As power costs soar and the demand for power in data centres grows saving energy is always going to be high on the to do list for man­agers, users and owners. Gartner have release an in depth report showing how to save up to 1 million kilo­watt hours per year.

The main areas for best prac­tice improve­ments are;

Plug holes in the raised floor: Most raised-floor envir­on­ments exhibit cable holes, conduit holes and other breaches that allow cold air to escape and mix with hot air. This single low-tech ret­ro­fit can save as much as 10 percent of the energy used for data centre cooling.

Install blank­ing panels: Any unused pos­i­tion in a rack needs to be covered with a blank­ing panel to manage airflow in a rack by pre­vent­ing the hot air leaving one piece of equip­ment from enter­ing the cold-air intake of other equip­ment in the same rack. When the panels are used effect­ively, supply air tem­per­at­ures are lowered by as much as 22 degrees Fahren­heit, greatly redu­cing the elec­tri­city con­sumed by fans in the IT equip­ment and poten­tially alle­vi­at­ing hot spots in the data centre.

Coordin­ate CRAC units: Older CRAC (com­puter room air-conditioning) units operate inde­pend­ently with respect to cooling and dehu­mid­i­fy­ing the air. These units should be tied together with newer tech­no­lo­gies so that their efforts are coordin­ated, or man­agers should remove humid­i­fic­a­tion respons­ib­il­it­ies from them alto­gether and place those respons­ib­il­it­ies on a newer piece of technology.

Improve under floor airflow: Older data centres typ­ic­ally have con­strained space under­neath the raised floor that is not only used for the dis­tri­bu­tion of cold air, but also has served as a place for data cables and power cables. Many old data centres have accu­mu­lated such a tangle of these cables that airflow is restric­ted, so the under floor should be cleaned out to improve airflow.

Imple­ment hot aisles and cold aisles: In tra­di­tional data centres, racks were set up in what is some­times referred to as “classroom style,” where all the intakes face in a single dir­ec­tion. This arrange­ment causes the hot air exhausted from one row to mix with the cold air being drawn into the adja­cent row, thereby increas­ing the cold-air-supply tem­per­at­ure in uneven and some­times unpre­dict­able ways. Newer rack layout prac­tices insti­tuted in the past 10 years demon­strate that organ­iz­ing rows into hot aisles and cold aisles is better for con­trolling the flow of air in the data centre.

Install sensors: A small number of indi­vidual sensors can be placed in areas where tem­per­at­ure prob­lems are sus­pec­ted. Simple sensors store tem­per­at­ure data that can be manu­ally col­lec­ted and trans­ferred into a spread­sheet, where it can be further ana­lyzed. Even this minimal invest­ment in instru­ment­a­tion can provide great insight into the dynam­ics of pos­sible data centres tem­per­at­ure prob­lems and can provide a method for ana­lyz­ing the results of improve­ments made to data centre cooling.

Imple­ment cold-aisle or hot-aisle con­tain­ment: Once a data centre has been organ­ized around hot aisles and cold aisles, dra­mat­ic­ally improved sep­ar­a­tion of cold supply air and hot exhaust air through con­tain­ment becomes an option. For most users, hot-aisle con­tain­ment or cold-aisle con­tain­ment will have the single largest payback of any of these energy effi­ciency best practices.

Raise the tem­per­at­ure in the data centres: Many data centres are run colder than an effi­cient stand­ard. ASHRAE (the Amer­ican Society of Heating, Refri­ger­at­ing, and Air-Conditioning Engin­eers) has increased the top end of allow­able supply-side air tem­per­at­ures from 77 to 80 degrees Fahren­heit. Not all data centres should be run at the top end of this tem­per­at­ure range, but a step-by-step increase, even to the 75 to 76 F range, would have a bene­fi­cial effect on data centre elec­trical use.

