W
HAT
H
APPENS
W
HEN
T
HE
S
CREEN
G
OES
B
LACK
?
ANALYZING DATA CONTINUITY MATURITY IN AIR-CARGO
COMPANIES
STUDENT NAME: ROBIN BEISEL STUDENT NUMBER: 11572582 FINAL DRAFT DATE OF SUBMISSION: 26-01- 2018 INSTITUTION: UNIVERSITEIT VAN AMSTERDAM MASTER’S THESIS: MSC. BUSINESS ADMINISTRATION – INTERNATIONAL MANAGEMENT TRACK THESIS SUPERVISOR: DR. M. PAUKKU
Statement of originality
This document is written by Student Robin Beisel who declares to take full
responsibility for the contents of this document.
I declare that the text and the work presented in this document is original
and that no sources other than those mentioned in the text and its references
have been used in creating it.
The Faculty of Economics and Business is responsible solely for the
supervision of completion of the work, not for the contents.
T
ABLE OFC
ONTENTS ABSTRACT 4 I. INTRODUCTION 5 1.2. METHOD 7 1.3. PURPOSE 8 II. LITERATURE REVIEW 9 2.1. OVERVIEW 92.2. RISK MANAGEMENT IN LOGISTICS 10
2.3. MANAGERIAL STRATEGIES TO CREATE A RESILIENT FIRM 13
2.4. CHANGE MANAGEMENT 16
2.5. THEORETICAL APPROACHES TO BUSINESS CONTINUITY PLANNING 18
2.6. BUSINESS CONTINUITY MATURITY MODEL 22
2.7 SUMMARY 24 III. THEORETICAL FRAMEWORK 25 3.1 OVERVIEW 25 3.2. WORKING PROPOSITIONS 26 IV. CONCEPTUAL MODEL 28 V. RESEARCH DESIGN 29 5.1. OVERVIEW 29
5.2. DESCRIPTION OF CASE AND SAMPLING 30
5.3. METHODOLOGY FOR ANALYSIS 32
5.4. STRENGTHS AND LIMITATIONS OF THE RESEARCH DESIGN 35
VI. RESULTS 38
6.1. OVERVIEW OF RESULTS 38
6.2. SUMMARY OF RESPONSES ERROR! BOOKMARK NOT DEFINED.
6.3. BUSINESS CONTINUITY MATURITY ANALYSIS 38
6.3.1. AWARENESS 38
6.3.2. PLAN PERVASIVENESS 41
6.3.3. BUSINESS CONTINUITY PLAN STRUCTURE 42
6.3.4. RESOURCE ALLOCATION 43
6.3.5. METRICS 44
6.3.6. LEADERSHIP 45
6.4. STRUCTURATION THEORY ANALYSIS 47
6.4.1. INTERACTIVE STRATEGY 47
6.4.2. INTEGRATIVE STRATEGY 48
6.4.3. PROCEDURAL 48
VII: DISCUSSION & MANAGERIAL IMPLICATIONS 52
VIII: CONCLUSIONS 57
WORKS CITED 59
ABSTRACT
Air-cargo companies have always been subject to disruptions such as weather, demand fluctuations, and mechanical issues. But in recent years, the use of big data analytics have helped decrease the likelihood of most disruptions causing an impact on business continuity. Cargo firms operate 24 hours a day 7 days a week and rely on big data to ensure efficiency and accuracy. (Gaur, et al., 2016) But what happens if this data is suddenly no longer available? This article focuses on measuring two air-cargo firm’s business continuity plan maturity, specifically regarding data loss scenarios.
The topic of data loss has made headlines as corporations face data disruptions resulting in exorbitant harm to both profits and reputation (Powley, 2017). Therefore, this study can contribute to current research by being the first to analyze business continuity maturity as it relates to data loss in logistics and provide best practices to cargo firms.
In this qualitative analysis, both cases were measured against the Business Continuity Maturity Model. Additionally, the cases were compared to each other to analyze managerial strategies. The
research question, “How do air-cargo companies organize their firm to successfully reach data continuity
plan maturity?” is answered in three ways.
First, to increase the level of Business Continuity Plan pervasiveness and awareness throughout the firm, management must provide training and gain buy-in from employees. Secondly, a firm can increase the level of Business Continuity Plan Maturity if management initiates dialogue and cross-functional communication between IT and Operations to continually improve the Business Continuity Plan. Finally, a firm can increase the level of Business Continuity Maturity through top management committing resources and initiating actions that can be measured and repeated with practice.This contributes to existing literature by providing an initial study of data continuity maturity and best practices for air-cargo data continuity planning.
I. Introduction
Air-cargo companies have always been subject to disruptions such as weather, demand
fluctuations, and mechanical issues. But in recent years, the rise of real-time data transmission coupled with big-data predictive methods has helped decrease the likelihood of most disruptions causing an impact on business continuity. Big data analytics are used daily for everything from increasing efficiency to flight plans, cargo manifests, and customer records. (Gaur, et al., 2016) But what happens if this data is suddenly no longer available?
There are numerous ways this data can be lost. Accidental deletion, device failure, natural events, such as hurricanes, fires, or floods, can all eradicate data and cause operational
disruptions. Disruptions in logistics management are any negative effects of risk upon the normal functioning of the chain. (Vakharia & Yenipazarli 2009) So in reality, the growth of data
dependency has actually exposed firms to new and critical forms of risk and disruption. Micheal Tierie, Vice President of Transportation Management Systems at DHL,
emphasized this: “If you look at risk planning and disaster recovery…time is critical. Especially with air-freight. When speed is of the essence continuity becomes more and more critical.” Because of this, companies must ensure that they have systems in place to deal with the risk of data disruption, especially as logistics is becoming more and more reliant on data in order to function.
This rise in big data dependency is partly due to just-in-time management. This concept was originally developed in the 1970’s to decrease waste by only supplying goods, as they were needed. (The Economist, 2009) Firms across many different industries have utilized this trend in an effort to “perfect” the supply chain by staying lean and reducing waste. The drawback of this lean operating structure is there is no room for error and thus further exposes the company to
disruptions if contingencies arise. Just-in-time management magnifies the impact of even a small disruption because firms utilizing this method do not have the ability to cover potential
shortfalls. Therefore, if any disruption in the firm’s operation occurs, it can cause significant losses and reduce a company’s overall competitive advantage. (Keenan 2006)
In order to better facilitate just-in-time supply chains, business analytics technology began to develop databases. By the 1980’s, telecommunications, airlines, and financial service firms had built massive data warehouses to store vast amounts of consumer data that enabled firms to improve overall operational efficiency. Today, as technology fast approaches more real-time data analytics, logistics managers increasingly rely on these data for daily operational business decisions. (Giannakis and Louis, 2016; Watson et. al., 2006)
This knowledge can be a source of sustained competitive advantage within a firm (Kogut and Zander, 1992). In particular, understanding past trends and predicting future outcomes is a key asset for air-cargo companies. (Alavi & Leidner, 2001) As Min and Zhou (2002) state, the success or decline of a firm can depend on their ability to organize their activities and manage their knowledge. Literature has thoroughly examined how this data can increase this knowledge and lead to operational efficiency and revenue (Slager and Kapteijns, 2004; Bower,1970) but there is little to no information to assist operations managers if data is suddenly non-existent.
