research that found one of the key drivers for implementation of BC&A is compliance and regulation. The key is to understand what your business needs to be compliant with. HP has strong experience of supporting financial companies in their assessment and deployment of compliance-based solution.

We also see contractual necessity becoming a key differentiator – where individuals and businesses want to know that their business partners are actually strong enough and resilient enough to be part of their supply chain. It is all about securing the delivery of services to customers.

Another key issue facing our customers is the increase in legal exposure today. There have been some high profile litigations recently where companies had to provide information, either to clear themselves or prove their case in court. This is a trend that’s likely to increase so it’s important to have the controls in place to minimise the costs and time necessary to restore information, to support legal discovery without repudiation.

FST. Are there any other challenges that are likely to develop in the near- and long-term?
BO. One issue facing some companies in city centres is the perceived increase in risk associated with major incidents in their area. For those companies that are pan-regional they want to be able to control their business from each disparate location. This raises a number of IT issues that companies must take advice on in order to ensure they can deliver a rock solid solution.

A third point is the drive towards longer operating days. Anyone in finance recognises the need to reduce the IT back-up window – it might seem like a trivial point for the business, but it’s important if you are to retain your critical customer data. Getting it right is not a matter of chance, rather a choice of proven strategies. If not the impact on your operational window the next day could mean your customers are without access to critical services.

An underlying issue today is that business groups are not sufficiently involved in understanding how recovery and business continuity is going to affect them. They are not typically involved in helping to set recovery objectives and lack awareness of their own role in the event of a disruption or disaster to get services back up and running.

Oh, and look out for recommendations coming from organisations such as the FSA on the levels of performance and recovery times for business, following its recent benchmarking project.

FST. Seeing as many of the benefits of this come from pre-empting and preparing for eventualities, how can real ROI be quantified in order to gain management buy-in?
BO. By conducting a business impact analysis, we can, for example, discover not only the potential impact of losing a particular fee generating service. In addition, we can identify which parts of the business that support that revenue stream are most at risk. Identifying where the risks are and how strong the probability is that those services affecting the customer will be impacted. This quantification helps the management team to confirm that they are investing appropriately in order to protect the lion’s share of their revenue.

Another way to get buy-in is to get management involved in a ‘rehearsal’ or an ‘instant management exercise’, from which they will truly understand their part in being able to bring the business back onto its feet.

FST. How can an organisation adapt or develop its business continuity planning to changes over time in both their own business and the risks it might face?
BO. What’s important here is to ensure that you don’t view business continuity as a one-time effort. If you do, you’ll get a one-time result. Most companies accept that within a year there will probably be several new services or applications that need to be protected or existing ones that have grown in importance. It’s important therefore to conduct a formal health check or assessment of the environment to ensure business continuity plans are up to date and that if you do have a plan, that people know how it works and their own part in it. There’s an element of training involved, both at an IT and a business level, and the role of management shouldn’t be underestimated.

If we look at how solutions HP enable business, this can be broken down into three main areas. The first is in planning and governance, where we will help customers conduct one of a number of key assessments, a business impact analysis, risk assessment, business continuity plan, etc. HP can deploy one of a number of solutions that support and enforce, for example, regulation or policy driven actions.

Secondly, where companies are focused on meeting a SLA for a particular business unit or customer application, we help customers to design, build and run integrated solutions that have elements of proactive availability management, security and business continuity through a tier of technology or services options appropriate to the business risk and rewards.

The third point involves our ‘building blocks’, which are built on our core leading technologies or services. Our mission critical services help customers to proactively meet their availability of service to customer goals. Enabling customers to proactively manage and reduce the day-to-day operational risk associated with service delivery. HP provides recovery services for a number of companies in the financial services market, where companies have not only a back-up of key data, but the IT equipment to run on and the office environment to work from in the event of disruption or disaster.

For example, HP offer an array of server technologies that deliver the highest availability and performance for data replication across data centres, and storage technologies to ensure effective replication and protection of crucial customer information.

FST. What do you think will be next for this technology – is there anything in particular you are excited about?
BO. The necessity for businesses to prioritise security and business continuity has been rising on the agenda for some time, now there is a sea-change in companies acting on the priority. I would advise companies to stalk to HP and see how they can act decisively on the issues at hand, because tomorrow will present a whole new set of challenges.