As I said in my last post, one of the reasons Software AG can adapt directly to the new situation is because we use our own business process management software – ARIS – as basis for our business continuity management system (BCMS). We can assess and prioritize risks, put new processes in place within a day and communicate these changes directly to our whole organization. I also discussed one element of a BCM system – business impact analysis and risk assessment (remember, we decided to focus on customer centricity – so Global Support is the process with the highest importance in the BCM system).
There are three more:
- Business Continuity Strategy: Based on a catalogue of potential threats, ensure that business activities are maintained at a reasonable level in crisis situations. Software AG’s BCM system ensures that global customer support processes remain available in the event of an emergency by coordinating between support, R&D, cloud operations, IT, facility management and other units.
- Business Continuity Procedures: Be able to respond quickly to emergencies and quickly restore standard processes and service level agreements. To this end, concrete work instructions and workarounds are defined; all employees have access to the system to receive the role-specific information relevant to them. The continuity procedures include the processes to evaluate whether a BC case exists and to solve a BC problem.
- Exercising and Testing: To ensure the BC procedures work in practice, they must be tested. To this end, annual tests are carried out, based on a training and rollout concept, so that every employee involved is aware of his or her role and tasks. The results of these tests flow into the continuous optimization.
The responsibility for business continuity is shifting from dedicated departments to the operational business departments – the first line of defense. At Software AG the responsibility for business continuity is found in our operational areas. Further development of the system is ensured by a cross-organizational project team (including a steering committee) and a dedicated business continuity manager.
Business Continuity Lifecycle
The governance of business continuity management is defined in Software AG’s enterprise management system, and the regular evaluation and improvement is a process described in ARIS:
The initial scope is to be reassured by the board every year. Software AG has developed a detailed training plan to ensure that all affected stakeholders are informed and capable to execute the plan and to mitigate risks for the key processes involved. The new “read and understood” capability of ARIS is used to distribute and manage changes.
In addition to exercising & testing an audit program with several internal audits for different areas will be conducted every year. These audits help to check the compliance of the BCMS itself and with the organizational requirements. Furthermore, there is an external audit every year to check the compliance of the Software AG BCMS to ISO 22301.
How is the BCM system being used in the current crisis?
Based on the continuity procedures, six locations have been defined with installed local incident response teams. They were selected to guarantee a full coverage of languages and our products.
These teams continuously answer these questions:
- Are all employees healthy?
- Are any SLA’s at risk?
- Is any help needed?
Management is daily updated on the situation in order to take prompt action.
It’s good to be prepared. When the very acute phase of the current crisis is over, you should set up a business continuity management system – or even better, integrate it into your enterprise management system. I hope that these best practices can help guide you through your business continuity plans.