Install variable-speed fans and pumps: Tra­di­tional CRAC and CRAH (com­puter room air handler) units contain fans that run at a single speed. Emer­ging best prac­tices suggest that variable-speed fans be used whenever pos­sible. A reduc­tion of 10 percent in fan speed yields an approx­im­ately 27 percent reduc­tion in the fan’s elec­trical use, and a 20 percent reduc­tion in speed yields elec­trical savings of approx­im­ately 49 percent.

Exploit “free cooling”: Free cooling is the general term for any tech­nique that cools air without the use of chillers or refri­ger­a­tion units. The two most common forms of free cooling are air-side eco­nom­iz­a­tion and water-side eco­nom­iz­a­tion. The amount of free cooling avail­able depends on the local climate, and ranges from approx­im­ately 100 hours per year to more than 8,000 hours per year.

Design new data centres using modular cooling: Tra­di­tional raised-floor-perimeter air dis­tri­bu­tion systems have long been the method used to cool data centres. However, mount­ing evid­ence strongly points to the use of modular cooling (in-row or in-rack) as a more energy-efficient data centre cooling strategy

The entire report ($195) can be found on the Gartner Web site: “How to Save a Million Kilo­watt Hours in Your Data Center.”

Usually seen when sizing unin­ter­rupt­able power sup­plies the Volt-Amp is often con­fused with Watts, they are not the same. The power require­ment of a piece of equip­ment is expressed in Watts of Volt Amps (VA), the most common example being of course the 100W light bulb.

A Watt is the actual or true power used or dis­sip­ated by the device

A Volt Amp is called the appar­ent power and is obtained by mul­tiply­ing the voltage by the current drawn by an altern­at­ing current device.

This is a small but sig­ni­fic­ant dif­fer­ence. The Watt rating is used for meas­ur­ing the power used and res­ult­ant heat. The VA is used for sizing calculations.

There are two types of load, res­ist­ive and reactive.

A light bulb is res­ist­ive but a com­puter or other elec­tronic device is reactive.

If we cal­cu­lated a the power used for a res­ist­ive light bulb oper­at­ing at 240volts and drawing 0.25ampere it is a matter of apply­ing a simple formula;

Power = Voltage x Current or 240 x 0.25

60 watts, the VA rating would be exactly the same.

Where the load is react­ive a power factor must be used. With react­ive loads a certain amount of power is absorbed by and sub­sequently released by the device. This power amount is called the react­ive power or the dif­fer­ence between appar­ent and true power.

In an example where a com­put­ing device has an imped­ance of 120 Ohms using Ohms law (current = voltage/resistance) 240/120 will produce a current figure of 2 amps.

Using the same formula as above to get power

Power = Voltage x Current or 240 x 2

The appar­ent power would then be 480VA

Since the load is elec­tronic, a power factor must be applied. Dif­fer­ent devices will have dif­fer­ent power factors; in this case the com­puter has a power factor of 0.9

Apply­ing the power factor to the appar­ent power results in a watt figure of 480 x 0.9 = 432 watts

This dif­fer­ence between the appar­ent power and true power is react­ive power, in this example 48 Volt Amps.

The vast major­ity of modern large com­puter devices now have very high power factors, usually close to 1 but smaller devices such as PC’s may be as low as 0.65

However, UPS devices do not have this high power factor. UPS devices are rated in VA with a stated power factor. The power factor is gen­er­ally accep­ted to be 0.6 for UPS devices designed to power PC’s and other small devices.

A typical 500VA UPS would deliver 300 Watts. To com­plic­ate things even further large UPS’s now have very high power factors, approach­ing 1

The UPS will have both maximum VA and Watt ratings that cannot be exceeded.