This year alone there have been several major data outages spanning across industries. In the airline industry, British Airways and Delta Airlines experienced massive data outages that caused losses of hundreds of millions of Euros. (Powley, 2017) These incidents have revealed that many business data management systems are vulnerable and companies may not have actionable, up-to-date plans in place to manage mass failure.
In practice, companies have vast strategic processes to manage operations. These assets require time, investment, and development as they mature. Thus, maturity models have been developed as a means to measure the maturity of various processes. (Lockamy and McCormick, 2004) Business continuity planning for data loss is one such strategic process that has not been addressed thus far in literature. The few studies that exist regarding data failure continuity plans are from the 1990’s addressing concerns about Y2K or from the 2000’s after the World Trade Center attacks. (Dawes et. al, 2002; Dimattia, 2001; GAO, 1998; Koch, 2004; Nosworthy, 1999)
In light of recent events and given that these studies are nearly 20 years old, it is certainly time to re-evaluate data-loss continuity plans. Therefore, this study can contribute to the existing literature by being evaluating current cases of data continuity planning using a Business
Continuity Maturity Model. (Tammineedi, 2010) Additionally, it will provide a benchmark and best practices for logistics firms regarding data continuity.
1.2. Method
This study will use a qualitative approach and will be exploratory and embedded in order to provide insight into human disciplines and strategy (Cassell & Symon, 2012). The study includes eight in-depth, semi-structured interviews with Operations and IT managers. By
utilizing two case studies, an assessment will be made as to whether the cases in the sample have sufficient plans in place to react to data loss, how often these plans are practiced, and how staff are trained in order to make the company more resilient to potential data disruptions.
Additionally, this study is designed to give insight cross-functionally and control for hierarchy and department. In order to do this, both IT and Operations managers were interviewed. The interviews included a data consultant, two upper managers, three middle
managers, and two ground operations managers. This allowed for triangulation of the results as comparison could be made between firms, departments, and managerial levels.
1.3. Purpose
First, this paper will outline the traditional approach to risk management and change management by surveying the existing literature. These concepts are the basis for the final theories of business continuity planning. After this, the Business Continuity Maturity Model is presented and a conceptual model is developed for analysis.
Then the case study data will be examined using the theories and the Business Continuity Maturity Model to address the key question, “How do air-cargo companies organize their firm to successfully reach data continuity plan maturity?” Based upon the findings, a proposal will be offered for an approach that combines tried-and-true continuity planning with an actionable framework specific to data loss protection. The paper will conclude with a discussion of the findings and propose recommendations for future research.
II. Literature Review
2.1. Overview
This section will provide an overview of the existing literature and theories that have led to the development of a Business Continuity Maturity Model. These theories in this section include: risk management, strategy as a process and a practice, change management and finally, business continuity management. A research gap is identified within the practical application of business continuity maturity models, particularly regarding data continuity.
Strategic management is practiced throughout industry in various forms as a way to organize a firms functions and goals (Whittington, 2000). One form of strategic management is business continuity planning. In this strategy, a firm utilizes both risk and change management to determine potential hazards to the firm and subsequently creates a plan to mitigate the impact of any potential disruption and continue business operations.
Although recent business articles have called for attention to the subject (Keenan, 2006; Ekekwe, 2014), best practices for data continuity management seem to have received little attention in scholarly research. Because there is not adequate literature on this topic in particular, studies on the practical application of continuity models for data loss are also insufficient.
Risk sources for logistics firms include risks that originate from problems with supply and demand, and those arising from disruption to normal business flow. This study focuses on the latter. (Gaci et al., 2016) Preparing for risks, particularly those with low probability but high business impact, is one of the main goals of a continuity plan. (Taneja et al., 2009)
Practitioners and scholars have broadly focused on minimizing logistical risks and disruptions through various methods because managers are increasingly aware of the effect they
have on financial performance. Hendricks and Singhal (2003) state that firms can expect disruptions to cause decreases in stock prices, sales growth and overall company value. In the past few decades, the trend towards lean supply chains has greatly decreased the amount of time a task or project can be delayed without causing significant delay to the end goal or project completion. This, in turn, has increased interdependency within the supply chain where even a small error can cause significant ripples throughout the chain.
Existing literature has identified the need for further attention to business continuity, inter-firm communication regarding planning, and leadership as well as the need for additional research to develop a structured process for managing potential disruptions. (Jüttner et al., 2003; Vakharia & Yenipazarli, 2003; Zong et. al., 2016) This literature review will examine the existing literature and identify the gaps in research on the subject of disruptions and risk in logistics, change and business continuity management.
First, it will examine the literature on risk management, which is one aspect of managing disruptions in an air-cargo company. Risk management must be understood in order to
appropriately plan for and mitigate disruptions. Second, strategic management theories are examined as the foundation for the third section, change management. Finally, an overview of business continuity management is outlined and various models for analysis are presented.
2.2. Risk Management in Logistics
Preparing for risks, particularly those with low probability but high business impact, is one of the main goals of a continuity plan. (Taneja et al., 2009) In general, “Risk is the chance, in
quantitative terms, of a defined hazard occurring…” (The Royal Society Study Group, 1992) Hazards can be unknown deviations or disruptions that affect the flow of products or information
throughout the organization. (Juttner, et al., 2003)
Disruptions in a supply chain can cause enormous ripples throughout an organization. Supply chains are a grouping of activities or actors that create and deliver a product or service to supply a demand. One of the key actors in this chain are logistics firms who manage the flow of goods and services from the point of origin, to the consumer, and back. An effective logistics firm must react to customer needs while also reducing production, warehousing, and distribution costs. It must also effectively integrate the coordination between information and financial flows. (Gaci et al., 2016)
Gaci et al. (2016), identify two broad categories of risk sources for logistics: risks that originate from problems with supply and demand, and those arising from disruption to normal business flow. As previously stated, this study focuses on the latter. These disruptions can be caused by both internal and external elements that create scenarios too great for the logistics chain to handle.
