Indian businesses not ready for an unexpected disaster

NEW DELHI: Despite recent learning from September 11 attack and the ominous threat of Indo-Pak war always looming large, Indian businesses are not prepared to take on the challenges of unexpected disastrous circumstances. Amongst the respondents surveyed by KPMG India, 79 percent said that they did not have a documented and tested Business Continuity Management (BCM) plan in place.

Even though an overwhelming number of respondents recognized the need for BCM (96 percent) only 21 percent had a formal, corporate wide documented and tested BCM plan in place. A significantly higher 24 percent of the organizations did not have any BCM in place. The statistics reveal a significant gap between an organization recognizing the need and the actual implementation of business continuity measures in various organizations across the country.

This is even more serious in view of the fact that 78 percent of the respondents have said that they have a heavy dependence on IT with 39 percent investing more than 5 percent of their budget on IT. Dependence on IT was maximum in the ICE sector (92 percent) followed by the Banking and Financial sector (78 percent).

Of the organisations surveyed, 71 percent were found to be operating in a 24x7 business environment. Running a 24x7 operation entails high uptime commitment that can only be addressed through comprehensive BCM initiatives, the report said. Interestingly around 44 percent of the respondents experienced some kind of business disruptions in the last two years.

Analysis reveals that all respondents who experienced business disruptions due to failure of back-ups faced an outage of over 24 hours with 67 percent listing natural disaster as another major case for disruption of over 24 hours.






Another interesting finding of the survey was the limited appreciation of the scope and extent of BCM in the corporate world. As much as 94 percent of the respondents associated BCM with risks centered mostly on IT hardware and software.





However the definition of BCM is more holistic and does not limit itself just to risks associated with the unavailability of IT hardware and software. Business risks addressed through BCM are, customer-end risks, supplier end risks, IT hardware and software risks, business core process risk and business partner risk.

The report advises that the BCM plan must clearly state the steps to be followed for escalating unresolved plans to disaster status. The purpose of problem escalation procedures is to define the steps and time intervals leading to the declaration of a disaster. The survey reveals that only 40 percent of the respondents have a formal mechanism to declare a disaster. In the absence of a formal mechanism for declaring a disaster, the BCM plan may not be activated in time, deteriorating the effectiveness of the recovery plan.

Availability of business systems is increasingly becoming a function of technology with system and data back-ups and RAID implementation as the most commonly used technologies. But despite offsite date storage being critical, 78 percent of the respondents either did not have an offsite or maintained one within close proximity of the primary site. In order to avoid destruction of the offsite backup it should be located at least 40 km away from the primary site and ensure that it does not fall in the seismic zone. All respondents belonging to the B&F sector had an offsite storage facility.

40 percent of the respondents listed corporate or regulatory compliance issues as the prime drivers for their business continuity initiatives and 39 percent stated BCM as a critical business need, essential for their survival.

The success of any BCM is dependent to a large extent upon the support extended by top management. In most organizations the primary owner of the BCM initiative was found to be the CIO.

Business Impact Analysis (BIA) is a significant component of the BCM initiative with a positive co-relation between conducting BIA and meeting business uptime requirements. There should be alternate processing facilities to ensure smooth recoverability of critical business functions with some possible alternative being a hot site, cold site, and co-location, etc. A disaster-recovery team with well-defined roles and responsibilities is vital, as is the need to test the BCM plan on a regular basis for effective implementation.



(CNS)