Literature Review: Disaster Relief

LITERATURE REVIEW1

Running head: LITERATURE REVIEW

Literature Review: Disaster Relief

Student

Date

The research literature covers business continuity and disaster relief (BC/DR) themes in some depth. Although the projects detailed in these papers were not necessarily undertaken as action research studies, they provide a useful source of information about the BC/DR process. This information includes defining what disaster recovery and business continuity entail, and how to determine which functional areas are essential for successful recovery, especially in terms of information technology (IT) functions. These articles also cover how to plan and implement BC/DR strategies, the role of IT in these processes, and whether previous BC/DR strategies have proven useful for specific organizations. This literature review both justifies the need for successful BC/DR strategies and documents approaches that may be taken toward their utilization.

Swartz (2003) discusses BC/DR plans and which elements are needed for their success. These plans are defined as policies that “ensure a strong likelihood that [businesses] will survive a disaster without long-lasting adverse effects,” but Swartz (2003) notes that only around one-fifth of American businesses have developed them. Many organizations prioritize business continuity methods that take IT into account, but there are other elements that are important. Plans should be made using input from, and considering the needs of, facilities management, human resources, and executive staff (Swartz, 2003). According to Swartz (2003), overall BC plans should include DR as a subcategory, alongside other types of disruption that may cause varying amounts of damage. They must also determine backups and alternatives for processes, especially IT functions, along with which functions cannot be interrupted for the business to remain viable. Although Swartz (2003) often gives broad recommendations, they could prove useful for establishing general BC/DR policies.

Business continuity management, and its goals, are further discussed in Jones (2011). According to Jones (2011), BC management is a comprehensive process, which determines likely risks and their potential impacts, and plans for both risk mitigation and DR strategies. This process must consider not only an organization's stakeholders, from customers to employees, but also its brand and value-generating functions (Jones, 2011). Furthermore, it must be “fully integrated across the entire organization” to be effective (Jones, 2011). Along with incident response, information security and records management should also be considered. This includes documenting records and information systems to be protected and recovered, and codifying policies for doing so; however, Tijan et al. (2009) discuss these processes in more detail. An organization must consider its goals for BC/DR plans. The Federal Emergency Management Agency (FEMA) states that the main BC/DR goal is “to reduce the consequence of any disruptive event to a manageable level” (Jones, 2011). This may include several different objectives that can vary based on organizational function. However, at the very least, they should minimize damage to life and property, prevent or mitigate disruptions, and protect essential assets, records, and equipment (Jones, 2011). Overall, plans must provide for resuming critical functions as quickly as possible, which can then transition to a shift back to normal operations (Jones, 2011). Access to records and information systems can be essential for meeting these objectives, which is why organizations must keep regular inventories of their records, and have a means of protecting and retrieving records and IT systems in a prioritized manner (Jones, 2011). The information provided in Jones (2011) is based on IT industry best practices, but could be useful for health care organizations which have a large volume of records. Its discussion of BC/DR goals and objectives is also more comprehensive than many of the other articles considered in this literature review.

Lanter (2011) also considers the role of managing records and information systems in BC/DR planning. This article is written from an IT industry-specific viewpoint, but could have useful information and practices for other types of organizations as well. Disruptions to IT networks are fairly common and can be extremely costly, even outside of a disaster setting (Lanter, 2011). However,82 percent of significant disruptions could be prevented or reduced by a BC/DR plan (Lanter, 2011). Additionally, having these plans in place, along with the ability to implement them when needed, can help prevent potential litigation which can sometimes occur following a harmful incident (Lanter, 2011). Therefore, BC/DR policies should include provisions for managing records and information systems that can be applied in DR and non-DR situations. In order to apply these policies, staff must be trained to be able to manage records, systems, and documents during incident responses (Lanter, 2011). Lanter (2011) suggests using information governance strategies, along with standardized measurement systems for evaluating their efficacy in an organization, that are created by IT and records industry professionals. Although organizations must purchase these materials, they do provide a means of ensuring that industry best practices are followed when planning how records and information systems will be managed, maintained, and recovered during a BC incident. They can also prove useful for training employees in these procedures, and creating a team of individuals that will be able to look after these systems in an emergency (Lanter, 2011). Although Jones (2011) and Tijan et al. (2009) provide greater detail on the subjects of records and information management, Lanter (2011) does contain useful references and justifications for implementing formal policies to accomplish these tasks.

Planning BC/DR strategies as quickly as possible, and ensuring that staff are familiar with them, can help to promote success in the event of a disaster. Seyedin, Ryan, and Keshtgar (2011) discuss a case study for BC/DR planning in a health care organization. Unfortunately, many health care staff, particularly trainees, are unfamiliar with their organization's BC/DR response plans, which jeopardize their successful implementation (Seyedin et al., 2011). Seyedin et al. (2011) identify several specific elements and practices that are conducive to success with BC/DR planning. These include identifying and acquiring resources that can serve as backup materials in an emergency, such as stockpiles of medical supplies and equipment, and finances that are reserved for a DR event (Seyedin et al., 2011). The BC elements of the plan should include delegation processes, locations for performing work, and necessary practices and technologies that are needed to resume normal functioning. They should allow the organization to serve a public that may also be affected by a disaster (Seyedin et al., 2011). Staff members should be consulted when planning and reviewing BC/DR strategies, and these reviews should occur at least annually to make sure that all staff are familiar with them. The review period should also include rehearsals of BC/DR activities, so as to reinforce familiarity. A combination of training and using action cards, which define critical processes and how they should be accomplished, has been shown to improve familiarity and execution of BC/DR plans (Seyedin et al., 2011). This case study could have applicability for other organizations, including those that specialize in animal health care.

Krock (2004) considers how quality control may be maintained in an organization during a DR process. This may be accomplished by having a small team of trained individuals who can evaluate business recovery process quality rapidly during this time. Quality control may be needed because time pressures, limited space, non-standard procedures, and other factors can impact this quality (Krock, 2004). Krock (2004) notes that IT systems are some of the most vital for BC/DR functions, and should be considered to be critical in any relief plan. During IT restoration, which should be a top priority, staff may believe they are maintaining usual quality standards, whereas the numerous external influences discussed above may prevent low-quality IT function from being recognized (Krock, 2004). Having quality control staff can ensure that the correct IT contractors and suppliers are contacted, that all necessary IT equipment is accounted for, and that servers and devices are being properly installed and tested. This staff should have enough knowledge to replace or repair damaged IT systems, perform rewiring, and install software for critical systems (Krock, 2004). However, if training limitations, the lack of a dedicated IT staff, or other factors prevent quality control staff from learning all of these skills, they should at least be able to determine situations where these processes are needed, and to be able to contact professionals that can perform them. This team should be selected and have responsibilities and resources defined during the planning process, and they should ideally have broad IT knowledge (Krock, 2004). Although Krock's (2004) case study specifically discusses an telecommunications business, these concepts could be applied to organizations in other industries, too.

Another case study regarding BC/DR implementation can be found in Tijan, Kos, & Ogrizovic (2009). This paper discusses the arrangement of hardware and software IT systems, and notes that, while mission-critical equipment and applications are usually defined in BC/DR plans, they may overlook certain crucial elements. Thee elements include user services, change management, and information security concerns (Tijan et al., 2009). User services may be particularly important during DR implementation, because it can allow staff unfamiliar with IT systems to assist in the setup and use of these components (Tijan et al., 2009). Consistency with Service Level Agreements should also be included as a medium-to-high priority in BC/DR IT planning, to ensure functionality and IT security. Critical software from general, database, and business application software should also be identified during planning, and include security elements such as antivirus software, Internet portal management software, and virtualization software that can help prevent against internal and external threats (Tijan et al., 2009). An information security management system created during BC planning can help to provide risk analysis, as well as testing controls for IT security (Tijan et al., 2009). These controls may include preventative, detective, and corrective measures that can be implemented as needed. For example, during a DR scenario that requires recovery of IT function, pre-planned measures for retrieving backups of hard disks, tape drives, or other data copying systems should be implemented (Tijan et al., 2009). This model is supported by a case study provided in Tijan et al. (2009), and could be useful for any organization.

