Agile methodologies clearly work well in the world of software development—the evidence is overwhelming. But how does Agile apply to other disciplines like business continuity management? Can the Agile philosophy help mitigate power disruptions and improve pandemic planning? Mr. Collins illustrates how one client in the financial services sector successfully applied Agile principles to a recent business continuity initiative. This session is intended for executives and project managers charged with developing business continuity and IT disaster recovery plans. Learning Objectives • Describe typical challenges as businesses try to build competency with business continuity management. • Learn how Agile principles can shape the vision and scope of business continuity initiatives. • Understand how Agile can enhance accountability, motivate teams, deliver short-term wins and generate real business value.

1. Delivering Business Value by
Applying Agile Principles to
Business Continuity Management
Ken Collins
Management Consultant
Solution Integrity Inc.
May 13, 2009

2. Introduction
Ken Collins, BASc, MBA, CMC, PMP, ITCP, ABCP, MCPD, CTT+
» ken.collins@solution-integrity.com
• Driving business success through strategic leadership of IT
» Change Agency
» Service-oriented Architecture
» Team-based Software Development
» Project Management Organization Frameworks
» Business Continuity Management and Disaster Recovery
May 13, 2009 2

3. Session Objectives
Intended Audience
• Executives and Project Managers charged with developing
business continuity and IT disaster recovery plans
Learning Objectives
• Describe typical challenges as businesses try to build
competency with business continuity management
• Learn how Agile principles can shape the vision and scope of
business continuity initiatives
• Understand how Agile can enhance accountability, motivate
teams, deliver short-term wins and generate real business value
May 13, 2009 3

4. Agenda
In Theory
• What is BCM?
• What is Agile?
• Conventional BCM Wisdom
• Typical Challenges
In Practice
• Adopting a New Mindset
• Applying Agile to a Business Continuity Project
• Managing Scope
May 13, 2009 4

5. What is Agile?

6. Agile Manifesto
May 13, 2009 10

7. Agile Principles
Early, continuous and frequent delivery
Working software is the measure of progress
Welcome and adapt to changing requirements
Teams work at a pace that can be sustained
Teams should reflect on successes and failures
Strive for simplicity in design and execution
May 13, 2009 11

8. The Waterfall Model
Agile is not merely a new vocabulary
Agile development has little in common with the
waterfall model, which is still widely in use
Waterfall
• Inflexible division into separate stages
• Commitments are made early
• Difficult to react to changes in requirements
• Iterations are expensive
• Unsuitable if requirements are not well understood or
are likely to change over the life of the project
May 13, 2009 12

9. Conventional
BCM Wisdom

10. BCM is Holistic Resilience
“Business Continuity Management is a holistic
process that includes the commitment of
management at all levels on an ongoing basis.
“Provides a framework for building resilience
and capability for an effective response thereby
safeguarding the interests of key stakeholders,
reputation and value-creating activities.”
The Business Continuity Institute
May 13, 2009 14

11. BCM is Critical…and Daunting
“To maximize business potential and ensure continuity for our
clients, risk-based proactive measures have been taken to
safeguard our production systems…The strategic plan for business
continuity accommodates the…process of achieving and
maintaining a high degree of disaster readiness, effectively
responding to disasters big and small and then returning to a well
positioned readiness state.”
“The alternate site recovery…represents a very high standard of
recovery in the event of major disaster…We are committed
to…preparing ourselves…and believe that, following a major
catastrophe involving our primary processing centre, we would be
operational within days.
May 13, 2009 15

12. Templates are Terrifying
“Establishing a Business Continuity Plan
requires a fair amount of research as well as the
collection of information. Gathering the
information can often be a daunting task.
…However, we have provided you with the
following templates outlining the key
requirements for work areas, technology, forms,
and procedures.”
May 13, 2009 16

13. Example of a Useless Template
STANDARD SUPPLIES REQUIREMENTS
QUANTITIES BY RECOVERY INTERVALS
DESCRIPTION WITHIN WITHIN
WITHIN 24 HRS WITHIN 1 WEEK
48 HRS 72 HRS
FILE FOLDERS AND BINDERS
CALCULATOR
HIGHLIGHTERS
PENS AND PENCILS
PENCILS
HOLE PUNCH (3 HOLES)
ELASTIC BANDS (PER BOX)
PAPER CLIPS (PER BOX)
PADS OF PAPER (LINED)
PRINTER PAPER
POST-IT-NOTES
STAPLER
STAPLER REMOVER
RULERS
SHRED IT BOX
DATE STAMP FOR AP
DEPOSIT STAMPS (CDN, US)
May 13, 2009 17