Careful thought needs to be applied to the correct sizing of UPS’s taking into account the nature of the load and design spe­cific­a­tions of the UPS itself in order to avoid errors. The safest approach is to keep the load at less than 60% of the VA rating of the UPS or seek expert advice

BS 31100 is a highly topical and import­ant stand­ard designed to help private and public sector organ­isa­tions under­stand, develop, imple­ment, and main­tain appro­pri­ate and effect­ive risk man­age­ment prin­ciples and prac­tice. It provides recom­mend­a­tions for a frame­work, related pro­cesses, and imple­ment­a­tion of risk man­age­ment. Using the stand­ard will increase the poten­tial to achieve the suc­cess­ful achieve­ment of risk man­age­ment object­ives and improve busi­ness performance.

BS 31100 is a key stand­ard for risk man­age­ment. It gives you an under­stand­ing on how to develop, imple­ment and main­tain effect­ive risk man­age­ment within your busi­ness. Using BS 31100 effect­ively can help you increase your company’s effectiveness.

Organ­iz­a­tions of all types and sizes face a range of risks affect­ing the achieve­ment of their object­ives. While “risk” is nor­mally regarded as neg­at­ive, risk man­age­ment is as much about exploit­ing poten­tial oppor­tun­it­ies as pre­vent­ing poten­tial prob­lems. It is import­ant to bear this in mind whenever man­aging risk, and in reading this stand­ard. Risk man­age­ment is an essen­tial part of good management.

Effect­ive risk man­age­ment help you achieve your object­ives by:

* Redu­cing the like­li­hood of events that would have a neg­at­ive impact on your busi­ness
* Increas­ing the like­li­hood of events that would have a pos­it­ive impact on your busi­ness
* Identi­fy­ing oppor­tun­it­ies where taking risks might benefit your busi­ness
* Improv­ing account­ab­il­ity, decision making, trans­par­ency and vis­ib­il­ity
* Identi­fy­ing, under­stand­ing and man­aging mul­tiple and cross-organization risks
* Execut­ing change more effect­ively and effi­ciently and improv­ing project man­age­ment
* Provid­ing better under­stand­ing of of gov­ernance, legal and reg­u­lat­ory require­ments
* Pro­tect­ing your revenue and enhan­cing value for money
* Pro­tect­ing your repu­ta­tion and stake­holder con­fid­ence
* Pro­act­ively man­aging your organization’s oper­a­tions
* Con­trolling expendit­ure and deliv­er­ing a cost-optimal control envir­on­ment
* Retain­ing and devel­op­ing cus­tom­ers by being more flex­ible and respons­ive to their needs.

The bene­fits of good risk man­age­ment (and the con­sequences of poor risk man­age­ment) will be felt by you, your staff, share­hold­ers, cus­tom­ers and other stakeholders.

BS 31100 provides recom­mend­a­tions for the frame­work, process and imple­ment­a­tion of risk man­age­ment and should be used for:

* Ensur­ing that your busi­ness achieves its object­ives
* Ensur­ing risks are pro­act­ively managed in spe­cific areas or activ­it­ies
* Over­see­ing risk man­age­ment in your company
* Provid­ing assur­ance on your risk man­age­ment strategy
* Report­ing to stakeholders

BS 31100 estab­lishes the prin­ciples and ter­min­o­logy for risk man­age­ment. It also gives recom­mend­a­tions for the model, frame­work, process and imple­ment­a­tion of risk man­age­ment gained from exper­i­ence and good practice.

This key stand­ard for risk man­age­ment is useful to CEOs, CFOs, CROs, CIOs, COOs and CTOs; chair­men and company sec­ret­ar­ies; man­aging, IT and finance dir­ect­ors; risk, insur­ance, claims and busi­ness con­tinu­ity man­agers; inform­a­tion secur­ity spe­cial­ists; under­writers; Health and Safety officers; and heads of legal affairs.

