Business Continuity in Action: A Progressive Approach
When treasury staff at a large U.S.-based company arrived at the office the morning of November 4, 2004, the assistant treasurer (AT) for cash and pension, greeted them with a sign, reading: “You cannot enter the building. What do you do? Where do you go?” This was a test; the latest in treasury’s ongoing business-continuity efforts by this company’s treasury group. It was the first time that the team did not receive notification of the test in advance. That day the staff succeeded in completing all mission-critical activities at treasury’s back-up site within normal business hours without any disruption to their customer or banking base-a key measure of success, according to the company’s AT.
The latest thinking on business continuity embraces the concept of resiliency. This concept reframes disaster preparedness from a purely reactive mode to one of adaptability-response readiness in the face of the unexpected. It means that while recovery may be in response to an extraordinary event, it should not be an extraordinary event itself. As companies heighten their focus on business continuity, this company’s treasury group serves as a case study in relentless focus on response readiness.
The company’s centralized treasury group, officially known as Treasury Solutions, views its current continuity plan as a work-in-progress over the nine years since it began formalizing continuity efforts in the mid 1990s. This outlook reflects treasury’s progressive approach to continuity planning and testing. The plan – which includes site and data redundancy as well as a communication tree-grew from whiteboard sessions in which treasury assessed “what if” scenarios. These scenarios progress from simple computer-software failure to increasingly complex scenarios involving multiple, simultaneous failures, including prohibited building access, followed by loss of mobile phone service, and, finally, the additional loss of electricity and landlines.
The resulting plan enables a high degree of adaptability based on the availability of these resources. For example, treasury maintains a primary computer in the corporate office; a second, stationary laptop at treasury’s offsite contingency facility; and a third one that the cash analyst carries home every night. This approach enables the cash analyst to function even if the secondary site is unavailable. The company’s AT describes the approach as a funnel: “As the team becomes more restricted due to limited mobility, they focus more narrowly on the most critical activities, like mission-critical payments.” So too are staff members identified as mission-critical, back up, and non-mission-critical. On November 4th, most of the treasury’s staff participated directly in the drill.
The treasury group’s testing process also reflects a progressive approach. Treasury at first planned and orchestrated all testing with all parties involved. But starting on November 4th, treasury added in the element of surprise, since treasury staff did not know about the test. During the next quarter the surprise element will advance another step-the back-up location, won’t be informed of the test either.
Redundancy is a crucial aspect of the contingency plan, both in terms of physical location and data. Treasury maintains a secondary site, which has a redundant power system, and should allow functionality, barring a regional catastrophic event, to prevent treasury from the ability to operate from that location. However, the third laptop-which accompanies the cash manager-assumes a scenario (e.g., weather-related) whereby staff is immobile, but phone and electricity are available. The treasury team also has plan designs for a third site, for higher-level disasters in which the current back-up facility is not available.
All three laptops have redundant information on a real-time basis. Additionally, treasury has a designated staff member, who is responsible for updating all mission-critical information, including a hot list of telephone numbers for treasury staff and bank contacts. The department’s contingency procedures are listed and readily accessible via computer and in hard copy. The group also maintains reference guides at its secondary location and with them to and from work with basic but vital practical details (e.g., where analog vs. digital lines are within the building). Critical functional information-phones numbers, special forms, etc.- is available online to the group. As back up in case of systems failure, team members also travel with a printed packet of all critical information to function in a mobile environment. On a daily basis treasury scans additional important functional information to distribute to the team as needed.
The treasury group places top priority on communication and coordination. “If communication isn’t possible,” says the company’s AT, “we can’t function as a treasury group.” The team has a calling tree that includes treasury team members, key internal customers, and external contacts. In keeping with its progressive approach, treasury is continually refining its plan. As a next step for communication, the group is investigating a capability for toll free on-demand conference call line, for scenarios where landlines are available (as a more effective communication tool for the team).
