Getting firms ready for when things go very wrong

 

Sam Mulholland has doom on the mind.

His business, Standby Consultancy Limited, focuses on business continuity management, helping companies plan for the worst and executing those actions when a disaster occurs.

He is now focusing his efforts on businesses in the South after extended stays overseas.

"Everyone thinks of the high-profile ones like earthquakes and bombs and things like that.

"But most of your disasters are isolated and quite small ... electrical fires, some guy digging up the cabling in the road with a digger and cuts you off, an employee that ... does something stupid either maliciously or accidentally."

Information technology (IT) is one of the biggest issues Mr Mulholland’s consultancy deals with.

Cyber attacks are a major threat to almost all businesses and can quickly put a company out of operation for days or even weeks.

"With a cyber attack, call centres are suddenly saying ‘something’s just not right, it’s not working’. Then someone else turns around and says ‘hey we’ve lost our email’. Suddenly the IT guys are saying ‘what the hell’s going on here?’."

Cyber problems are not an IT department-only issue, they are a management problem.

Managers have to have a plan that is put in place when a cyber attack happens. That can include having backup data centres, or if worse comes to worst, tearing down your IT system and building it again.

Planning for the unexpected

"If you knew what the disaster was going to be, you would have mitigated and planned for it, but you don’t.

"If I’d stood around two years ago and said ‘what would happen if a gunman walked into a mosque in New Zealand and shot 52 people,’ I’d have been laughed out of the room."

The important thing for businesses is to have a plan in place that you can modify to suit, whatever the scenario.

There are few businesses that have not been impacted by the Covid-19 pandemic, and it is something his organisation has experience planning for. They did not, however, expect a pandemic as worldwide as Covid-19 has been.

And yet, he has clients that are using their existing plans to cope.

"Most of that involves putting people to work from home and things like that."

He said the key was for businesses to get operational as soon as possible and that is what the plan lets them do.

Recently one of Mr Mulholland’s clients’ office was destroyed because it was about 5km from the Beirut explosion.

"They were up and running within four days," Mr Mulholland said.

"They have the infrastructure in place, they’ve thought their way through it and away they go."

The benefit of having the plan is you know the route you are going to follow.

"When a disaster is happening you are burning, you are really burning your cash because you’re getting no cashflow, and that’s what kills most companies."

The method against the madness

"There’s a whole process you go through," Mr Mulholland said.

Usually he and his consultants start by getting an agreement with the chief executive to put the plan in place. Then they work, normally with a C-level manager, to carry out a risk assessment.

"Hey, you’re living in Queenstown. That’s a major earthquake risk because of the southern fault-line. It’s fairly isolated. It’s only probably got two comms links into the city. Isolate all of those risks."

Then he looks at impact; what is the impact if you cannot do your business?

"There are critical areas. If you’re running a call centre you still need to be able to answer your clients. If you’re a manufacturer you need to be able to be pushing your goods out your door."

After the impacts are known, they work out a strategy.

It is common to have two data centres or moving data into the cloud.

Another option is to have another operation in another city.

"If we’re talking call centres what you often see is people, if the call centre fails, they can just go to another location and sign in and start working."

Businesses also must know how their customers will be impacted by any changes.

"Eighty percent of your income normally comes from 20% of your clients, so of course you focus on them."

A budget needs to be applied to the plans. There are cheaper strategies and there are "Rolls Royce" plans.

"If you go for the Rolls Royce it’s going to cost you a lot of money.

"Only airlines, banks, hospitals are getting into that game now, [and] need the Rolls Royce solutions.

"Other companies can live without their systems for 24 hours, 48 hours or some up to a week."

Mr Mulholland said many businesses take several years to put in place because of the budgeting and training required.

Then tests of the plan need to be carried out with a crisis management team that dictates how the plan is carried out.

"And then once it’s in place you just keep it up to date."

Once things are happening, the blood is pumping

When an event is occurring is often the moment clients call Mr Mulholland in.

"I was in the Middle East when the Arab Spring happened.

"I get this phone call: ‘Sam, are you in the Middle East? Get into our office’. To see APCs [armoured personnel carrier] and tanks going past and things like that was quite interesting. That was in Bahrain."

Rehearsing the business continuity plan is crucial because in the moment staff have to be able to execute the plan and know what to do.

"I’ve seen it happen where people who are perfectly good managers just fall to pieces.

"That’s not a criticism, because they’re having to deal with something that is totally different. There may be dead bodies in the passageway, there may be someone outside with a gun ... buildings collapsing, or they’ve got problems at home."

He said some people will rise to the occasion, but they have to be controlled as well.

"Look you’ve got to go home, you’ve been here for 12 hours, you need a rest [and] we’ll see you at eight o’clock tomorrow morning.

"It’s really adrenaline pumping as well."

From data centres in Invercargill to IBM

Mr Mulholland’s previous job involved managing data centres doing banking processing in Dunedin and Invercargill.

It was in that job that he learned about planning for disruption.

"You had hardware failures, all those sort of things. Snowstorms ... we were servicing right up into Geraldine.

"Couriers couldn’t get through, we had software failures, you name it, we had it."

A paper he wrote in the late 70s about business continuity planning also brought him to the attention of many businesses, and one of those was IBM.

The global IT company got Mr Mulholland to set up offices in the South Island, which then led to him becoming their consultant here.

"I said ‘alright, I’ll have a go’. It hasn’t stopped since then."

After working as a consultant he got approached by a Bahrain business looking for a business continuity plan, and within 10 days Mr Mulholland was in the country.

Since that deal Mr Mulholland’s business has expanded to other countries such as Qatar, the United Arab Emirates and Saudi Arabia.

About five Standby consultants remain in the Middle East, continuing the business continuity planning.

jacob.mcsweeny@odt.co.nz