Skip to main content

Business Continuity Planning: Scared + Prepared = Spared

Steve Gilde April 21, 2020
Business Continuity Planning

With extra time on my hands, I turned to my business bookshelf for some reading material and came across a dog-eared and much highlighted classic that seems very appropriate for our current times. “Only the Paranoid Survive”, written by computer industry legend Andy Grove, outlines his experience and strategies for dealing with massive change, like the COVID-19 pandemic that has virtually the entire global population in its deadly grip.

In his book, Grove would call what we are going through today a Strategic Inflection Point or a 10X change, where everything you knew or thought you knew gets turned upside down and typical rules no longer apply. 

As Mr. Grove put it, “There’s wind and then there’s a typhoon, there are waves and then there’s a tsunami.” Or in our case, there is flu season and then there is a global pandemic.

Strategic-Inflection-PointClearly, there is a long way to go before the Coronavirus crisis is over. Even if we can get the disease itself under control over the next few months, there are ominous warning signs about what a “recovery” might look like in this country and for the broader global community. On top of the seismic tremors caused by COVID-19, an economic tsunami is about to wash over the financial services industry. In other words, there is plenty to be scared about.

Consider the following:

These statistics point toward a huge spike in loan defaults and business failures, as well as personal and corporate bankruptcies. In closing out their Q1 2020 books, most of the major US banks have set aside billions of dollars in loan loss reserves. (As I write this, it looks like Nieman Marcus will be the next big retailer to file for Chapter 11 protection. With all of its stores already closed, it looks like there is only one final sale left for NM after more than 100 years in business.)

To top it all off, there will almost certainly be new legal and regulatory changes coming for the payments industry. New rules will most likely involve additional protection for consumers and employees, increased data privacy and security, as well as more BCP rigor and testing.

Preparation is Key

Even though dealing with the chaos of such a Strategic Inflection Point is difficult to manage while you are bailing as hard as you can to stay afloat, it is possible to navigate difficult times and comes out better and stronger on the other side. Preparation is the key, but maybe not in the traditional way most companies go about it. In his book Grove states, “… you must recognize that no amount of formal planning can anticipate such changes. Does that mean you shouldn’t plan? Not at all. You need to plan the way the fire department plans. It cannot anticipate where the next fire will be, so it has to shape an energetic and efficient team that is capable of responding to the unanticipated as well as the ordinary event.”

According to Kathleen M. Sutcliffe, co-author of Managing the Unexpected (with Karl Weick) the structure and culture of an organization are key. “Crises do not come out of nowhere, but are the most extreme versions of things that happen all the time, so it is possible to anticipate them in outline and build up resilience.”

Unfortunately, many companies suffer from what Grove calls “the inertia of success.” Rather than planning for both success and failure, many organizations tend to be overly optimistic about their prospects with management taking the “it can’t happen to us” approach to strategy and planning.

It’s déjà vu all over again

Perhaps an example to call out here is the “current” problem with COBOL. It seems that many government agencies are struggling with their legacy mainframe systems as they try to respond to the rapid influx of unemployment claims and other changes necessitated by the COVID-19 crisis.

Those of us who worked through the Y2K issue can distinctly remember dealing with this situation before. During the lead-up to the year 2000, there was great consternation about the age and state of legacy mainframe programs and lack of COBOL programmers available at the at time. It seems that more than 20 years later, we are still in the same predicament. Was this an issue that “came out of nowhere”, or is this something that could have been and should have been anticipated.

And while state governments are the main organizations dealing with the COBOL problem today, many banks and financial services organizations have the same underlining issue. In 2017, a Reuters study highlighted the exposure for the US financial industry

  • 220 billion lines of COBOL code in use
  • 43% of banking systems built on COBOL
  • 80% of in-person transactions processed by COBOL based systems
  • 95% of ATM transaction rely on COBOL code

Another example closer to my heart is the issue of testing. According to the Capgemini World Quality Report 2019, 47% of organization say that testing is the biggest cause of delay in their development process. At the same time 42% of organizations indicate that they still rely solely on manual testing, saying that the biggest reason that they can’t automate their testing is because of all the change going on! Hopefully, the COVID-19 crisis will be the catalyst for these organizations to improve their capabilities before “the next time”.

Sooner or later, you have to deal with change. All debts need to be paid eventually. Some organizations will use what they learn from the present situation to update not only their Business Continuity Plans (BCPs) but their ability to execute those plans, i.e. they will improve their operational resiliency. Others will not.

To sum things up in the words of Andy Grove: “Bad companies are destroyed by crisis, good companies survive them, great companies are improved by them. Success breeds complacency. Complacency breeds failure and only the paranoid survive.”

 

New call-to-action

 

 

Related posts

Payments Testing - March 19, 2024
PCI DSS 4.0: Will You Be Ready?
Steve Gilde Author at Paragon
ATM Testing - February 8, 2024
PCI DSS 4.0 Changes: Is Your ATM Fleet Ready for 2024?
Steve Gilde Author at Paragon
Payments Testing - December 20, 2023
Payment Testers: The Detective Work Behind Secured Transactions
Steve Gilde Author at Paragon