Brindley (2000) identifies several potential sources of disruptions in the logistics chain: staff, facilities, raw material availability, and finally data availability. The study goes on to identify potential outcomes of these occurrences, namely, loss of brand image, loss of revenue, and loss of competitive position. These risks are very real concerns for business managers today. Data availability in particular is critical to logistics. During the exploratory interviews, when asked how dependant their firm was on their data systems, a respondent replied, “These days it’s 100 percent. As soon as the system stops we have direct impact. Small or big. That’s also why we have we have many business issues.”
Some risks and disruptions in logistics have been widely studied. Risks that can potentially disrupt the chain include some that are unavoidable but predictable such as
hurricanes, winter delays, etc.; and others that are less predictable for example, trade regulation changes or political unrest. The results of these risks can have extreme consequences for industries and firms.
Juttner, Peck & Christopher (2003) found that there are three categories of risks for firms: environmental, network, and organizational risk sources. Commonly used logic diagrams are used for researching the cause and effect relationship of such disruptions, the “fault tree analysis” (FTA) and the “event tree analysis” (ETA). The first (FTA), identifies all of the potential events leading up to a system failure or disruption. The second (ETA), focuses on the potential consequences and outcomes after a disruption occurs. (Norrman & Jansson 2004)
A ten-step supply risk assessment process for identifying and managing risk was then developed. First, one must identify the material or service, and appoint a manager as a process owner. Next, create a risk assessment scorecard based upon the risk factors: design, cost, legal, availability, manufacturability, quality, supply base, environmental, health, and safety impacts. Analyze each factor and assign the risk scores for the impact analysis. Document the analysis and course of action to be taken then monitor the process. Finally, determine it is sufficiently assessed. (See Figure 1)
Figure 1. Norrman & Jansson, 2004
As with the previous model, a typical method for risk analysis per Gaci et al. (2012) begins with identifying the probability of a disruption occurring and the intensity of its effects.
Then the vulnerability of each business process impacted by these effects is analyzed. After this analysis, non-significant risks are discarded and thus major risks are identified. (Gaci et al., 2012) These types of analyses are the primary step in any continuity plan.
Due to the vast array of environmental hazards, networks, and organizational structures, risk assessment becomes a challenging ordeal. However, it is necessary to identify critical risk factors and then structure the firm to reduce vulnerability and absorb potential disruptions. In the next section, firm managerial strategies towards risk management and continuity will be
analyzed.
2.3. Managerial Strategies to Create a Resilient Firm
In terms of risk, the overall strategy of a firm “can either absorb or amplify the impact of events arising from environmental or organizational risk sources…” (Juttner, Peck & Christopher, 2003) Therefore, it becomes imperative to analyze the nature of the firms overall managerial strategy towards potential risks.
A plethora of frameworks exist to design the flow of an organization. These can include a more overreaching process or one specific to practical implementation. Rosemann and vom Brocke (2015) proposed that business processes should not consist of a number of steps, rather, a continual process should be created and transformed into a unique capability set. They suggest that there are several factors that can make the business process successful in mitigating disruption. These factors are governance, people, firm culture, strategic alignment, and IT.
When dealing with these factors, there are two strategic managerial approaches that can help mitigate disruption: practice (hard) vs. process (soft) (Whittington, 2000). Process strategies focus on the sociological or soft aspects of strategy. Researchers of strategic processes tend to focus on various actors and their relationship to organizational and economic outcomes.
Conversely, forming strategic hard practices such as IT analyses or technological software solutions are specifically designed to analyze the input and create an improved output. Practice researchers place high emphasis on these specific tools as a means to an end for
improving a specific problem area whereas pure process researchers do not place high emphasis on these hard practices as they are merely a small part of the overall goals of the organization. (Whittington, 2000)
Some researchers recommend using a combination of these two strategies because different firm activities dictate different measurements and focus. To understand why there are differing strategic methods, one must understand that there are various ways to measure performance. The first is by measuring a particular practice’s impact on organizational results (procedural outcomes). Second, by measuring the level of performance of the practice while in use (social observations). The third is by measuring the widespread adoption of the practice throughout the firm (policy pervasiveness). (Whittington, 2000)
Jarzabkowski (2008) examined “structuration” theory, which combines aspects of both practice (hard) and process (soft) methods. He begins with the idea that individuals produce and reproduce the social structures of their institutions (norms, beliefs, interests, etc.). This
phenomena, although initially formed by individual actors, disassociates over time from those individuals and becomes a part of the overreaching social order of an organization. Although this social order guides actions, actors are still reflexive and able to act against the institutional norms or react to procedural changes. Jarzabkowski (2008) outlines three ways managers can
potentially affect change in their organization. These methods are procedural (changing policies), interactive (active communication), and integrative (changing institutional structure).
Procedural management changes policies and creates recurrent processes through leadership, committed resources, and the use of administrative metrics such as budgets, performance charts, etc.(Burke, 2018) Top managers must embed these into the corporate strategy and targets in order to have overreaching results across the organization. These types of “ domination” strategies help to create and change patterned behavior. (Jarzabkowski 2008) Whittington (2000) cautions firms not to rely solely on the widespread use of hard strategic practices (such as annual audits, SWOT analyses, and reports), as they have the potential to only microscopically change an organization.
While implementing new processes and procedures, Interactive strategy encourages simultaneously interacting with members of the firm to persuade them that certain courses of action are desirable. In theory, this helps to change the fundamental institutions by changing the mindsets of the actors. (Jarzabkowski, 2008) It has been shown when there is communication within a department the actors are more likely to buy-into new strategies and the plan is more likely to dissipate throughout the department. (Somers and Nelson, 2001; Ahmad and Cuenca, 2001) Additionally, studies indicate that overall levels of awareness increase because employees practice and create new habits and relevant skills. (Burke, 2018; Wilson and Hash, 2003)
Finally, Integrative strategy attempts to change the behavior of the actors through interactions and simultaneously changing policies and procedures to create ones that can be measured and maintained. The procedures are often modified based upon the feedback of the actors through their interactions with top management. By involving various actors in the creation and maintenance of the new procedures through interaction and legitimacy, change can be managed. (Jarzabkowski 2008) This strategy encourages inter-departmental interaction and
dialogue with management by recombining capabilities. Often firms create task forces or teams dedicated to improving a specific business function. (Kogut and Zanders, 1992)
2.4. Change Management
The previous section outlined several ways in which an organization can approach strategic management. However, a firms strategy must also be flexible and able to adjust to organizational and external changes that occur frequently with technology. Therefore, it is important to
understand the nature of change management. Change management is the foundation of an effective business continuity plan as it is the strategic way in which the organization manages changes and minimizes the chances of disruptions occurring.
Even incremental changes in an organization, particularly in a data system, can have significant impacts on operational functions. Software and data systems are continuously updated and thus continuously exposed to risk. A documented procedure for strategic change
management can help to reduce the risk of disruptions by anticipating the effects of the change within the organization in a controlled manner. (ENISA, 2016)
Director Exploitation Management, KLM stated:
“Basically we want to eliminate the amount of changes we put in process applications because every change of the application is a risk. So if something is working and you don’t change it probably keeps working but if you change something to upgrade new code or whatever. It’s a risk.”
Change management has its roots in the theories of strategy as a process. Strategic processes have examined the relationships between a firm’s structure, activities, and the context of the organization (Bower, 1970). Later scholars have indicated that in addition to these factors, external influences of political, cultural and social factors also have an impact upon strategy
formation, change, and implementation (Johnson, 1987). These external factors serve as a control mechanism for the organization’s strategy and any member’s future contributions. (Jarzabkowski, 2008)
Kuipers et al. (2013) determine three aspects of organizational change: context, content, and process. Context refers to the firm’s internal and external environment. Content refers to the firm’s overall structures, systems, and methods. Finally, process refers to the interventions and procedures that bring about the change.
Many scholars cite the need for top managers’ focus on change in order for it to succeed. However, (Jarzabkowski, 2008) states that there is a paradox with top managers ability to control contextual structure. Once these managers embed a certain strategy within the firm, it can be difficult to change. Once structural context is institutionalized as a piece of the organization’s processes a strong precedent is created and it is unclear how much top management support can alter deeply embedded contextual habits.
Organizational change management is considered to be a vital aspect of any firm’s strategic plans. It can maximize the benefits for all the stakeholders as well as retain the sustainability of strategic processes. Many associate change management with employee’s anxiety, uncertainty and ultimately resistance to change. (Kazmi et al., 2014) Barley & Tolbert (1997) state that for organizational change to occur, existing contextual institutions must be interrupted in order for new methods to be internalized (Jarzabkowski, 2008). The new processes must be adopted collectively and have a repetitive pattern that can be replicated over time.
Generically, there have been several major change models developed for organizations. The key aspects of most plans include: documented change procedures, duty assignments, quality control, practice, and testing. (Norman, et al. 2009) One popular change management
model known by the acronym ADKAR, was developed specifically to help people internalize new methods. It stipulates that the individual must have awareness of the need for change, the desire to uphold the change, the knowledge of how to change, the ability to replicate the new changes, and reinforcement to make lasting change. (Boca, 2013) Many change management models have been based upon this theory, including many business continuity planning strategies.
2.5. Theoretical Approaches to Business Continuity Planning
As previously stated, changes to an organization’s structure or systems can expose a firm to risks. Although change management can help an organization reduce the likelihood of risks occurring, it can never eliminate them. Thus, business continuity management (BCM) combines elements of risk management and strategic change management in order to mitigate the effects disruptions and ensure efficient business continuity and recovery of key data. (Swansen, 2010) The Business Continuity Institute further describes BCM as, “A holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience with the capability for an effective response that safeguards the interests of key stakeholders, reputation, brand and value creating activities.” (BCI, 2007)
Swansen et al. (2010) states that even nowadays information systems are quite vulnerable to things such as power outages, drive failure, etc. These risks can often be minimized by
Therefore continuity planning is essential to mitigate the effects of risk on a firm and provide effective means to minimize system unavailability.
Generally, there is agreement about the need to mitigate the effects of risk among
scholars and practitioners, however, there are differing opinions on how to handle it. These plans are crucial to any managerial strategy as a firm must prepare for potential disruptions. After a firm can successfully identify an effective plan to reduce risk in their data supply, decisions can be made mitigate the effects of potential disruptions if they do occur.
One method called adaptive policymaking, initially developed as military strategy, is a structured but adaptive step-by-step approach. Adaptive policymaking acknowledges that making a continuity plan is not a one-time initiative but a continuous process to deal with disruption. This type of adaptive plan has the ability to change depending on the circumstance whereas a robust plan can perform in many situations. (Taneja et al., 2009)
Kotter (1996) developed one of the earlier continuity management models. This model included eight parts that were essential for success: instill a sense of urgency, build a guiding coalition, create a vision and supporting strategies, communicate with team members to create trust, remove obstacles, create quick wins, keep on changing, and make the changes stick.
Organizations often assess success of their continuity plans by querying if the plan worked as intended or if it “passed” or “failed”. However, Holt (2001) advises that practice exercises should be conducted with an emphasis not on passing or failing but discovering what works and what does not. (Holt, 2001) This allows for continuous improvement and also identifies any areas of vulnerability.
Holt’s study states that not only must a business continuity plan be unique to each organization but it must also include a clear element of assessment, or a benchmark for success.
Holt states that, “Before organizations measure anything they need to work out what success looks like, so they have a benchmark and an objective to aim for.” Therefore, the firm must first conduct an assessment of their critical activities and breaking them into components, metrics can then be added for maximum quantifiable success or failure. (Holt, 2001)
This assessment can be complex but it is important to find the sources of risks in order to react appropriately when they occur. It has become necessary to put in place data analysis teams and find new methods for organization and application of the information. (Hazen et al. 2014) Research in this area is severely lacking particularly in regards to the practical application and regular upkeep of continuity plans within corporations.
Holt (2001) states that the business impact analysis can then form the basis for a
continuity plan based upon those activities that warrant the most protection. This analysis would address the critical areas of concern and how they can be both protected and efficiently reinstated in case of a disruption. The plan then should bring together those responsible for each critical activity to ensure understanding, participation, and cooperation in the planning phase. (Holt, 2001)
According to Mintzberg and Waters (1985), if an implemented strategy is enacted precisely as it was intended to be it is considered “deliberate” whereas a strategy is considered to be “emergent” if the strategy was not what was originally planned but due to unforeseen developments the firm must change its original plan. Therefore, it is important to both develop said plan as well as practice it to ensure viability.