Con­tents:

Fore­word
Intro­duc­tion
Scope
Risk man­age­ment prin­ciples
Risk man­age­ment frame­work
Risk man­age­ment process
Devel­op­ing risk man­age­ment activities

Annexes
Annex A (inform­at­ive) risk cat­egor­ies
Annex B (inform­at­ive) risk man­age­ment tools
Annex C (inform­at­ive) Effects of con­trols
Annex D (inform­at­ive) risk matur­ity models
Annex E (norm­at­ive) incor­por­at­ing poten­tially pos­it­ive con­sequences of risk
Glossary

Related Links

INform / Issue 19 / BS 31100 ezine

Friendly: soft Dis­cus­sion and meeting on the first British…IHS Engineering

Insur­ance Net­work­ing News — New York,NY,USA

New risk man­age­ment stand­ard published

What is BS31100?

A survey has revealed than many com­pan­ies do not act­iviely manage and monitor their Chinese sup­pli­ers. In light of recent coun­ter­feit and safety con­cerns the survey high­lights an urgent need for review.

Many com­pan­ies do not act­ively manage and monitor their Chinese sup­pli­ers and most lack the ability to fully trace faulty impor­ted goods or replace their sup­pli­ers in a crisis, accord­ing to a recent survey.

The Quality Exec­ut­ive Board (QEB) announced the results of a survey, Sup­plier Quality Man­age­ment Prac­tices for China, which high­lights best prac­tices and major risks for com­pan­ies sourcing from China.

The Board’s ana­lysis reveals that there is still no sub­sti­tute for having a good team on the ground: Com­pan­ies who are most con­fid­ent about their Chinese sup­pli­ers rig­or­ously screen and qualify those sup­pli­ers. In-person plant visits are uni­ver­sally popular and viewed as highly effect­ive. While all respond­ents agree that the most effect­ive way to monitor sup­pli­ers on a con­tinu­ous basis is to have company staff placed at the Chinese sup­plier, only 17% of com­pan­ies employ this method.

Other key find­ings include:

Nearly 20% report that the cost of sourcing from China can at times exceed the savings: One-fifth of com­pan­ies report the total costs of man­aging and ensur­ing sup­plier quality in China fre­quently or occa­sion­ally exceed the labor cost savings.

Only about a quarter of com­pan­ies have con­tin­gency plans to replace their Chinese sup­pli­ers: Com­pan­ies voiced sig­ni­fic­ant con­cerns with Chinese sup­pli­ers, includ­ing poor product quality, loss of data privacy, intel­lec­tual prop­erty viol­a­tions, and repu­ta­tion risks such envir­on­mental pol­lu­tion, product safety issues and human rights viol­a­tions. Yet most had no con­tin­gency plans in place to replace their Chinese sup­pli­ers or could only replace some of their Chinese sup­pli­ers in the event of a crisis.

Com­pan­ies have great dif­fi­culty main­tain­ing trace­ab­il­ity of goods sourced from China: Only a quarter of respond­ents report cer­ti­fied full trace­ab­il­ity down all tiers of their supply chain.

CEB Program Dir­ector Peet van Biljon says, “The research sug­gests that no company can be com­pla­cent about the products and mater­i­als they source from China; we are just begin­ning to under­stand the full mag­nitude of the Chinese sourcing problem.”

The increas­ing incid­ence of power cuts across UK and Europe has alerted com­pan­ies depend­ent on crit­ical power to the neces­sity for their oper­a­tions to be pro­tec­ted by standby equip­ment, such as Gen­er­at­ors and Unin­ter­rupt­ible Power Sup­plies (UPS).

What is less well under­stood is the care required in spe­cify­ing the most suit­able back-up system, as an inap­pro­pri­ate choice will still leave a busi­ness vulnerable.

Design

Before a standby system is installed, a thor­ough ana­lysis should be made of the spe­cific applic­a­tion to ascer­tain the load, oper­at­ing envir­on­ment and the most appro­pri­ate design for provid­ing crit­ical power. This is seldom done well, if at all and con­sequently many standby systems installed are simply incap­able of ful­filling their emer­gency role. Always consult a sup­plier with in-house design ser­vices for a total power solution.

Install­a­tion

Sur­pris­ingly often in crit­ical applic­a­tions the quality of install­a­tion has not been given suf­fi­cient atten­tion — often as a direct result of a “lowest price tender” system. Where systems have been installed down to a price rather than up to a required quality, risks are ever-present.

