Canadian firms believe the four per cent of their IT budget currently put towards business continuity planning is insufficient, according to a recent survey by IDC Canada.
In fact, companies surveyed responded that an additional 90 per cent should be allocated towards business continuity.
The study, conducted last June, polled Canadian IT and business counterparts from large and mid-sized companies across a mix of verticals including financial, public sector, manufacturing, distribution and infrastructure.
"In other words, Canadian firms feel that they're not doing enough," said David Senf, director of Canadian security and software research with the Toronto, Ont.-based research firm.
According to Senf, the admission that business continuity requires more attention is no surprise considering the level of preparedness, or lack thereof, found across the sample. In particular, a mere quarter of firms said they have a plan that's actually been tested, while one third have an untested plan, another third have an ad hoc plan, and 12 to 15 per cent have none at all.
Actually, this lack of preparedness shows a disconnect between executives' number one concern of IT reliability and uptime, and what these execs are actually pushing the organization to do, said Senf. "It's an important area for them, yet they're cited as one of the reasons why Canadian firms aren't doing more. There's not a lot of leadership occurring among Canadian managers to push their organizations to do more."
There are ample reasons to test and exercise a business continuity plan, said Marv Wainschel, director of education at Eagle Rock Alliance Ltd., a West Orange, New Jersey-based management consulting firm specializing in business reliability planning.
Testing helps the company to practice its plan; generate awareness among participants who will be carrying it out; and allows the company to find out if components of the plan actually work. For example, he said, organizations should ensure they can recover lost data, bring back a process on a particular machine, and switch the network.
Wainschel said the four per cent of IT budget allocated towards business continuity cited by respondents probably doesn't include resources allocated towards continuity at the production level, such as maintaining duplicate processing ability at a remote site, and the replication of data.
"Some people don't consider that part of business continuity planning," said Wainschel, adding that business continuity can also encompass different levels of resolution management like quality assurance, and data security.
The study also found that among companies with business continuity plans, maintaining customer service was the area of the business that was of most concern. However, that concern was more pronounced among mid-market firms who typically employ a more tactical focus, compared to the "complete picture" approach of large organizations, said Senf.
Company reputation and financials were also among the concerns.
These business areas would naturally fall among the top focal points for any company, agreed Wainschel. "Usually, the mission of any company centres on the strength of their customer service, customer relationships, their financial strength, reputation issues and also their ability to conform to legal requirements."
And at the very bottom of the list of business area concerns, sat regulatory compliance – although that may change as Canada's compliance legislation becomes more stern, said Senf. "But as it stands, regulatory compliance is not a big issue that Canadian firms are worried about."
Regulatory compliance generally falls to the bottom of the list of concerns, noted Wainschel, because if a company is diligently handling issues like customer service, financials and reputation, then compliance usually gets covered in the process.
The survey also found that IT executives were not as in tune as their business counterparts to the importance of business continuity planning. This makes sense given the areas of concern identified by respondents, said Senf, because business execs generally have more direct interaction with customers and financials.
Getting organizations more aware of the importance of business continuity planning is unfortunately often driven by the severity of the impact of a disaster, said Senf.
He said the majority of Canadian firms in the last 12 months have experienced a disruption of some sort, be it IT or weather-related, but despite this, "most organizations are reactive than proactive."
Check out the associated Webcast with David Senf: Defend data and reduce the risk of downtime