Although potentially applicable, none of these studies directly address continuity planning regarding data loss in business. Watson et al. (2006) states that solutions to data disruptions will require flexibility on the part of a firm and a well-devised plan that can handle
real-time strategic reflexes in response to disruptions. They state that “in many companies, the operational and decision support systems are ‘islands’” that share a pool of data but utilize different employees, criterion and processes to analyze the data. (Watson et al., 2006)
Li et al. (2015), states that academic research regarding data loss is “extremely valuable and pressing” and identified three existing applications of big data, one of which is the
connections between logistics management and big data. Research has shown that these processes can yield predictive outcomes and lead to a reduction of risk in the chain. However, they do not yet indicate whether businesses effectively have plans in place to react if these systems were to fail.
Some studies on the subject of business continuity have been developed for government use (Wilson and Hash, 2003; Swansen et al., 2010). One study by Swanson et al. (2010) outlined an approach to data continuity planning that was designed for the United States Federal
Information Systems. However, as the author states, this approach could theoretically be applied to corporations as well. Their seven-step continuity plan begins with developing a planning policy statement, this provides formal guidance and authority from top management. Second, the business impact analysis should be conducted in order to prioritize critical business functions. Third, preventative controls must be identified to reduce the likelihood of a disruption.
Fourth, recovery strategies should be created to ensure the business function can be back online quickly with minimal damage to business or reputation. Fifth, the information system continuity plan should be developed to measure the impact of the disruption on security and data loss. Sixth, the plan should be tested and practiced in order to validate the plan’s effectiveness, identify any gaps, and assess the organization’s overall level of preparedness. Finally, the plan
must be maintained as a living document that is regularly updated to reflect system updates or organizational changes. (Swanson et al., 2010)
2.6. Business Continuity Maturity Model
Capability maturity models have been used as the standard for measuring a firm’s performance level in a functional area. They typically are guides with criteria to assess a particular functional efficiency based on pre-defined levels. Each level has its own requirements that a firm must meet and describes how the firm can achieve higher levels. (Randeree, 2012) There typically are two types of maturity models according to Randeree (2012), process-based and operational-based. The first is similar to strategy as a process (Whittington 2000) in that it focuses on control and documentation, the second is more holistic focusing on overall organizational change.
Norman et al. (2009) identify key aspects of timely data recovery. It states that several key components are necessary: a written continuity plan that is up to date, the pervasiveness of the plan, existence of offsite storage for the plan and data, and finally regular testing of the plan. Herbane et al. (1997) stated in their study regarding business continuity implementation, that if managers or subordinates lack awareness of the business continuity plan, it is likely that they will not respond appropriately in the event of an incident. These aspects are also reflected in the Business Process Maturity Model (BCMM). (Tammineedi, 2010)
The Business Continuity Maturity Model includes several aspects: Leadership,
Awareness, Business Continuity Plan Structure, Program Pervasiveness, Metrics, and Resources. Per the authors, leadership buy-in is essential to an effective business continuity plan. Without this, the authors theorize that the plan will not be appropriately scaled to include the entire organization but consist of disjointed efforts. (Tammineedi, 2010) Additionally, leadership is
need to appropriate resources and assign metrics to the organization (Burke, 2018). Awareness is also essential for the staff and management (Tammineedi, 2010)
FIGURE 2– BUSINESS CONTINUITY MATURITY MODEL (ADAPTED FROM TAMMINEEDI, 2010):
Business Continuity Maturity Model Levels
Level 1 Self Governed Level 2 Departmental Level 3 Cooperative Level 4 Standards Competence Level 5 Integrated Level 6 Synergistic
Comparative Model Organization “At Risk” “Competent” Performance Best of Breed
Corporate Competencies Attributes of Organization at Each Maturity Level
Leadership VL L M MH H VH Awareness VL L M MH H VH BCP Structure VL L M MH H VH Program Pervasiveness VL L M MH H VH Metrics VL L M MH H VH Resource Commitment VL L M MH H VH
FIGURE 3– BUSINESS CONTINUITY MATURITY MODEL CODE ATTRIBUTES (TAMMINEEDI, 2010):
Maturity Level Code Maturity Level Code Attributes
VL Very Low: Aspect not recognized by senior management as strategically important
L Low: A business unit has begun efforts to increase BCM awareness - state of preparedness remains low.
M Medium: Several business functions have an established BCP and some support from the senior management with moderate levels of preparedness.
MH
Medium-high: Senior management understands the importance BCP and is pursuing it through strategy and new processes across the firm. The critical functions are known
H High: All critical functions are identified & actively practiced & updated BCP in place. Sr. Management initiates regular training & communicates importance throughout firm.
VH
Very high: Synergized BCP strategies are made and tested by all business functions. External and internal functions are coordinated, practiced, and updated regularly to
provide a superior state of preparation.
2.7 Summary
Previous literature confirms that having effective strategies regarding risk management and change management can improve a firm’s overall ability to avoid risk, and in this case, data loss. However, overall there are very few studies on the level of organizational preparedness for implementing continuity plans after data loss occurs. On this topic, business continuity literature has focused primarily on IT systems recovery and less on the human contributions during plan implementation. (Herbane et al., 1997)
Additionally, the majority of existing studies on this subject address disaster recovery but not specifically data loss. These studies are outdated since organizations now rely on complex and overreaching data systems. The purpose of this research is to examine the effectiveness of planning as it relates to data continuity.
The change management strategies that are presented have various levels of effectiveness depending upon the overall structure and nature of the firm. Although the idea of continuity planning regarding data has been briefly touched on in literature, it has not been readily applied to a business case. Therefore, in the next sections, this thesis will present a theoretical
framework and a conceptual model for measuring a firms overall maturity regarding business continuity.
III. Theoretical Framework
3.1 Overview
This section will develop a theoretical framework by combining the Business Continuity
Maturity Model with aspects of strategic and change management. In particular, Jarzabkowski’s (2008) theories regarding strategizing behavior of top management and their focus upon various results.
Sirkin, et. al (2014) challenges that literature in recent years has focused too much on so-called “soft issues” such as leadership, culture, and employee motivation. They state that while these issues are important they are not sufficient to implement transformation or create lasting change within an organization. They state that it isn’t easy to change attitudes or the institutional atmosphere. Therefore, hard factors such as metrics, firm benchmarks, and firm-wide strategic changes should also be used because they are measurable, able to be communicated, and able to be quickly implemented. This study argues that it is a combination of both soft and hard issues that truly produce business continuity plan maturity.
Research into structuration theory states that the combination of strategic processes, governance, and institutions guide actions within the firm. However, this does not ultimately determine specific outcomes as individual agents still possess the capacity to choose to act against the norms and mores. (Jarzabkowski 2008)
So how can a firm determine the best managerial strategy to successfully attain data continuity plan maturity? In this study the Business Continuity Maturity Model will be used to measure each firm’s level of maturity as a starting point. As stated in the previous section, the Business Continuity Maturity Model includes six aspects: Leadership, Awareness, Business
Continuity Plan Structure, Program Pervasiveness, Metrics, and Resources. Next, the strategic aspects of structuration theory (interactive, integrative, and procedural) will be examined to see whether these three types of managerial styles have an influence on the various levels of maturity for each firm.
3.2. Working Propositions
The first managerial strategy that will be tested will be Interactive strategy. This strategy encourages simultaneously interacting with members of the firm to persuade them that certain courses of action are desirable. In theory, this helps to change the fundamental institutions by changing the mindsets of the actors. (Jarzabkowski, 2008) This strategy can improve plan pervasiveness and awareness by increasing the level of coordination between various business functions and departments. Including multiple disciplines enhances the degree to which a cohesive continuity plan can been integrated and understood in each unit. (Kogut and Zanders, 1992)
This leads to working proposition number one:
WP1: In order to advance to another level of program pervasiveness and awareness, management must adopt an interactive strategy thereby through practice and gaining buy-in from employees.
The second strategy to be examined is integrative strategy. This strategy attempts to change the behavior of the actors through cross-functional interactions while simultaneously changing policies and procedures to create ones that can be measured and maintained. The procedures are often modified based upon the feedback of the actors through their interactions with management and other departments.
By involving various actors in the creation and maintenance of the new procedures through interaction and legitimacy, change can be managed. (Jarzabkowski 2008) Business continuity structure refers to scale of the program and whether it is dynamically integrated throughout the firm’s various processes.
This leads to working proposition number two:
WP2: In order to advance to another level of Business Continuity Plan Structure maturity, management must adopt an integrative strategy, which initiates
cross-departmental communication to continually improve the Business Continuity Plan (BCP). The final strategy is procedural where management changes administrative procedures and
creates recurrent processes. These can include the use of administrative measures such as
budgets, performance charts, etc. Top managers must embed these into the corporate strategy and targets in order to have overreaching results across the organization. These types of “
domination” strategies help to create patterned behavior. (Jarzabkowski 2008) This leads to working proposition number three:
WP3: A firm can only create sustained maturity through top management procedural leadership strategies shown by committing resources and initiating actions that can be measured and practiced.
Metrics are developed through quantifiable criterion to ensure on-going tracking and competency goals. Resource commitment is shown by skilled and supported staff, financial resources, etc. to ensure long-term functioning of the plan. Finally, leadership is shown by the commitment and dedication of top management to develop a companywide plan and ensure the support is in place for the plan to be understood and followed. (Tammineedi, 2010)
IV. Conceptual Model
The working propositions set out in the previous section were formulated from professional literature and experience through exploratory interviews. To review the research question and working proposition are as follows:
RQ: How do air-cargo companies organize their firm to successfully reach data continuity plan maturity?
WP1: In order to advance to another level of program pervasiveness and awareness, management must adopt an interactive strategy thereby through practice and gaining buy-in from employees.
WP2: In order to advance to another level of Business Continuity Plan Structure maturity, management must adopt an integrative strategy, which initiates
cross-departmental communication to continually improve the Business Continuity Plan (BCP). WP3: A firm can only create sustained maturity through top management procedural Leadership strategies shown by Committing Resources and initiating actions that can be Measured and practiced.
The competency levels defined by the Business Continuity Maturity Model will be used to gauge each firm’s level of maturity and the amount of focus each manager places on each of the six aspects. The conceptual framework shown below reflects the research question and working propositions by showing the levels of synergy within a firm that result in positive or negative effects in the search for business continuity maturity.
The first element of Awareness refers to when each level in the hierarchy is aware of and understands the plan procedures and has interaction with the plan. The Business Continuity Plan (BCP) structure must include various hierarchies. The Business Continuity Plan must also be pervasive meaning the plan is understood and coordinated across several business functions. It must be dynamic in the sense that it can adapt and fluctuate easily with organizational changes.
The modifier, top management support, equates to senior management recognizing the Business Continuity Plan (BCP) as strategically important. In turn, they allocate resources, recognize the BCP throughout the firm, and provide strong leadership. They also establish metrics used by each business function to determine the level of success.
The next section will first form an overview of the research design. Then the description of the case studies, methodology, strengths and limitations are examined.
V. Research Design
5.1. Overview
The literature review outlined the major theories surrounding business continuity management and change management. In order to develop an effective framework and answer the research question the Business Continuity Maturity Model (BCMM) was used as a tool (Tammineedi,
2010). This model will be used to determine best practices and which strategic methods influence business continuity maturity.
Although this model can be easily applied, there is a significant lack of testing of data continuity maturity in literature making it difficult for practitioners to gauge their firms’ preparedness in this area. In this study, two air-cargo companies will be examined using the Business Continuity Maturity Model (BCMM).
A qualitative method was used for this research. This method differs from quantitative methods in several ways. Qualitative research allows for exploratory questioning and enables the discovery of unexpected causalities, which may not be obvious through other methods.
Quantitative methods, in contrast, utilize fixed hypothesis and numeric measures to explain phenomenon. The qualitative method allows one to understand results in context and how each firm’s strategy, institutions, and the interactions of the actors affect the outcome. One is able to see the issue from the point of view of individuals within each firm. (Bryman, 1984) Also, being on-site allowed strategy behaviors to be observed first hand which helped to understand the case data.
5.2. Description of Case and Sampling
This research will go in depth to cross-examine air-cargo companies, DHL and KLM Air France (KLM/AF) Cargo. This will be an empirical study to closely determine the functionality of their continuity plans; specifically how their existing development phases and strategic methods contribute to the success of their data continuity plan. The case study will examine the in-depth dynamics of a very complex and real phenomenon in order to understand the situation in detail.
(Yin, 2015) This case study will be both embedded and exploratory and will therefore be helpful for testing previous the theoretical concepts outlined.
These units of analysis (KLM/AF and DHL Cargo) were chosen because they are two large multinational corporations within the air-cargo industry. As stated previously, air-cargo is especially dependent on data for everything from flight plans to warehouse management. If any critical systems fail, operations are halted and both money and reputation can be quickly lost. Therefore, business continuity plans are essential to operations.
Research results were acquired through several methods: primary data from interviews and observations and secondary data from existing literature, publications, and prior research. For this study, I was granted the unique privilege of interviewing several members of DHL and KLM/AF management. Research took place in person at company facilities or via phone when distance was an issue. Case respondents were then selected from across their hierarchy in order have a cross sectional view of both KLM/AF and DHL separately. This was done to gauge how knowledge differs and pervades from managers to staff and also between the IT and Operations departments. The respondents included upper management, middle management, and ground operations managers.
The interviewees were chosen from upper management who work cross-functionally with both Operations and IT; middle management from Operations or IT; and Ground Operational Managers. Additionally, the individuals were chosen because they had lengthy experience in each company (on average more than ten years) and were aware of both past and present data continuity efforts.
Initially, an exploratory interview was conducted with a consultant whose expertise includes change management and providing digital strategy support. This was done to get a
better understanding of the subject as well as the challenges companies face in practice. After that, seven managers from within two air-cargo firms were interviewed. All interviews were semi-structured. This allowed the study to be consistent but also flexible in order to gain more in-depth knowledge. Management also received more theoretical questions and questions regarding overall company procedures as well as questions that aimed for practical
implementation and understanding. The topics included the overview of the continuity plan, employee understanding, testing and updating procedures, and the metrics of the plan’s success. The literature that was used included scholarly research established for strategy implementation, operational training, and business continuity management.
5.3. Methodology for Analysis
Within the Business Continuity Maturity Model (Tammineedi, 2010), there are six detailed levels of maturity (see figure 2) that allow managers to gauge the level of preparedness within the organization. The maturity levels of each competency (Leadership, BCP Structure, Metrics, Plan Pervasiveness, Resource Commitment, and Awareness) are measured on a six-point scale with one representing very low and six representing very high. Levels one through three indicate insufficient preparedness and incomplete program basics needed to support a mature BCP. (Tammineedi, 2010) Levels four through six indicate a maturing organization which needs continual support in order to advance and maintain maturity. (Tammineedi, 2010).
The primary interview was conducted with Consultant and Founder of Digital Shapers, Marelle van Beerschoten, whose expertise includes providing digital strategy support and change management for firms. This was done in order to gain a preliminary understanding of change
The subsequent interviews were with individuals within two large air-cargo companies, KLM/AF and DHL, at various levels of hierarchy from within Operations and IT management. The interviews were each approximately one hour long and were conducted in-person with the exception of one that was conducted via phone due to distance.
All interviews were recorded with permission and transcribed for data analysis and comparison (Yin, 2009). This allowed for accuracy and potential triangulation of responses (Eisenhardt, 1989). Codes were created to align with the eight key factors in BCMM. The responses were evaluated using the criterion from the Business Continuity Maturity Model.
Table 1: Overview of Interviewees
Company Industry Employees Title
Consultancy Digital Training NA Founder/CEO
Airline Company
Logistics 200,000+ Vice President of TMS Applications Airline
Company
Logistics 80,000+ Director of Information Management Airline
Company Logistics 80,000+ Director Exploitation Management Airline
Company
Logistics 80,000+ Business Improvement Project Manager
Airline
Company Logistics 200,000+ IT Project Delivery & Program Manager Airline
Company Logistics 80,000+ Import/Export Warehouse Manager Airline
Company Logistics 200,000+ Ground Manager
NVIVO 10 was used to analyze the qualitative data. Utilizing a cross-case analysis as well as inter-case analysis (comparing hierarchies and departments), one can better see the results of the responses (Yin, 2009). Yin (2009) states that these sorts of tables can provide a uniform framework in order to display qualitative data and potentially reveal patterns or relationships between the responses. The codes were developed using the Business Continuity
Maturity Model. The response data was divided by the primary codes and secondary codes and then divided into categories (Pratt, 2009).
Three strategic methods were used as preliminary codes: procedural, interactive, and integrative. The preliminary codes were then divided into secondary-codes from the Business Continuity Maturity Model. Procedural strategy included: leadership, metrics, and resource allocation. Interactive strategy was divided into secondary codes, awareness and plan
pervasiveness. Finally, integrative strategy was further coded as Business Continuity Plan (BCP) structure. A few further codes were added as the analysis progressed in order to highlight themes or discussion points. Table 2 (below) includes an overview of the main codes.
After coding the interviews, NVIVO 10 was used to outline the most important quotes in a table in order to determine similarities between the responses. In the result section there is a summary of the results divided into very low or low maturity (level one and two),
medium/medium high maturity (level three and four), and high and medium-high maturity (level five and six).
Table 2. Overview of Main Codes
OVERVIEW OF CODES STRATEGIC METHOD (PRIMARY) CORPORATE COMPETENCY (SECONDARY) PROCEDURAL LEADERSHIP METRICS RESOURCE ALLOCATION INTERACTIVE AWARENESS PLAN PERVASIVENESS INTEGRATIVE BCP STRUCTURE
5.4. Strengths and Limitations of the Research Design
The quality of the study is ensured through four tests of validity: external validity, internal validity, construct validity, and reliability. (Yin, 1984) Construct validity verifies if the study is measuring what it is intended to measure. (Yin, 1984) To ensure construct validity, multiple sources were used for the analysis including interviews and scholarly publications. Additionally, the conceptual model was followed to determine the results. To allow for in-depth responses, respondents were questioned using semi-structured interviews and open-ended queries. This was validated by the results being substantiated by multiple actors.
Soy (2015) states that the more a study can replicate the same findings in different circumstances the more external validity exists. In order to ensure external validity or generalize
the results, the cases were specifically selected to clearly correlate to the study. The results of the study were based upon the theoretical framework provided above and two cases were used creating more variations. Although two cases were examined using a small exploratory sampling, the results became consistent after only a few interviews.
Internal validity is important in exploratory research. Internal validity shows whether there is a correct causal relationship or if there are methodical errors that lead to inconclusive correlation. Internal validity can be found through patterns in qualitative results (Yin, 1984). During an exploratory study, the researcher infers correlation based upon past information, in this case, interviews. Therefore, with permission from the interviewees, the interviews were also recorded, transcribed, and coded. This was done to compare the responses to each other and to the working propositions to determine if they resulted in cross verification or triangulation. (Yin, 1984)
Reliability of the research is the overall goal of any study. This can be shown by another researcher is able to replicate the research and come to the same results (Yin, 1984). In order to ensure reproduction, this study records all the steps that were taken in order to come to the final conclusions (Cassell & Symon, 2012). Additionally, the respondents were interviewed alone and encouraged to answer freely reflecting on their own experiences. The study is comprehensive and cross functional, examining several departments and levels of hierarchy. All of these factors increase the likelihood of the results being repeatable and therefore, reliable.
The results of the study are limited to the comparison of two cargo companies and the results indicate that further investigation into this subject is needed. Additionally, this study also did not attempt to test or implement the business continuity plan nor did it attempt to perform a
quantitative analysis. Both could be areas for future research. Instead, qualitative research was done in favor of exploring a new research area and finding in-depth best practices applicable to other firms in this sector.
