Transcription

1 Business Continuity Management Software - Build or Buy

2 Introduction The level of demand for technological integration and flexibility within business continuity management has grown with astonishing speed over the past decade. The task of producing the required innovative systems that ensure effective communication and people management are now a key requirement in effective software delivery on both a large and a small scale. Traditionally, the manual processes involved in the creation, training and update of an emergency action plan (EAP) relies on a broad spectrum approach to situation control. Due to this, it often fails entirely when faced by unpredictability. Fast and direct communication of relevant information between ground staff and key senior management, in time to provide effective chain of command, becomes a huge barrier to best practice. The integration of an effective and efficient online system that provides reliable results consistently is an essential requirement when considering the safety of staff and business reputation. When deciding to build software in-house or buy a license for existing software there is a simple question that must be considered; to what extent can you trust the proposed computer program to protect the lives of your staff and what are the considerations that contribute the effectiveness of one system over another? The answers come from four areas of research that consider the business impact of modelling intelligent software to assist with typically reactionary problems. The areas of research needed to make your decision 1- Understand the requirements and risks associated when taking on a project of this size 2 - Outline the advantages that would be most beneficial to your company 3 - Consider long term goals of the software when measured against company growth and expansion 4 - Weigh up your options with the benefit of industry expertise and professional advice Below are some of the most frequently asked questions companies use to decide if they have sufficient resources to build their software in-house. To test your company s readiness, just tick either yes or no in relation to your company next to the corresponding question. Do you have an IT team that can dedicate time to the development of a bespoke program? Do you have a leader for the team with incident management expertise who can set clear time-frames and push a team to deadlines? Do you have the resources to train new staff and support the custom built application, taking into account changes and updates? Do you have effective means of ensuring the system is compliant, functional and up-to date with technological advances? Do you have the time and expertise to create comprehensive support documents, an internal helpdesk and patching updates with automatic testing? Yes (Build) No (Buy) Do you have a methodology for ensuring your software can change and evolve to meet new demands placed upon it? Do you have the expertise to design and optimise all relevant processes within the system, taking into account real-time security policy and resilience? Do you have the time to fully manage both the scope of development itself and the budgeting of the ongoing project? Can you ensure doing all of the above will not interfere with the day-to-day running of your business, directly impact your customers and bottom-line?

3 1. Requirements and Common Pitfalls Knowing where to start is, like many things, not always easy. The first considerations must fall into the speculative domain; rather than looking directly at pricing or timescales, instead the aims for the software must qualified and challenged at both a fundamental land technical level. No other part of the conceptual work is as difficult as establishing technical requirements... No other part of the work so cripples the resulting system if done wrong. No other part is as difficult to rectify later. Brooks, No Silver Bullet: Essence and Accidents of Software Engineering. Companies who decide to build their software in-house often have a limited vision of the software they need, understanding only a portion of their real requirements. This lack of technical expertise and scope within the specification can prove disastrous when put into effect. While factors such as scope and technical demand at an interpersonal level carry little weight financially, when considering the effectiveness of the system in practice, they are paramount. Another issue which tends to lead away from the best course of action when considering software projects arises when companies are unable to view their options objectively; they can often miss key considerations or wildy overestimate others. Many variables can come into play that cannot necessarily be accounted for when companies; - Favour internal knowledge - Internal knowledge is cheap and readily available - Focus too much on irrelevant details - A company rarely understands the scope of a desired system - Have IT staff who have free time - IT staff should have speciliased projects that grow existing expertise - Don t want to introduce a big change - Often building it in-house appears to be an easy option - Underestimate the time, money and work required - Staff are forced to make estimations without thorough research Organizations with no history of external technology acquisitions are more likely to depend upon in-house development even if the build case is not rational The Black Swan effect Rosen, Wall Street and Technology, 2001 Factors that cause far greater harm than originally understood or anticipated are known as Black Swans. (Nassim Nicholas Taleb, Fooled by Randomness, 2001) For example, Levi Strauss, in 2003, decided to update their in house SAP protocols, leading from a $5 Million initial budget, that became a $200 Million loss because they were overconfident and underestimated the variables involved. This effect is not rare: We examined 1,471 projects, comparing their budgets and estimated performance benefits with the actual costs and results... Fully one in six of the projects we studied was a black swan, with a cost overrun of 200%, on average, and a schedule overrun of almost 70% Bent Flyvbjerg and Alexander Budzier, The Harvard Business Press Projections that cover cost, speed and functionality are often vastly underestimated. In one year, corporate America spends over $275 Billion across 250,000 in-house software development projects, meaning the average cost of development is around $1.1M. (The CHAOS report - The Standish Group) Many more go over time or even fail entirely for a wide array of reasons: Development can suffer from unrealistic deadlines, speed and quality of research is not balanced and sometimes key modules are missed entirely. These factors can have enormous knockon effects including bugs, inefficiency and downtime, all of which can cause compromises or the entire project to be scrapped at huge expense. Results by % of those which succeeded in creating their software on budget Sucessful Challenged Failed Note: Challenged concerns software that is completed and operational but over budget, over time estimate and with fewer features and functions than initially specified. Figures collected by the standish group.