Poor quality com­pon­ents, low quality work­man­ship, under sizing of cables, wrong set­tings on adjustable com­pon­ents and circuit break­ers, inad­equate cooling systems, poor fuel systems, etc all lead to high prob­ab­il­ity of failure.

Main­ten­ance

Equip­ment needs regular main­ten­ance to perform at its best and this should be con­sidered a must not an option. There is always res­ist­ance to spend­ing more than the initial cost of the equip­ment. Where the equip­ment does not display any outward signs of noise, motion or activ­ity, as in the case of a UPS, it is easy to forget it after it has been installed. To over­look main­ten­ance would be a grave mistake. The UPS is there to protect and support busi­nesses in an emer­gency, so it has to be ready. Main­ten­ance is an integ­ral part of the UPS system, and should not be mar­keted as an extra level of insurance.

Bat­ter­ies

Bat­ter­ies are the heart of all back-up power systems and are the main cause of oper­a­tional fail­ures. Without con­tinu­ous battery mon­it­or­ing, users of the major­ity of static UPS systems, cent­ral­ised emer­gency light­ing systems and rec­ti­fiers are unlikely to have any warning before their system lets them down.

Age

Most organ­isa­tions would not dream of using crit­ical IT equip­ment beyond 3 — 5 years of age. The same organ­isa­tions seldom con­sider upgrad­ing or renew­ing a circuit breaker or a gen­er­ator control system. Some standby gen­er­ator systems date back 30 years and beyond. Even if a system is cor­rectly designed, installed and main­tained it could still fail due to its age. This is simply because build­ings are dynamic cre­ations, where the ori­ginal cri­teria for the crit­ical power install­a­tion may change over time. As part of your main­ten­ance agree­ment insist on a regular assess­ment of the crit­ical load and the system’s ability to support it.

Tem­per­at­ure

Main standby power com­pon­ents, diesel gen­er­at­ors and UPS gen­er­ate sub­stan­tial amounts of heat. As any install­a­tion draws in its cooling air at these elev­ated ambient tem­per­at­ures it is imme­di­ately heated further by the heat rejec­ted from the equip­ment. This effect often forms a vicious circle, ulti­mately res­ult­ing in the standby system losing its thermal equi­lib­rium with tem­per­at­ures climb­ing inex­or­able upwards until the whole system fails. Chlor­ide, a total service pro­vider, carries out more than 500 load tests each year and has found that many systems installed in the UK struggle to main­tain thermal equi­lib­rium at sub 30ºC ambient tem­per­at­ures. Very few systems would sustain thermal equi­lib­rium at 35ºC and above.

Network Resi­li­ence

The National Grid con­siders that its period of greatest demand is in the winter, which is true given a hol­istic view. It is, however, not true for any “Hi-Tech” organ­isa­tion where the heat gen­er­ated by their equip­ment is a liab­il­ity. In these cases the period of increased demand is in the summer when air con­di­tion­ing is drawing its greatest load. National Grid openly states that it reduces the resi­li­ence of its network in summer in order to accom­mod­ate their main­ten­ance. It follows then, that spe­cific parts of the network, such as the com­mer­cial centres of any City, are subject to less resi­li­ence at the very point when they are at their most vulnerable.

Secur­ity

Crit­ical power systems often have no phys­ical secur­ity leaving systems prone to tam­per­ing or sab­ot­age, maybe by the dis­af­fected employee. Access control and per­son­nel screen­ing is often lacking, whilst night shift absent­ee­ism and even alcohol abuse have been known to leave systems unmonitored.