14. Typical Challenges

15. Typical Challenges
Lack of executive support and accountability
Unclear strategy
Maintaining a sense of urgency
Planning instead of exercising
Trying to do too much all at once
May 13, 2009 19

16. Typical Challenges – Strategy
Unclear strategy
• Which categories of business disruption should be
addressed?
• What fundamental assumptions should be made?
• What’s the overarching approach?
• What are the RTOs and RPOs for each business
process?
• What’s the cost of disruption?
» 6 hours? 24 hours? 2 days? 1 week?
May 13, 2009 20

17. Typical Challenges – Urgency
Business Continuity uses URGENT NOT URGENT
significant resources
I II
Organizations often
IMPORTANT
struggle to develop plans
and to support them on a
continuing basis
NOT IMPORTANT
What typically happens to
important, non-urgent
initiatives?
III IV
May 13, 2009 21

18. Typical Challenges – Change
Change is scary; the fear factor is real
• It will cost a bundle
• We’ll have to make a commitment
• We could make a bad decision
• It’s going to create more work for us
• We don’t know where to start
May 13, 2009 22

19. Adopting a New Mindset

20. Opening Your Mind…
to a New Mindset
Firm A
• “As a key component of our employer-of-choice
strategy, we want to communicate to potential
employees that this is a great place to work…”
Firm B
• “The last thing we want to be is an ‘employer of
choice.’…”
Mark Huselid, Brian Becker and Richard Beatty, The Workforce Scorecard
May 13, 2009 26

21. Should Industry or Context
Affect the Project Approach?
Project Characteristic Construction/Engineering Information Technology
Change Slow and incremental Rapid and unplanned
Requirements Explicit and documented Ambiguous and vague
Roles Specialists Utility players
Implementation Six Sigma Controlled crisis
Budgeting/Scheduling Historically based Historically unfounded
Where does BCM fit?
May 13, 2009 27

22. Contrasting Paradigms
“The dominant paradigm has been the work-down view, where
developing a solution is a deterministic exercise, similar to traditional
engineering pursuits, but business forces driving some initiatives
today require a different approach.”
Sam Guckenheimer, Software Engineering with Microsoft Visual Studio Team System
May 13, 2009 29

23. Contrasting Paradigms
Core Assumptions
Planning and Change Process
Primary Measurement
Definition of Quality
Acceptance of Variance
Intermediate Work Products
Troubleshooting Approach
Approach to Trust
May 13, 2009 30

24. Contrasting Paradigms
Planning and Change Process
Work-Down Attitude Value-Up Attitude
Planning and design are the Change happens; embrace it.
most important activities to get Planning and design will
right. You need to do these continue through the project.
initially, establish Therefore, you should invest in
accountability to plan, monitor just enough planning and
against the plan, and carefully design to understand risk and
prevent change from creeping to manage the next small
in. increment.
May 13, 2009 31

25. What Management Needs
Confidence through Predictability and Progress
• How much will it cost?
• When will it be done?
• How will we measure progress?
May 13, 2009 32

26. When is it Done?
You’re building a house…can you envision a
time when it’s done?
• Waterfall
You’re building great software…can you
envision a time when it’s done?
• Agile
So where does BCM fit?
May 13, 2009 33

27. Applying Agile to a
Business Continuity Project

28. In
Practice
Background
The organization decided upon a seven-stage
model, and then tried to plan everything!
“Over the past years, a few projects have taken
aim at putting BCP and IT DRP in place.”
Documents of 100+ pages sat on shelves
May 13, 2009 35

29. In
Practice
Getting Started
Align Senior Management
State the Problem
Pull Together the Guiding Team
Develop the Change Vision and Strategy
Communicate!
May 13, 2009 36

30. In
Practice
Problem Statement
Customers demand assurance that business
continuity plans are in place to mitigate the
impact of service disruptions. These
expectations are not well aligned with our
current corporate reality.
With our heavy reliance upon IT, it is clear we
must create and validate comprehensive
disaster recovery plans that underpin business
continuity.
May 13, 2009 37