4 2. The Advantages of Buying - Considerations that go beyond pricing COTS, or Customisable off-the-shelf business continuity and risk management software is specifically designed to deliver flexible and on-demand visibility, communication and control over both incidents (which generally have predicable causes and outcomes) or a large scale crisis (which often do not). The first point to make is that today, the majority of business continuity software providers use SaaS (Software-as-a-Service) as a platform to offer the greatest ease of use and most powerful level of front-line protection against hardware failure. A SaaS model lends itself so well incident management because of its versatility; it enables staff to login securely using any device connected to the Internet and does not require users to manually update or patch their software. A wide range of features that cover logging, escalation, reporting and management of business interruption also help to ensure efficient and effective practice and clear command structure at all times. They also provide protection over various additional aspects that, while not considered as priorities, are nevertheless equally important to business interests. Integration with a range of technologies and working partnerships with other businesses, for instance, are key to providing a service which excels at both an individual and business level. Beyond actual functions, buying into existing software that has been used by similar companies offers access to a priceless knowledge base. Experience Consulting with professionals who deal with incident management software on a daily basis provides access to a wide range of complex intuitive programming knowledge, including specialist functions such as comprehensive reporting, compliance focused data management and reactive control processes. Assimilating an existing incident management solution, as opposed to building it, means you can easily avoid various risks and costs associated with software development and evolution. The extra time saved can free up time to focus on additional projects which add value to the business and also improve your other business continuity processes. Training Support documents and properly trained users ensure that software is correctly used at all levels and that each individual has the necessary understanding of the software s scope and potential to enact an immediate and ongoing positive change within their role. A properly tested training programme ensures users have high levels of operational and technical competency and can perform effectively under extreme pressure. Specialist trainers use proven techniques, influenced by feedback from a wide array of existing clients, to achieve noticeably better results. Support Providing immediate and effective support for a range of staff across multiple sites, often in different countries, is vital to ensuring successful adoption and confidence in software. Support teams must be able to understand the importance of queries and then predict any additional knock on effects. Support resources, patch updates and enhancements are normally included in the licensing costs when buying an existing risk management software suite. Ongoing considerations for a company that decides to build Software Development Software model creation Software designer tool creation Software module creation Web development Country specific versions Data localisation Data Mapping Data Migration Testing Documentation Rollout Project Management Research Data collection Model development Methodology development Validation Training Evaluation Pricing control Product changes License Monitoring Maintenance and Support Ongoing maintenance Software upgrades Auto-update tools Help desk Issue tracking Opportunity Costs Business Employees Schedule delays