Remote Mon­it­or­ing

Mission crit­ical systems are often left unat­ten­ded outside normal working hours. Watch­ing over the UPS and mains power remains essen­tial; what happens if a weekend problem goes unnoticed until Monday morning? Com­pan­ies running 24/7 remote mon­it­or­ing pack­ages for both UPS and gen­er­at­ors are becom­ing an essen­tial part of the main­ten­ance mix, provid­ing imme­di­ate iden­ti­fic­a­tion of prob­lems, pre-emptive main­ten­ance and ‘remote fix’ capability.

Finally…

As prob­lems exper­i­enced by crit­ical power system end-users are very likely to be one or a com­bin­a­tion of factors out­lined here this list rep­res­ents a check­list for reas­sess­ing the reli­ab­il­ity of exist­ing crit­ical power systems.

Andrew Hodge is Service Sales Manager at Chlor­ide Harath

The very word “Com­pli­ance” strikes dread in many senior man­age­ment forums.

Viewed most often as a pain, neces­sary evil, or at best a burden on the busi­ness, Com­pli­ance has become a word most often asso­ci­ated with a sigh of despair. But should this really be the case? The very reason many senior man­agers have to be dragged kicking and scream­ing into the Com­pli­ance arena is often the com­plex­ity of the subject and fear of the unknown.

At the end of the day most senior man­agers are focused on making money for the busi­ness, con­trolling costs and gen­er­at­ing value for the share­hold­ers so they view com­pli­ance issues as a distraction.

Now that is inter­est­ing in itself, par­tic­u­larly the latter two points.

Surely con­trolling costs and gen­er­at­ing value for the share­hold­ers should be really good drivers to under­stand what Com­pli­ance can mean to the busi­ness? Part of the problem, and the per­cep­tion, is the pleth­ora of dif­fer­ent com­pli­ance issues that appear when the surface of the topic is scratched, e.g. Human Rights, Privacy, Data Pro­tec­tion, Freedom of Inform­a­tion, Tax­a­tion, Cor­por­ate Gov­ernance, Intel­lec­tual Property/Copyright, Health & Safety, Fraud & Cor­rup­tion, Com­pet­it­ive Prac­tice, Anti-trust, Money Laun­der­ing, Stand­ards (e.g. ISO/IEC27001, COBIT, SAS70) and much more.

Is it any wonder why senior man­age­ment would rather avoid getting embroiled in this as much as pos­sible? The problem is — it is their respons­ib­il­ity, and they are account­able for Com­pli­ance so, in time, many will become to realise that they have no choice and even that Com­pli­ance can provide real bene­fits to the business.

How can this ever happen?

Surely the whole Com­pli­ance effort costs a fortune and bogs the busi­ness down in unne­ces­sary procedure?

All many man­agers see is increas­ing red-tape, extra costs for con­trols, new or increas­ing com­pli­ance teams, per­sonal liab­il­ity and spiral­ing overheads.

But, is this a fair view? Sure there are addi­tional costs to be carried for the com­pli­ance efforts, but it could be argued that these are more than bal­anced by factors such as:

* Increased Customer/Shareholder/Partner con­fid­ence and trust
* Improved ana­lysis, doc­u­ment­a­tion and effi­ciency of busi­ness pro­cesses
* Better busi­ness resi­li­ence
* Greater buy-in from man­age­ment and staff
* The de-duplication of control efforts
* Faster audits with less hold points
* Reduced audit costs Reduced crisis/incident man­age­ment and remedial action costs
* Avoid­ance of legal or reg­u­lat­ory sanc­tions or fines and more …

It is sur­pris­ing how the very attempt to ensure Com­pli­ance can often become a cata­lyst for change. As a busi­ness grows often the devel­op­ment and doc­u­ment­a­tion of sound busi­ness pro­cesses falls by the wayside and greater reli­ance is placed upon staff know­ledge and expertise.

This can work for a while but we live in an ever chan­ging world where the pace of life is increas­ing daily and a lack of sound busi­ness prac­tice will mean trouble in the future. It only takes a key member of staff to leave, or say a dis­gruntled member of staff to ‘throw a spanner in the works’ and serious reper­cus­sions can ripple through­out the business.

