Boosting BCP

As the deadly bombings rocked London last July 7, followed by four attempted bombings two weeks later, the big news among British financial services firms was no news at all. Despite the unexpected attacks, it was nearly business as usual - proof that the industry had enough of a handle on business continuity planning (BCP) and disaster recovery (DR) to keep operations going.

Back on this side of the Atlantic, reports are showing that business continuity has taken a backseat to more pressing compliance initiatives, such as Sarbanes-Oxley and Basel II. While BCP and DR ranked eighth in Financial Insights' 2003 annual top 10 priority list for the capital markets, BCP and DR disappeared from the list in both 2004 and 2005. "It fell off the radar screen," says Gene Kim, a senior analyst at the Framingham, Mass.-based research firm. "We're just not hearing a ton of stuff about it."

Michael Pacchia, a senior IT analyst at Lehman Brothers, insists that his firm is one of the exceptions. Pacchia was involved in the massive IT recovery of the firm's trading floor after Sept. 11, 2001, and currently runs the BCP and DR project for its equities division. "Having a solid BCP and DR strategy is an integral part of all our IT projects," he says. "This has always been high on our radar screens." Pacchia continues, "We don't approach any new technology without viewing both sides of the picture - assessing the risks, determining the impact and asking the 'what if' questions."

Patrick Alesi, vice president of business continuity management at Lehman Brothers, stresses that since Sept. 11 the New York-based firm has been working hard to improve and expand it's BCP and DR processes. "We previously had more of a centralized approach to business continuity, and then we realized that the best way to do it was to push BCP out to the businesses, so that they're really accountable for developing their plans and putting their plans into effect," he says.

Alesi has a history with BCP at Lehman Brothers. From 1997 to 2000, he held a similar role, but he says the firm previously approached business continuity as more of a technical function. "Business continuity was more centralized then - we did a lot of work around providing networks and distributed data centers," he explains. Alesi says that he left the firm after Y2K, primarily because, "People lost interest." After Sept. 11, Lehman Brothers made a large reinvestment in BCP and he returned to the firm.

Although Alesi presently is just one of three principal BCP planners for Lehman in the Americas (with a staff of three analysts), he notes that a number of chief administrative officers (CAOs) throughout the firm also are responsible for BCP. "There's a broad acceptance that business continuity has to be the cornerstone of everything we do," he explains.

"Each division has a CAO and each department within a division has a CAO. The CAOs are tasked with dealing with budgets, head counts, space planning, ... and it's a natural fit for them to do BCP," Alesi continues. "Everybody in that role is a business continuity planner for the group that they represent. So even if there is only a small group in the Americas that has business continuity in its title, there are dozens of people that do BCP for the firm."

From an IT perspective, Lehman Brothers makes no distinction between its BCP and production environments, Alesi notes. Moreover, BCP has become subject to the same business drivers to which any of its other businesses are subject - people want real-time information, from anywhere, at any hour. Consequently, the firm has focused on providing tools that allow people to get information quickly through wireless devices and the Internet. Lehman Brothers also has connected BCP with its regular operations tools (i.e., databases that manage people and systems), so that, from a technology standpoint, disaster recovery is equivalent to regular operational incident management.

"IT plays a central role [in BCP]," says Alesi. "The tools that they've developed allow people to see their desktop from almost any place in a Lehman site the same way that they'd see their desktop at their normal desk. They can also access their data remotely if they need to." He continues, "The infrastructure that IT has built around the data centers has really enabled the business to focus more on the communication and the flexibility to react instead of being tied to whatever the IT solution is. The technology has released the business from thinking about recovery as something out of the ordinary, and has allowed them to focus more on ... what the employees' travel considerations are, the well-being of the employee, and the communication to the employee."

Pacchia adds that some of the new tools provided by engineering to support business continuity planning include a proprietary synchronization method and new application modeling techniques, although he declines to explain them in detail. Instead, he says, "Both the BCP and production environments are equally as critical to the business, and both are expected to work on demand with no tweaking. There's a lot of value and peace of mind in having this philosophy, for the simple reason that one day your BCP site could be your production site."

Whether BCP and DR will make it back on industry priority lists in 2006 remains to be seen. In the meantime, tragedies like the London bombings will serve as unfortunate reminders that financial institutions must continue to be vigilant in their planning.

"People are still concerned about continuity," says Financial Insights' Kim. "And in a post-Sept. 11/Iraq war environment, folks need to always be aware of those issues."