31. In
Practice
Vision Statement
By the end of 2008, we will have built a framework of
business continuity best practices by iteratively and
incrementally exercising risk management and disaster
recovery processes
We will simulate likely disruptions, execute organization-
wide responses, produce audited test results, and
advance improvements to both infrastructure and
planning; thereby assuring our customers and
shareholders that we effectively mitigate exposure to
regional service interruptions
May 13, 2009 44

32. In
Practice
Iterative Approach
“We have adopted an iterative approach to
delivering a comprehensive solution, which
enables us to plan for the most likely risks to our
organization while building a framework that
supports our response to potential events that
threaten our ability to service our customers.”
May 13, 2009 46

33. Managing Scope

34. Incrementalism
Incrementalism is a good idea for all
projects…and a must when risks are high
When do we really understand the problem?
Before or after implementing a solution?
“Plan to throw one away; you will anyhow”
• Frederick P. Brooks , The Mythical Man-Month
Do you get an ‘A’ for effort…or for results?
May 13, 2009 48

35. Iterative Approach
Minimize risks by breaking large projects into multiple versions
Functionality
Version 3
Version 2
Version 1
Time
May 13, 2009 49

36. Benefits of Iteration
Manages uncertainty and changes in scope
Encourages continuous and incremental improvement
Enables shorter delivery time
Sets clear and motivational goals for team members
Forces closure on project issues
May 13, 2009 50

37. In
Practice
Business Risks
Risk Consequence Prob Impact
Building-localized power outage High Medium
Local or regional disruption of a non-permanent Medium High
duration (e.g., three weeks) that denies access to
facilities and systems
Pandemic event that denies access to facilities, Medium High
personnel and systems
Permanent loss of facilities and systems Low Severe
May 13, 2009 51

38. Driving Statement for In
Practice
First Deliverable
“The nature of our business suggests we should
be able to operate at 100% capacity (client-
critical services) for 72 hours with a building-
localized power outage”
May 13, 2009 52

39. In
Practice
Scenario-based Exercises
May 13, 2009 53

40. Predictive versus Adaptive
Historically, BCM tries to be predictive
• Heavy planning effort to identify and mitigate several
eventualities
» Daunting
Adapting quickly to changing realities
• Minimal planning, with a focus on a single scenario
» Manageable
May 13, 2009 57

41. In
Practice
Examples of Adaptive Behavior
First Exercise
• Which is better?
» Detailed response plan
» Minutes
• Oopsies!
» Exceeded generator capacity
» Disruption upon resumption
• Adapted and retried a month later
» Installed a second generator
» Installed UPS’s throughout the office
May 13, 2009 58

42. Delivering Value with Purpose and Practice In
Practice
BCM Operationalized
Guiding Principles
• Foster Open Communications
• Work Toward a Shared Vision High Availability
• Establish Clear Accountability and Shared Responsibility and
• Focus on Delivering Business Value Advanced Recovery
Business Value
Permanent
Relocation and Restoration
Strategic Focus
Shared Cultural Values
Centre of Excellence
Pandemic Enhance Client Satisfaction
Work Area Recovery
BCM Introduced IT Disaster Recovery
Alternate Site
Mindsets
Building-localized Risk Mitigation Focus • Pride of Workmanship
Power Outage Foster Culture Change • Team of Peers
Build Confidence in Approach • Frequent Delivery
Assessment Eliminate Client Dissatisfiers • Willingness to Learn
and Kickoff
2007 2008 2009

43. Suggestions for Success
Enhance accountability
• Appoint an executive champion
• Assign a dedicated project manager
• Engage business unit managers
KISS and make incremental progress
It’s a change initiative; manage it like one
• Review “Our Iceberg is Melting”
Use scenario-based exercises as the
primary measure of progress
May 13, 2009 66

44. Session Objectives – Recap
Intended Audience
• Executives and Project Managers charged with developing
business continuity and IT disaster recovery plans
Learning Objectives
• Describe typical challenges as businesses try to build
competency with business continuity management
• Learn how Agile principles can shape the vision and scope of
business continuity initiatives
• Understand how Agile can enhance accountability, motivate
teams, deliver short-term wins and generate real business value
May 13, 2009 67