5 The Wider Effect of Software - Doing the job right The advantage of an existing framework to actively protect staff, mitigate business risk and ensure best practice at all levels of an organisation is an invaluable asset when additional considerations beyond pure necessity arise. Using existing software to enhance processes, you gain powerful tools to maximise performance that have been tried and tested in live situations around the world. Customisation The way software is perceived by the end user dictates how often and effectively it is used. Fulfilling individual needs improves adoption and reduces the impact of integration upon normal operations. Tailoring existing software with role specific modules and fusion of brand identity is a cost effective way to meet individual business demands. With an existing software base that has been proven to work already, customisation can be centered around staff who need more specific information to perform effectively. Adaptive and Reactive Response In extreme situations, circumstances can change so quickly and drastically that software must be able to adapt in order to effectively control a situation. An intelligent incident management suite gives key staff the visibility and operational control required to manage multiple complex incidents in parallel. In a crisis, if software fails staff can lose confidence, making mistakes that can prove costly later on. A well designed system ensures this never happens through comprehensive live testing from a range of incidents all over the world. This level of flexibility and insurance can be invaluable in giving staff the ability to perform at their most effective when put under pressure. Resilience and Security When risk control structures are put in place to ensure the safety of employees and company reputation, their ability to function at all times is paramount. The flexibility to use software away from a workstation (on a tablet or smartphone for instance) or with a weak internet connection allows staff to manage on the move and make key decisions in time to stop incidents escalating. Having contingency systems in place and thoroughly tested security measures are another key feature which we use at AIControlPoint to ensure our customers are never left exposed. Looking to the Future The level of ingrained intelligence within core design and complexity of infrastructure are key; software that runs background updates and reduces the level of required user interaction will be the only ones that effectively protect business needs. In the future, any system that fails to do this will quickly become a hindrance for staff and will need replacing, or at best require constant patches to keep up with new waves of technology. A COTS business continuity offering successfully negates the risk of redundancy in this arena, with new features and connectivity being added at all times. An Agile Approach to Software Traditionally, when considering a project, a company will write out requirements, the developers will create a plan and then work, often independently, from one task to the next. This is commonly known as waterfall development or incremental development. While this has the advantage of structure, it is rigid and often causes problems when new requirement needs arise or if functionality is overlooked. AIControlPoint favour agile development methodology. The basic principles involve far higher levels of collaboration between development staff, focus on the quality of development over much smaller time periods and the ability to react to new requirements more quickly. This dynamic approach means adaptation and integration is far easier and staff are less weighed down by time and documentation constraints; the entire focus is on the quality of the processes involved and the ability to evolve and grow with changing business and technological environments.

6 4. Weighing up your options The technology sector is, by it s very nature, prone to change and development. Software designed now may be obsolete in less than three years so, because of this, the ability to adapt to changing business needs and evolve in line with demands is vital. Put simply: In sharing the cost of a specialist development team, support staff and ongoing resources needed to stay up-to-date, far greater and more successful results are achieved longer term with a vastly reduced total cost of ownership when you create a partenership with a proven, successful and trusted business continuity software provider. Mature, stabilized, standardized packages in general embed best practices allowing such expertise to be purchased Buchowitz, A Process Model of Make vs. Buy Decision Making 1991 An existing incident management and business continuity SaaS package offers control, visability and accountability of incidents at all levels without detracting from core company needs. Advantages include: Clear outline of pricing from the outset Control over processes and chain of command Ready made for immediate use Experience of peers and industry analysts Comprehensive support and training Available through various devices Flexibility to work with other programs Constant upgrades and enhancements So, Build or Buy? Buying Incident management software provides staff with powerful, ready to go protection and fixes costs which may otherwise escalate. While building an incident management software in-house does offer a fleeting achievement and ultimately ownership of software; effectively managing the initial and ongoing technical and operational requirements such as timescales, costing, expectations, legality, insurance, training, testing, support, and development and can become a heavy burden. The fact is that building business continuity and incident management software requires complex processes and faces such a high proportion of risk that only small scale projects are ever viable which still only reduce the problem under certain circumstances rather than solve it completely. Several types of risks can be avoided when using packages. These include completion risks, cost/budget risk, control risk and performance risk Davis, Guide to Risk Assesment and Control Activities, 1998 Ultimately, the considerations are objective and quantitative; the initial and ongoing cost of research, staffing, creation, integration, development and ownership, weighed against the expectation of outcomes and the chance of success. Clearly, the secret to effective risk management is the trade-off of mitigation cost against the potential adverse effects of avoided risk. Ronald P. Higuera, Yacov Y. Haimes Software Risk Management About AIControlPoint AIControlPoint deliver centrally located and remotely accessible incident management systems that replicate an organisation s existing processes and ensures effective control over issues of all sizes. Their software is used by a number of the worlds largest companies in a wide range of industries including Shell, BP, Thomas Cook, easyjet and ING. They have also been named Gartner Cool Vendor for 2013 in in Business Continuity Management and IT Disaster Recovery Management. AIControlPoint is part of the Access Intelligence group, a collection of software modules which compliment the GRC life-cycle for companies worldwide, with a proven track record in delivering powerful solutions where they are needed most. Tel: info@aicontrolpoint.co.uk Website: