delivering business value by applying agile principles to business continuity management

Delivering Business Value by Delivering Business Value by

Applying Agile Principles to Applying Agile Principles to

Business Continuity ManagementBusiness Continuity Management

Ken CollinsKen Collins

Management ConsultantManagement Consultant

Solution Integrity Inc.Solution Integrity Inc.

May 13, 2009May 13, 2009

May 13, 2009 2

IntroductionIntroduction

� Ken Collins, BASc, MBA, CMC, PMP, ITCP, ABCP, MCPD, CTT+

» [email protected]

• Driving business success through strategic leadership of IT

» Change Agency

» Service-oriented Architecture

» Team-based Software Development

» Project Management Organization Frameworks

» Business Continuity Management and Disaster Recovery

May 13, 2009 3

Session ObjectivesSession Objectives

� Intended Audience

• Executives and Project Managers charged with developing business continuity and IT disaster recovery plans

� Learning Objectives

• Describe typical challenges as businesses try to build competency with business continuity management

• Learn how Agile principles can shape the vision and scope of business continuity initiatives

• Understand how Agile can enhance accountability, motivate teams, deliver short-term wins and generate real business value

May 13, 2009 4

AgendaAgenda

� In Theory

• What is BCM?

• What is Agile?

• Conventional BCM Wisdom

• Typical Challenges

� In Practice

• Adopting a New Mindset

• Applying Agile to a Business Continuity Project

• Managing Scope

What is Agile?What is Agile?

May 13, 2009 10

Agile ManifestoAgile Manifesto

May 13, 2009 11

Agile PrinciplesAgile Principles

� Early, continuous and frequent delivery

� Working software is the measure of progress

� Welcome and adapt to changing requirements

� Teams work at a pace that can be sustained

� Teams should reflect on successes and failures

� Strive for simplicity in design and execution

May 13, 2009 12

The Waterfall ModelThe Waterfall Model

� Agile is not merely a new vocabulary

� Agile development has little in common with the

waterfall model, which is still widely in use

� Waterfall

• Inflexible division into separate stages

• Commitments are made early

• Difficult to react to changes in requirements

• Iterations are expensive

• Unsuitable if requirements are not well understood or

are likely to change over the life of the project

Conventional Conventional

BCM WisdomBCM Wisdom

May 13, 2009 14

BCM is Holistic ResilienceBCM is Holistic Resilience

� “Business Continuity Management is a holistic

process that includes the commitment of

management at all levels on an ongoing basis.

� “Provides a framework for building resilience

and capability for an effective response thereby

safeguarding the interests of key stakeholders,

reputation and value-creating activities.”

The Business Continuity Institute

May 13, 2009 15

BCM is CriticalBCM is Critical……

� “To maximize business potential and ensure continuity for our clients, risk-based proactive measures have been taken to safeguard our production systems…The strategic plan for business continuity accommodates the…process of achieving and maintaining a high degree of disaster readiness, effectively responding to disasters big and small and then returning to a well positioned readiness state.”

� “The alternate site recovery…represents a very high standard of recovery in the event of major disaster…We are committed to…preparing ourselves…and believe that, following a major catastrophe involving our primary processing centre, we would beoperational within days.

BCM is CriticalBCM is Critical……and Dauntingand Daunting

May 13, 2009 16

Templates are TerrifyingTemplates are Terrifying

� “Establishing a Business Continuity Plan

requires a fair amount of research as well as the

collection of information. Gathering the

information can often be a daunting task.

…However, we have provided you with the

following templates outlining the key

requirements for work areas, technology, forms,

and procedures.”

May 13, 2009 17

Example of a Useless TemplateExample of a Useless Template

S T A N D A R D S U P P L I E S RE Q U I R E M E N T S

QUANTITIES BY RECOVERY INTERVALS DESCRIPTION

WITHIN 24 HRS WITHIN

48 HRS WITHIN

72 HRS WITHIN 1 WEEK

FILE FOLDERS AND BINDERS CALCULATOR

HIGHLIGHTERS

PENS AND PENCILS

PENCILS

HOLE PUNCH (3 HOLES)

ELASTIC BANDS (PER BOX)

PAPER CLIPS (PER BOX)

PADS OF PAPER (LINED)

PRINTER PAPER

POST-IT-NOTES

STAPLER

STAPLER REMOVER

RULERS

SHRED IT BOX

DATE STAMP FOR AP

DEPOSIT STAMPS (CDN, US)

Typical ChallengesTypical Challenges

May 13, 2009 19

Typical ChallengesTypical Challenges

� Lack of executive support and accountability

� Unclear strategy

� Maintaining a sense of urgency

� Planning instead of exercising

� Trying to do too much all at once

May 13, 2009 20

Typical Challenges Typical Challenges –– StrategyStrategy

� Unclear strategy

• Which categories of business disruption should be

addressed?