Yes — we all know we should write pro­ced­ures so that someone can take over if the worst should happen; but the ‘instant’ nature of the working envir­on­ment today (e.g. the Inter­net, email, instant mes­saging, mobile con­nectiv­ity) makes that very unlikely — we just do what we do!

This is where Com­pli­ance brings back some sanity to the work­place. An auditor is not sat­is­fied by ‘hearsay’ evid­ence that a key busi­ness process is oper­at­ing in line with legal or reg­u­lat­ory require­ments — they want cold, hard doc­u­ment­ary evidence!

The Com­pli­ance drive has a tend­ency there­fore to under­line the need for key con­trols, pro­ced­ures and evid­ence, and to ensure that adequate funding is com­mit­ted to their main­ten­ance. What is often missed is the oppor­tun­ity to develop one man­age­ment system to control all aspects of com­pli­ance, regard­less of law, reg­u­la­tion or standard.

Many organ­isa­tion still approach Com­pli­ance from a piece­meal angle — HR do their bit, IT do their bit, Legal do their bit, etc. It is also common to see organ­isa­tions cre­at­ing sep­ar­ate teams, tasked with com­pli­ance to a par­tic­u­lar piece of legis­la­tion. This is, at best, unwieldy, inef­fi­cient and expens­ive; a prac­tice to be avoided. This can be due to the ‘siloed’ nature of many organ­isa­tions, internal polit­ics, expert­ise issues, or just plain stub­born­ness to get involved.

The problem is Com­pli­ance issues usually cut right across the busi­ness and a very strong lead is needed for any team that is going to co-ordinate all issues company wide. A com­pet­ent Com­pli­ance team can build one man­age­ment system that will provide co-ordination of the com­pli­ance effort, one repos­it­ory and source of inform­a­tion for audit trails and asso­ci­ated evidence.

This avoids the ‘empire build­ing’ that often happens when say a new piece of legis­la­tion comes along, con­tain­ing and poten­tially redu­cing costs.

So, ‘Over­head or Busi­ness Benefit’?

Much depends on your view­point and the type of organ­isa­tion you work for. Finance, Banking and Insur­ance are heavily reg­u­lated, and accept Com­pli­ance as just part of daily busi­ness, whereas for, say a man­u­fac­tur­ing busi­ness, this is all just a cost they would prefer not to have.

Hope­fully this will change in time, legis­la­tion may become simpler and easier to under­stand (eh .. pos­sibly..), busi­ness prac­tices and man­age­ment systems will improve, and many will see how the Com­pli­ance effort can bring real dividends.Business

Clif­ford May, Con­sultancy Prac­tice, Integ­ralis Ltd UK

The stand­ard prac­tice of con­duct­ing a Busi­ness Impact Ana­lysis (BIA) to determ­ine the basic recov­ery require­ments (Mission Crit­ical Pro­cesses, RTO’s, RPO’s, Crit­ical Applic­a­tions, Sup­pli­ers, and other Resources) is a vital phase of every Busi­ness Con­tinu­ity Man­age­ment program.

The BIA process can be long and dif­fi­cult — no matter what data col­lec­tion method is used. Is the return on your BIA invest­ment (time, man­power and resources) offset by the value of the results?

If a BIA is a fun­da­mental part of BCM, the under­ly­ing cost may simply be a neces­sary evil. But, when a BIA is a one-time ‘project’ — as in many organ­iz­a­tions — is the cost real­ist­ic­ally pro­por­tional to the value?

Some organ­iz­a­tions conduct a BIA expect­ing to repeat the process at regular inter­vals. However, once the initial BIA is com­pleted and the true cost known, such expect­a­tions are often abandoned.

Focus on change

Failure to update a BIA is a leading cause of Recov­ery Plan failure. Change is the only con­stant in busi­ness. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.

Intend­ing to update a BIA is easy; yet the update process often fails.