VI. Results
6.1. Overview of Results
This section first analyzes the two cases independently of each other against the Business Continuity Maturity Model and gives an average score for each based upon capability. The capabilities are scored by level of maturity ranging from very low to very high.
In section 6.3, these cases are again measured independently against the structuration theories in order to assess whether the various strategies contribute to increases in plan maturity. The working propositions are assessed and a discussion and comparison of the results follows.
6.2. Business Continuity Maturity Analysis
In this section, the Business Continuity Maturity Model capabilities will be analyzed in order to determine each firm’s level of data continuity plan maturity. It will be structured as follows: Awareness, Plan Pervasiveness, Business Continuity Plan Structure, Resource Allocation and Metrics.
6.2.1. Awareness
Awareness is essential for staff throughout each hierarchy level. It begins with having ongoing training and practice. Training can “demonstrates relatable disruptive events and how each team member can contribute to resilience and recovery.” (Tammineedi, 2010) Founder of Digital Shapers, Marelle van Beerschoton, deals specifically with change management and effectively creating strategies for coping with awareness. She stated that,
“You really need to start with understanding. It’s usually what I notice. Whenever plans are not communicated well or not even drafted well, then it usually starts even at the management level that they have insufficient skills to be able to get the plans executed.” She continued by stating that in her experience, any resistance to change normally does not come from unwillingness to change, rather it occurs when the employee or manager lacks
understanding or is not an active part in of the changes that are happening.
Per the Business Continuity Maturity Model, Awareness refers to the level of
understanding of staff of each level of the firm. (Tammineedi, 2010) Awareness was measured with two factors: the respondent’s ability to identify an alternative course of action in the case of a disruption and their ability to locate the continuity plan instructions (with the assumption that an alternative course of action would be listed for them to follow).
Within KLM/Air France, all respondents indicated that business functions could still be operated for varying amounts of time with a “workaround” or a temporary alternative method. In most business functions investigated, there existed a plan for employees that included alternative courses of action to take in order for business to continue while the incident was being rectified. In such cases, however, a workaround was not intended as a permanent fix and the problem still needed to be ultimately fixed by the IT department or external service providers.
For example if the cargo acceptance system is down, the employees can do one of two things. Either they can accept cargo on a duplicate program, which will then sync with the normal program when systems are back, or, they can manually track incoming cargo for a given period of time. The level of awareness in this business function was very high due to a continual process of system updates that occur each week during their evening shift. Each employee is therefore trained to handle the workaround.
However, there lacked consistency with awareness throughout different business
functions. The level of maturity varied drastically by business function. Some business functions had a very high level of understanding of the workaround needed for their critical functions while others had incomplete or outdated plans that were not easily located.
In contrast, DHL management and employees were almost completely dependent upon their IT department and service providers to fix an issue. Several questions were asked to gauge their ability to react to data loss, but none of the respondents indicated having an overreaching plan in place that included alternative workarounds for operations continuity. Rather, each manager focused solely upon their technological backups and expected Service Level Agreement (SLA) timeframes.
One DHL manager stated,
“I've seen many instances where service disruptions. They [IT] are usually not very well prepared and they kind of depend on everything working. So whenever something
happens and in terms of IT doesn't work or the system doesn't work, the pressure shifts to fixing the problem rather than kicking in the backup process to make sure that you process your shipments. Of course they try to do whatever they can. You see the dependence on the technical part is very high.”
For this competency, KLM/Air France scored on average a medium level of maturity. The levels of preparedness and employee understanding varied drastically throughout the firm. While one manager who was directly in charge of working on changes to the Business Continuity Plan could identify where to locate the plan his direct subordinate could not. However, there were efforts in place to build an employee training program and coordinate efforts to improve the plan with the help of operational staff and managers.
DHL scored on average “Low” indicating that they have some efforts in place to increase business continuity awareness however their awareness is low due to the lack of training and
encouragement from management to depend on the IT department and wait for a resolution. There was also no indication of a training program to make employees aware of processes.
6.2.2. Plan Pervasiveness
Managers from both firms indicated that the primary cause of data failure was human error. it would follow that creating plans and training for the entire firm would both help to avoid risk and mitigate disruption. Founder of Digital Shapers, Marelle van Beerschton stated,
“We work a lot with people from different silos because that’s obviously a big problem as well. People need support from other departments. So the basic level of understanding is necessary of other departments too. Because they play a role in the same process.” Both KLM/AF and DHL did, to some extent, have coordination across their operations and IT departments in that they both have similar escalation matrices for their critical systems. The employees are expected to submit issues first to their department’s duty cargo manager. Then if the duty cargo manager is unable to solve the incident, the IT department is to be contacted. The incident is categorized based upon how many users are affected and how critical the business function is that is offline.
While DHL management recognized that integrating a plan across multiple disciplines is important, they indicated that in a large organization with many different business applications it is difficult to do so. This supports Watson, et. al. (2006) findings: “in many companies, the operational and decision support systems are ‘islands’” that share a pool of data but utilize different employees, criterion and processes. (Watson et al. 2006)
However one DHL Ground Manager stated,
“We always had a problem in making sure that everybody's up to date with whatever is going on especially in a big organization. So that's basically our best way of getting
things together; to involve multiple disciplines; to make sure that everyone is in line with what's going on here.”
Both companies did have plans in place for testing their physical data systems. Within both organizations this was done by the IT department as an annual test where one server would be shut down allowing the second redundant server to run all of the applications. Both firms indicated that normally this process was very smooth and they encouraged feedback from
operations staff if any problems occurred during testing. This does indicate a higher level of BCP Maturity.
Overall, plan pervasiveness refers to the level of coordination between various business functions and departments and the degree to which a cohesive continuity plan has been
integrated in each unit. (Tammineedi, 2010) KLM/Air France scored medium in this capability because they are just beginning to test and implement their operational plans that have been created. DHL scored low on this as contacting their IT help desk was the interaction that was encouraged between Operations and IT.
6.2.3. Business Continuity Plan Structure
The Director of Exploitation Management at KLM stated, “When you know a process is going to change, part of your implementation is also adjusting your business continuity plan.” Both KLM/Air France and DHLindicated they had their business continuity plans on a sharepoint or shared document server within their firm in order for it to be easily accessed and updated. However, only one manager, who was in charge of the BCP management, was able to readily find these plans. Another manager at KLM/Air France looked for several minutes before locating one continuity procedure. He then commented that they should probably make it easier to find.