• What fundamental assumptions should be made?

• What’s the overarching approach?

• What are the RTOs and RPOs for each business

process?

• What’s the cost of disruption?

» 6 hours? 24 hours? 2 days? 1 week?

May 13, 2009 21

Typical Challenges Typical Challenges –– Urgency Urgency

� Business Continuity uses significant resources

� Organizations often struggle to develop plans

and to support them on a

continuing basis

IVIII

I II

URGENT NOT URGENT

IMP

OR

TA

NT

NO

T IM

PO

RT

AN

T

II

� What typically happens to important, non-urgent

initiatives?

May 13, 2009 22

Typical Challenges Typical Challenges –– ChangeChange

� Change is scary; the fear factor is real

• It will cost a bundle

• We’ll have to make a commitment

• We could make a bad decision

• It’s going to create more work for us

• We don’t know where to start

Adopting a New MindsetAdopting a New Mindset

May 13, 2009 26

Opening Your MindOpening Your Mind……

to a New Mindsetto a New Mindset

� Firm A

• “As a key component of our employer-of-choice

strategy, we want to communicate to potential employees that this is a great place to work…”

� Firm B

• “The last thing we want to be is an ‘employer of

choice.’…”

Mark Huselid, Brian Becker and Richard Beatty, The Workforce Scorecard

May 13, 2009 27

Should Industry or Context Should Industry or Context

Affect the Project Approach?Affect the Project Approach?

� Where does BCM fit?

Historically unfoundedHistorically basedBudgeting/Scheduling

Controlled crisisSix SigmaImplementation

Utility playersSpecialistsRoles

Ambiguous and vagueExplicit and documentedRequirements

Rapid and unplannedSlow and incrementalChange

Information TechnologyConstruction/EngineeringProject Characteristic

May 13, 2009 29

Contrasting ParadigmsContrasting Paradigms

� “The dominant paradigm has been the work-down view, where developing a solution is a deterministic exercise, similar to traditional engineering pursuits, but business forces driving some initiatives today require a different approach.”

Sam Guckenheimer, Software Engineering with Microsoft Visual Studio Team System

May 13, 2009 30


Core AssumptionsCore Assumptions

� Planning and Change Process

� Primary Measurement

� Definition of Quality

� Acceptance of Variance

� Intermediate Work Products

� Troubleshooting Approach

� Approach to Trust

May 13, 2009 31


Planning and Change ProcessPlanning and Change Process

Work-Down Attitude

� Planning and design are the most important activities to get right. You need to do these initially, establish accountability to plan, monitor against the plan, and carefully prevent change from creeping in.

Value-Up Attitude

� Change happens; embrace it. Planning and design will continue through the project. Therefore, you should invest in just enough planning and design to understand risk and to manage the next small increment.

May 13, 2009 32

What Management NeedsWhat Management Needs

� Confidence through Predictability and Progress

• How much will it cost?

• When will it be done?

• How will we measure progress?

May 13, 2009 33

When is it Done?When is it Done?

� You’re building a house…can you envision a

time when it’s done?

• Waterfall

� You’re building great software…can you

envision a time when it’s done?

• Agile

� So where does BCM fit?

Applying Agile to a Applying Agile to a

Business Continuity ProjectBusiness Continuity Project

May 13, 2009 35

InPractice

BackgroundBackground

� The organization decided upon a seven-stage

model, and then tried to plan everything!

� “Over the past years, a few projects have taken

aim at putting BCP and IT DRP in place.”

� Documents of 100+ pages sat on shelves

May 13, 2009 36

InPractice

Getting StartedGetting Started

� Align Senior Management

� State the Problem

� Pull Together the Guiding Team

� Develop the Change Vision and Strategy

� Communicate!

May 13, 2009 37

InPractice

Problem StatementProblem Statement

� Customers demand assurance that business continuity plans are in place to mitigate the impact of service disruptions. These expectations are not well aligned with our current corporate reality.