Con­sider the effort required to com­plete the ori­ginal BIA: ques­tion­naire pre­par­a­tion, dis­tri­bu­tion and col­lec­tion; inter­views to “nor­mal­ize” the results, plus the cost of ana­lysis and report generation.

Often, the ori­ginal BIA process “project”, may take three to eight months. Sig­ni­fic­ant busi­ness changes make the pro­spect of repeat­ing that lengthy process daunt­ing. Post­pon­ing the update may be ration­al­ized. Like most things in life, post­pon­ing dif­fi­cult tasks allows them to grow more unwieldy.

To stream­line the process, the updated BIA must focus on the changes — rather than repeat the entire process. It is likely that much of the inform­a­tion from the earlier BIA is still valid. The update process simply entails drilling down to which busi­ness pro­cesses have changed, and how those changes affect the ori­ginal BIA results. Of course, the method used to conduct the earlier BIA will determ­ine just how easy — or how dif­fi­cult — the update process becomes.

In Inform­a­tion Tech­no­logy, an updat­ing process is gen­er­ally ongoing (Change Man­age­ment) because IT changes have a direct impact on daily oper­a­tions. In busi­ness oper­a­tions, changes occur reg­u­larly, but are seldom, if ever, doc­u­mented. (To be fair, no matter how robust the IT program, not every organ­iz­a­tion con­sist­ently cor­rel­ates its Change Man­age­ment inform­a­tion with its DR Plan.)

The Whole is Greater than the sum of its Parts

Is it suf­fi­cient for indi­vidual busi­ness process “Owners” or func­tion leaders to update their own crit­ical resource require­ments? Yes, if the update method allows for the capture of changes in enterprise-wide depend­en­cies (on other pro­cesses, applic­a­tions, etc.). But no effect­ive update can be con­duc­ted in a vacuum; any change to crit­ical depend­en­cies or resources is likely to have a cor­res­pond­ing affect upon those depend­ent processes.

While it may be effi­cient for a process team to update its own BIA, only by col­lect­ing and integ­rat­ing changes across the enter­prise can the true impact of busi­ness changes emerge.

The Path of Least Resistance

Fre­quently, the cost of updat­ing a BIA (in man­power and time) is per­ceived as unjus­ti­fi­ably high. Not updat­ing a BIA may become an accep­ted risk. BCM man­age­ment may opt to focus on BC/DR Plan updat­ing (assum­ing most process owners under­stand the impacts of change and will modify their Plans appro­pri­ately) without revis­ing the BIA. The more bur­den­some the BIA process, the higher the propensity not to repeat it.

Once made, such a decision often becomes insti­tu­tion­al­ized. Later, the failure to reflect fun­da­mental changes in the organization’s struc­ture may result in flawed Plans and a failed recov­ery. With luck, flaws show up in a test or exer­cise — not a real life incident.

What’s in your Toolbox?

Does your exist­ing BIA format lend itself to manip­u­la­tion? Or do you have to start from scratch? Do you use soft­ware that integ­rates BIA and Plan development?

Does the BIA format lend itself to the use of col­lab­or­at­ive tools? Can busi­ness process owners gain access to the ori­ginal BIA survey? Network– or Web-based col­lab­or­at­ive tools reduce the pain of updat­ing a BIA, while enabling mon­it­or­ing and audit­ing of the process by the BCM leaders or planners.

Assess your options, and pick a BIA updat­ing method that works best for your situ­ation. It may not be free, it may be time-consuming, and it may not be pain­less. But it will pay dividends if you have a dis­rupt­ive event.

An out-of-date BIA expo­nen­tially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA inform­a­tion, the valid­ity of Plans should be ques­tioned, and their suc­cess­ful exe­cu­tion must be suspect.

eBRP Solu­tions, Inc

As long time fol­low­ers of BS25999.Com will know I like to change things around on a regular basis so this is the first post in the new blog format.

I will be intro­du­cing new content as well as mater­ial from the old site on a regular basis, please add any com­ments or feedback.