The recent crisis in Egypt serves as a sober reminder of the need for highly robust disaster recovery (DR) and business continuity (BC) planning in the global sourcing industry. And while most large, multinational corporations and their sophisticated outsourcing service providers do have DR and BC plans in place, they tend to focus on just one layer of the onion – getting IT systems and applications up and running in alternate locations.
But a fully effective risk management strategy must methodically peel back each onion layer in order to deep-dive examine, and be pre-prepared to address, the potential primary, secondary and tertiary impacts of all variables and components in a truly holistic manner, as shown below.
Let’s look at a real-world disaster situation in a comparatively stable part of the world to bring this concept to life – the devastating impact massive Hurricane Katrina had on the Medical Center of New Orleans and its patients in 2005.
To set the stage of the overall impact, when Hurricane Katrina hit New Orleans, major parts of the city were flooded, people were stranded in their homes, there was major infrastructure damage, power was out, businesses and city services shut down, ground transportation in and out of the city was impossible, and the city was in utter chaos.
At the Medical Center of New Orleans, the “what was affected” included the emergency room, the laboratory, the pharmacy, the operating rooms, nursing, and ambulatory, specialty care, intensive care unit, and rehabilitation services. The “who was affected” included the patients, the doctors in the Medical Center and other destinations, the nurses, and management. The “issues related to the impact” included inability to operate, prescribe or administer medications, and receive payments and medical supplies. And the “what actions could be performed to mitigate the effect of the issues” included evacuating patients to other hospitals, delivering data processing from a remote site, and relocating back office functions to a remote site.
To snapshot the cascading effects of the crisis, the primary impact was a catastrophic breakdown of infrastructure, which required evacuation of the hospital’s patients. But there were massive evacuation issues which caused patients to be separated from their physicians and dispersed to unknown destinations. This led to the secondary impact, wherein receiving hospitals couldn’t diagnose patients, medical records were inaccessible in flooded facilities, and physicians couldn’t be contacted to coordinate care. The tertiary impact was that some patients were unable to receive proper treatment, causing loss of life and extended illnesses. Additionally, as payer and provider processes were completely down, the government had step in, driving massive additional costs to tax payers.
The bottom line is that New Orleans as a city – and the Medical Center itself – was completely unprepared to handle a catastrophe of this magnitude.
Against that backdrop: how many layers of your risk management strategy have you unpeeled to pre-prepare for any type of disaster?