� With our heavy reliance upon IT, it is clear we must create and validate comprehensive disaster recovery plans that underpin business continuity.

May 13, 2009 44

InPractice

Vision StatementVision Statement

� By the end of 2008, we will have built a framework of business continuity best practices by iteratively and

incrementally exercising risk management and disaster

recovery processes

� We will simulate likely disruptions, execute organization-wide responses, produce audited test results, and

advance improvements to both infrastructure and planning; thereby assuring our customers and

shareholders that we effectively mitigate exposure to

regional service interruptions

May 13, 2009 46

InPractice

Iterative ApproachIterative Approach

� “We have adopted an iterative approach to

delivering a comprehensive solution, which

enables us to plan for the most likely risks to our

organization while building a framework that

supports our response to potential events that

threaten our ability to service our customers.”

Managing ScopeManaging Scope

May 13, 2009 48

IncrementalismIncrementalism

� Incrementalism is a good idea for all

projects…and a must when risks are high

� When do we really understand the problem?

Before or after implementing a solution?

� “Plan to throw one away; you will anyhow”

• Frederick P. Brooks , The Mythical Man-Month

� Do you get an ‘A’ for effort…or for results?

May 13, 2009 49

Iterative ApproachIterative Approach

� Minimize risks by breaking large projects into multiple versions

Time

Fu

ncti

on

ality

Version 1

Version 2

Version 3

May 13, 2009 50

Benefits of IterationBenefits of Iteration

� Manages uncertainty and changes in scope

� Encourages continuous and incremental improvement

� Enables shorter delivery time

� Sets clear and motivational goals for team members

� Forces closure on project issues

May 13, 2009 51

InPractice

Business RisksBusiness Risks

SevereLowPermanent loss of facilities and systems

HighMediumPandemic event that denies access to facilities, personnel and systems

HighMediumLocal or regional disruption of a non-permanent duration (e.g., three weeks) that denies access to facilities and systems

MediumHighBuilding-localized power outage

ImpactProbRisk Consequence

May 13, 2009 52

InPracticeDriving Statement for Driving Statement for

First DeliverableFirst Deliverable

� “The nature of our business suggests we should

be able to operate at 100% capacity (client-

critical services) for 72 hours with a building-

localized power outage”

May 13, 2009 53

InPractice

ScenarioScenario--based Exercisesbased Exercises

May 13, 2009 57

Predictive versus AdaptivePredictive versus Adaptive

� Historically, BCM tries to be predictive

• Heavy planning effort to identify and mitigate several

eventualities

» Daunting

� Adapting quickly to changing realities

• Minimal planning, with a focus on a single scenario

» Manageable

May 13, 2009 58

InPractice

Examples of Adaptive BehaviorExamples of Adaptive Behavior

� First Exercise• Which is better?

» Detailed response plan

» Minutes

• Oopsies!

» Exceeded generator capacity

» Disruption upon resumption

• Adapted and retried a month later

» Installed a second generator

» Installed UPS’s throughout the office

InPractice

Delivering Value with Purpose and PracticeDelivering Value with Purpose and Practice

Building-localized Power Outage

IT Disaster RecoveryAlternate Site

PandemicWork Area Recovery

Permanent Relocation and Restoration

Bu

sin

ess V

alu

e

Risk Mitigation FocusFoster Culture Change

Build Confidence in ApproachEliminate Client Dissatisfiers

Strategic FocusShared Cultural ValuesCentre of Excellence

Enhance Client Satisfaction

High Availability and

Advanced Recovery

Assessment and Kickoff

BCM Introduced

BCM Operationalized

2007 2008 2009

Guiding Principles• Foster Open Communications• Work Toward a Shared Vision• Establish Clear Accountability and Shared Responsibility• Focus on Delivering Business Value

Mindsets• Pride of Workmanship• Team of Peers• Frequent Delivery• Willingness to Learn

May 13, 2009 66

Suggestions for SuccessSuggestions for Success

� Enhance accountability

• Appoint an executive champion

• Assign a dedicated project manager

• Engage business unit managers

� KISS and make incremental progress

� It’s a change initiative; manage it like one

• Review “Our Iceberg is Melting”

� Use scenario-based exercises as the

primary measure of progress

May 13, 2009 67

Session Objectives Session Objectives –– RecapRecap

� Intended Audience

• Executives and Project Managers charged with developing business continuity and IT disaster recovery plans

� Learning Objectives

• Describe typical challenges as businesses try to build competency with business continuity management

• Learn how Agile principles can shape the vision and scope of business continuity initiatives

• Understand how Agile can enhance accountability, motivate teams, deliver short-term wins and generate real business value

Thank You!Thank You!