Organizations must also be able to assess preparedness risks in their BC/DR programs. Jrad, Morawski, and Spergel (2004) discuss a model for accomplishing this task. Like Krock (2004), Jrad et al. (2004) write from an IT organization perspective, but their model could be applicable for organizations in other industries as well. Identifying risks can help to proactively limit the adverse impacts of a disaster, rather than simply reacting to one after it occurs (Jrad et al., 2004). Planning for BC should include six steps, according to Jrad et al. (2004): validating plans, assessing risk, analyzing business impact, developing plans, testing plans, and maintaining plans. Risk identification should focus on determining the amount of data from IT systems, if any, is lost, and how much downtime a business can handle (Jrad et al., 2004). In order to identify risks, a network of functions and systems in the organization must be created. This allows for the risk to these components, and a total “aggregate risk” to be calculated, along with the likelihood of these events (Jrad et al., 2004). Expected downtimes can be calculated as well, and their effects compared to the capabilities of the organization under normal working environments (Jrad et al., 2004). The cost of these disasters can then be calculated. These costs should be compared to potential mitigation alternatives that would include both benefits and costs to the organizational network (Jrad et al., 2004). Jrad et al. (2004) suggest plotting networks out to determine which components are needed for basic functions, which directly impact customers, and which stakeholders are involved with each component. Businesses may also use disaster models, based on Poisson distributions to determine the likelihood of certain events and their effects, such as natural disasters or technical failures (Jrad et al., 2004). The model discussed here could provide a useful means of evaluating risk mitigation strategies, and could form a best practices approach to risk identification, but it does have the disadvantage of having not been empirically tested for efficacy.

This literature shows that BC/DR planning is a necessary function for any organization, and requires several key elements. Staff should be actively involved in every stage of the planning and implementation process for BC/DR programs, and organizations should be responsible for training and rehearsing for these incidents. Preparations should provide for stockpiling necessary resources, backing up needed IT systems, and having earmarked finances for BC/DR activities. Organizations should also include records and information management as critical components in any plan, and have employees that are trained to accomplish specific prevention, maintenance, and recovery duties. This type of preparation can ensure that an organization can successfully reduce its risks and manage stakeholder-specific functionality during any adverse event.

Proposal

Best Friends Animal Hospital is an organization that does not have a formal business continuity and disaster relief (BC/DR) policy. This action research project will involve working with multiple stakeholders to formulate and implement a BC/DR plan. Therefore, it must determine which needs and risks should be considered in this plan, consider the goals for, and the benefits of, an effective plan, and utilize the necessary resources and stakeholders to implement and realize the plan. This will help to ensure that Best Friends Animal Hospital can successfully navigate any risk or disaster it may encounter while meeting its key stakeholders' needs. This project will use five iterations to formulate a BC/DR plan for Best Friends Animal Hospital.

Iteration 1 will involve a brainstorming session with the researcher and executive staff of the animal hospital. This session will be used to introduce all parties to the BC/DR concept, and will identify the requirements that the animal hospital would have for a BC/DR plan. It will determine the communication flow that will be involved in organizing the plan and assessing its specifics. It will also consider the key stakeholders that must be considered in any BC/DR plan and which needs they might have. The researcher will request that these participants discuss requirements with their subordinates as well for the next meeting. These processes will be necessary for defining BC/DR requirements at a later point.

Iteration 2 will involve a series of one on one meetings with the executive hospital staff to discuss their perceptions and feelings on the brainstorming session. Each executive will be asked to offer their input on critical systems and functions that their department performs. These meetings will also allow each participant to discuss their departmental needs after consulting with their staff. The researcher will use these responses to create an overall list of needs for a BC/DR plan, along with which critical systems and functions will be necessary to include in the plan.

Iteration 3 will involve a follow up meeting between the researcher and all executive staff from the animal hospital. This meeting will discuss organizational and stakeholder needs. In doing so, it will identify common needs for different departments, and determine which systems and functions are needed for both individual departments and the animal hospital as a whole. Methods to integrate systems and needs will also be discussed, and the participants will determine whether individual departmental requirements are centrally critical for meeting stakeholder needs. The researcher will actively involve these participants in the planning process by dividing duties, where the researcher will manage planning for overall and integrated system requirements, and assigning the individual requirements to the appropriate department. The participants will be responsible for creating BC/DR plans for their department-unique requirements by the next meeting.

Iteration 4 will involve one on one meetings with the executives to collect plans for department-unique requirements. It will also allow the executives to supply the researcher with departmental feedback on needs and systems plans on an individualized basis. The executives will be requested to formalize their needs and systems plans for a final presentation, which the researcher will compile into a policy document.

Iteration 5 will allow the researcher to present the BC/DR policy to the executives and staff in a final organization-wide meeting. Copies of the process will be provided to all executives and staff, and both executives and the researcher will be available to field questions on the policy from staff.

References

Jones, V. A. (2011). How to Avoid Disaster: RIM's Crucial Role in Business Continuity Planning. Information Management Journal, 45(6), 36-40.

Jrad, A., Morawski, T., & Spergel, L. (2004). A model for quantifying business continuity preparedness risks for telecommunications networks. Bell Labs Technical Journal, 9(2), 107-123. doi:10.1002/bltj.20029