Further, treasury has designated “cash captains” within the company’s operating companies, who can coordinate communications related to cash mobilization. The cash captains serve as a focal point for communicating efficiently beyond treasury during a crisis, serving as a conduit for reaching treasury’s internal customers. In the case of a local disaster in which neither the primary nor secondary site is available and centralized treasury is without electricity and phone service, the cash captains become critical to the contingency process.
In the experience of this company’s treasury group, critical success factors to a viable continuity plan include senior management support, regular practice, and due diligence around dependencies external to treasury.
A main challenge for many treasury departments is mustering senior management commitment for treasury to focus on business continuity. The company’s management gave 100 per cent support, providing both the time and resources for treasury to develop its model. The assistant treasurer says the key was getting senior management to decide that treasury is mission-critical to the company. To achieve this, treasury emphasized the vital role that cash mobilization plays in the ability to keep operating. Talking management through the exercise of identifying those business activities that enable continued operation-including funding disbursements, collecting cash, and paying employees-reinforced the axiom that cash is king and secured management support.
While there is a tendency to push business continuity to the back of the work pile, this company’s AT asserts that to be successful it business continuity must stay at the forefront of treasury’s agenda. The key is to prepare staff to be ready to handle anything and to know how to react in order to carry on the mission.
Therefore staff training should focus on teaching staff members to respond without being told what to do. To achieve this, one must create disruptions in the normal work routine by adding surprise and complexity to the testing process. Regular practice through drills helps the team develop a mindset of adaptability and resiliency. The ability to know all of the granular details that the team would need in an emergency only becomes clear through testing. One example of this early testing was gaining access to the backup facility. He points out that the littlest of things jump out when you do the testing.
Since a continuity plan is only as strong as its weakest link, the company’s treasury group monitors the contingency capabilities of its key internal and external partners. Within the company, treasury looks at the ability of any departments supplying treasury with data to perform their functions. Likewise, the treasury group takes a serious look at the ability of its banking providers to operate in contingency mode as well as any other provider who handles treasury functions on its behalf. A key assessment factor is how quickly a partner can recover without data loss, the optimal being immediate recovery through hot sites.
Treasury pays on-site visits to its third party providers to get a physical flavor of the recovery process and to discuss the process with senior management. The focus on third parties has always been a part of treasury’s mandate, although recent events have heightened this further. In the new Sarbanes-Oxley environment the availability of an SAS 70 is becoming a must-have for all third-party providers.
Companies’ continuity plans will vary based on differences in their business models. Ironically, a treasury’s strengths can also be its weakness. For example, the company’s assistant treasurer points out that while treasury’s centralization strengthens the company’s controls, it also concentrates the treasury group, which-from a business-continuity perspective-is a disadvantage when compared to companies with regional treasury centers that enable natural hand-offs of mission-critical tasks. Treasury recognizes that it doesn’t don’t have all the answers to every scenario, and they it always have has to improve and test new contingencies as they come up. By continuing to dialog with other treasury professionals, the treasury group is able to custom-fit the right continuity plan for the treasury group to fulfill its obligation to their customer base.
But no matter a company’s treasury structure, the key is adaptability, readiness for any possible scenario. For this company’s treasury team, the focus on business continuity is itself a constant. The end result, according to the AT, is a plug-and-play model that enables the company’s centralized treasury group to replicate head office activities immediately.
Within the last six months the company has begun driving towards what the company calls a “total solution.” Each department has identified mission-critical activities and a game plan for business continuity. The company’s treasurer, has been tasked with the initiative. As the company addresses business continuity at an enterprise-wide level and moves towards a coordinated approach, treasury continues to show leadership, applying common sense, continued vigilance, and incremental improvement.
Note: this article contains suggestions only, and is not meant to substitute for your own internal procedures which are appropriate for your company. This information is not legal advice. You may wish to consult your own legal advisor to discuss your company’s legal needs.