May 13, 2009 70

The 8The 8--Step Process of Successful ChangeStep Process of Successful Change

John John KotterKotter, , Our Iceberg Is MeltingOur Iceberg Is Melting

Set The Stage 1. Create a Sense of Urgency2. Pull Together the Guiding Team

Decide What To Do3. Develop the Change Vision and Strategy

Make It Happen4. Communicate for Understanding and Buy-in5. Empower Others to Act6. Produce Short-Term Wins7. Don’t Let Up

Make It Stick8. Create a New Culture

May 13, 2009 81

What is Agile?What is Agile?

� Agile methods generally promote a project

management process that encourages frequent

inspection and adaptation, a leadership

philosophy that encourages teamwork, self-

organization and accountability, a set of

engineering best practices that allow for rapid

delivery of high-quality software, and a business

approach that aligns development with customer

needs and company goals

May 13, 2009 82


� The dominant paradigm has been the work-down view, where developing a solution is a deterministic exercise, similar to traditional engineering pursuits, but business forces driving some initiatives today require a different approach

May 13, 2009 83


Core AssumptionsCore Assumptions

� Planning and Change Process

� Primary Measurement

� Definition of Quality

� Acceptance of Variance

� Intermediate Work Products

� Troubleshooting Approach

� Approach to Trust

May 13, 2009 84


Planning and Change ProcessPlanning and Change Process

Work-Down Attitude

� Planning and design are the most important activities to get right. You need to do these initially, establish accountability to plan, monitor against the plan, and carefully prevent change from creeping in.

Value-Up Attitude

� Change happens; embrace it. Planning and design will continue through the project. Therefore, you should invest in just enough planning and design to understand risk and to manage the next small increment.

May 13, 2009 85


Primary MeasurementPrimary Measurement

Work-Down Attitude

� Task completion. Because we know the steps to achieve the end goal, we can measure every intermediate deliverable and compute earned value running as the percentage of hours planned to be spent by now versus the hours planned to be spent to completion.

Value-Up Attitude

� Only deliverables that the customer values (working software, completed documentation, etc.) count. You need to measure the flow of the work streams by managing queues that deliver customer value and treat all interim measures skeptically.

May 13, 2009 86


Definition of QualityDefinition of Quality

Work-Down Attitude

� Conformance to specification. That’s why you need to get the specs right at the beginning.

Value-Up Attitude

� Value to the customer. This perception can (and probably will) change. The customer might not be able to articulate how to deliver the value until working software is initially delivered. Therefore, keep options open, optimize for continual delivery, and don’t specify too much too soon.

May 13, 2009 87


Acceptance of VarianceAcceptance of Variance

Work-Down Attitude

� Tasks can be identified and estimated in a deterministic way. You don’t need to pay attention to variance.

Value-Up Attitude

� Variance is part of all process flows, natural and man-made. To achieve predictability, you need to understand and reduce the variance.

May 13, 2009 88


Intermediate Work ProductsIntermediate Work Products

Work-Down Attitude

� Documents, models, and other intermediate artifacts are necessary to decompose the design and plan tasks, and they provide the necessary way to measure intermediate progress.

Value-Up Attitude

� Intermediate documentation should minimize the uncertainty and variation in order to improve flow. Beyond that, they are unnecessary.

May 13, 2009 89


Troubleshooting ApproachTroubleshooting Approach

Work-Down Attitude

� The constraints of time, resource, functionality, and quality determine what you can achieve. If you adjust one, you need to adjust the others. Control change carefully to make sure that there are no unmanaged changes to the plan.

Value-Up Attitude

� The constraints may or may not be related to time, resource, functionality, or quality. Instead, identify the primary bottleneck in the flow of value, work it until it is no longer the primary one, and then attack the next one. Keep reducing variance to ensure smoother flow.

May 13, 2009 90


Approach to TrustApproach to Trust

Work-Down Attitude

� People need to be monitored and compared to standards. Management should use incentives to reward individuals for their performance relative to the plan.

Value-Up Attitude

� Pride of workmanship and teamwork are more effective motivators than individual incentives. Trustworthy transparency, where all team members can see the overall team’s performance data, works better than management directives.