45. Thank You!

46. The 8-Step Process of Successful Change
John Kotter, Our Iceberg Is Melting
Set The Stage
1. Create a Sense of Urgency
2. Pull Together the Guiding Team
Decide What To Do
3. Develop the Change Vision and Strategy
Make It Happen
4. Communicate for Understanding and Buy-in
5. Empower Others to Act
6. Produce Short-Term Wins
7. Don’t Let Up
Make It Stick
8. Create a New Culture
May 13, 2009 70

47. What is Agile?
Agile methods generally promote a project
management process that encourages frequent
inspection and adaptation, a leadership
philosophy that encourages teamwork, self-
organization and accountability, a set of
engineering best practices that allow for rapid
delivery of high-quality software, and a business
approach that aligns development with customer
needs and company goals
May 13, 2009 81

48. Contrasting Paradigms
The dominant paradigm has been the work-down view, where
developing a solution is a deterministic exercise, similar to traditional
engineering pursuits, but business forces driving some initiatives
today require a different approach
May 13, 2009 82

49. Contrasting Paradigms
Core Assumptions
Planning and Change Process
Primary Measurement
Definition of Quality
Acceptance of Variance
Intermediate Work Products
Troubleshooting Approach
Approach to Trust
May 13, 2009 83

50. Contrasting Paradigms
Planning and Change Process
Work-Down Attitude Value-Up Attitude
Planning and design are the Change happens; embrace it.
most important activities to get Planning and design will
right. You need to do these continue through the project.
initially, establish Therefore, you should invest in
accountability to plan, monitor just enough planning and
against the plan, and carefully design to understand risk and
prevent change from creeping to manage the next small
in. increment.
May 13, 2009 84

51. Contrasting Paradigms
Primary Measurement
Work-Down Attitude Value-Up Attitude
Task completion. Because we Only deliverables that the
know the steps to achieve the customer values (working
end goal, we can measure software, completed
every intermediate deliverable documentation, etc.) count.
and compute earned value You need to measure the flow
running as the percentage of of the work streams by
hours planned to be spent by managing queues that deliver
now versus the hours planned customer value and treat all
to be spent to completion. interim measures skeptically.
May 13, 2009 85

52. Contrasting Paradigms
Definition of Quality
Work-Down Attitude Value-Up Attitude
Conformance to specification. Value to the customer. This
That’s why you need to get the perception can (and probably
specs right at the beginning. will) change. The customer
might not be able to articulate
how to deliver the value until
working software is initially
delivered. Therefore, keep
options open, optimize for
continual delivery, and don’t
specify too much too soon.
May 13, 2009 86

53. Contrasting Paradigms
Acceptance of Variance
Work-Down Attitude Value-Up Attitude
Tasks can be identified and Variance is part of all process
estimated in a deterministic flows, natural and man-made.
way. You don’t need to pay To achieve predictability, you
attention to variance. need to understand and
reduce the variance.
May 13, 2009 87

54. Contrasting Paradigms
Intermediate Work Products
Work-Down Attitude Value-Up Attitude
Documents, models, and other Intermediate documentation
intermediate artifacts are should minimize the uncer
necessary to decompose the tainty and variation in order to
design and plan tasks, and improve flow. Beyond that,
they provide the necessary they are unnecessary.
way to measure intermediate
progress.
May 13, 2009 88

55. Contrasting Paradigms
Troubleshooting Approach
Work-Down Attitude Value-Up Attitude
The constraints of time, The constraints may or may
resource, functionality, and not be related to time,
quality determine what you can resource, functionality, or
achieve. If you adjust one, you quality. Instead, identify the
need to adjust the others. primary bottleneck in the flow
Control change carefully to of value, work it until it is no
make sure that there are no longer the primary one, and
unmanaged changes to the then attack the next one. Keep
plan. reducing variance to ensure
smoother flow.
May 13, 2009 89

56. Contrasting Paradigms
Approach to Trust
Work-Down Attitude Value-Up Attitude
People need to be monitored Pride of workmanship and
and compared to standards. teamwork are more effective
Management should use motivators than individual
incentives to reward incentives. Trustworthy
individuals for their transparency, where all team
performance relative to the members can see the overall
plan. team’s performance data,
works better than management
directives.
May 13, 2009 90