• Home /
• Case studies BCM /
• An Implementation Case Study for Business Continuity Management: VocaLink builds a strong BCM culture

An Implementation Case Study for Business Continuity Management: VocaLink builds a strong BCM culture

Summary

VocaLink is a specialist provider of transaction services to banks, their corporate customers and Government departments. It processes domestic and international automated payments and provides ATM switching solutions. On a peak day, the VocaLink automated payment platform processes over 90 million transactions and over half a billion in a month. Its switching platform connects the world's busiest ATM network of over 60,000 ATMs. TalkingBusinessContinuity.com interviewed Eugene Taylor, the Business Continuity Manager at VocaLink, and asked him some questions about how Business Continuity Management (BCM) was embedded across the organisation. His answers reveal both an organisation and a manager passionate about building a strong BCM culture.

Who champions the BCM programme?

The VocaLink Board, who own the BCMS policy, champions the programme at the highest level and enthusiastically supports the establishment of VocaLink's Business Continuity Management System (BCMS) and ensuring it is of the highest quality balanced with ease of implementation.

The Corporate BCM Oversight Forum, accountable to the Board, are VocaLink's BC implementation champions who meet quarterly and are responsible for strategy, direction and BCM review.

The Corporate Crisis Management Team (responsible for managing incident responses through to resolution) ensure that VocaLink's BCM is robust, practical and capable of managing any disruption.

The Business Continuity Planning (BCP) framework of contingency planning requirements, including reviews by the Business Continuity representatives (BC Reps) from each internal business function, ensures all BCP activity is continually focussed on supporting VocaLink's business objectives.

What triggered the Current program?

The current BCM programme was triggered in late 2006 when Eugene Taylor took over the role of Business Continuity Manager, a role which had previously been primarily Disaster Recovery (DR) focused. The BCMS was restructured from the bottom up (with strong support from senior management) using a variety of standards (the draft BS 25999 Code of practice, the FSA best practice guide, the Business Continuity Institute Good Practice Guidelines) and years of experience.

How is success measured?

VocaLink measures its business continuity success through:

• Responses to live incidents
• Plan testing
• Review of competencies and performance of BC personnel
• Quarterly Oversight check points
• Internal audits
• Certification assessments
• Staff wide surveys
• Regular awareness programmes
• Assessing intuitive competence of BC personnel during all activities
• Benchmarking against similar organisations
• Market wide exercises
• Levels of community involvement.

What benefits did you get from going through the implementation process?

VocaLink's primary benefit was an increased level of commitment to the programme and content of the BCMS. 15% of VocaLink staff now hold specific Business Continuity responsibilities displaying increasing companywide diligence, enthusiasm and commitment.

What about downside - were there any problems or issues which you wish to share (they can be general)?

Naturally, we faced challenges and issues in achieving our aim. Most significant were the organisational changes resulting from the Voca - LINK merger in July 2007. Whilst there were significant changes in organisation structure, an integration of cultures, services, management and technology also presented challenges, together with an increasingly diverse geographical spread of locations. The increase in size of the post-merger company inevitably resulted in an increase of data. Coupled with a flux in organisational structure this certainly posed some interesting challenges in maintaining holistic connection between the components of our BCM. 

Did you use PAS 56 (this is the pre-standard that BSI published about 3 years before BS 25999)? When did you become aware of BS 25999?

VocaLink became aware of the work around BS 25999 during 2006 and early 2007, through their involvement in the public review. At that time there were a number of standards across the globe and we had formed a strategy that took the best of all to move into a holistic approach covering all areas of BC. Some elements of PAS 56 were considered in the early days. One must also remember that our internal DR standards at that time were high.

Did you undertake a formal gap analysis between your organisation's systems and the Standard? If so was this done internally or with the help of external consultants

When we looked at the standard there were some improvement opportunities but no significant gaps. Our BC capability had rich elements already embedded which really only required connecting up.

How soon did you start to benchmark your processes against the standard internally?

Just three months into the role, our BC function underwent an external audit against the draft BS 25999 standard, as part of VocaLink's companywide risk and compliance procedures. We also took on the challenge of a British Standards Institute pre-assessment in late 2007 which was invaluable in helping us to understand our level of compliance and preparedness against the Standard.

How big was your project team for this?

Initially it was just me on the BCMS project. I completely re-engineered the existing system - an incredibly difficult decision and a very daunting prospect at the time, yet later proved to be well worth it. As we developed the programme we involved the BC Reps more fully and they must share the credit for the success. The 'project' team which I head up now includes BC Reps and deputies (+95), the incident management teams, the Oversight Forum, key stakeholders from other functions (Risk, H&S, facilities, procurement, corporate IT for example) and of course the Executive Team and their continued support for driving BC best practice.

Within your organisation how much involvement was there with other departments and operational managers across the business?

Massive! Every VocaLink business function is integral to our BC and has oversight of governance, crisis management, service continuity and business continuity management. Furthermore, specific expertise across the risk, H&S, facilities, procurement, security, HR, communications, assurance, legal, finance, marketing functions contribute to ensure maximum success of the BC project. Employees at all levels across the company were involved ensuring rewarding and informative collaboration and ownership.

Did you involve any of your supply chain in this process? Your main customers? Your biggest suppliers? Both?

Absolutely on all counts - suppliers and customers.

All our key customers have a VERY keen interest in our BCM capability and are closely involved. All are treated equally with the same high level of involvement. We have over 80 key suppliers of which there are 15+ BIA identified critical ones. We review all our suppliers regularly and have embarked on a collaborative approach to identify the arrangements of our suppliers and work with them to better understand vulnerabilities.

What is the BCM reporting line in your organisation?

My role (Corporate Business Continuity Manager) reports to the head of Operations Planning and Control (OPC) who reports directly to the Operations Executive Director. My role and its activities are reviewed on a quarterly basis by the Corporate Oversight Forum consisting of senior representation across all business divisions within VocaLink. The role also requires ongoing maintenance of the crisis management structure which I address through regular BC health-checks with the Executive Directors and key functional heads. As the largest proportion of our BC reps sit within the Operations and IT functions, the role is suitably placed under OPC which also owns corporate health and safety and operations assurance.

What made you decide to go for certification to BS 25999? Was there any influence from customers or suppliers?

VocaLink wanted to demonstrate our strong BCM commitment to our customers and the industry at large. We also wanted to participate in regular independent assessment to assure our stakeholders that we are striving for continual improvement to achieve the highest standards within our BCM. Our customers are delighted that we have taken the initiative as it shows our commitment to offering them as reliable and dependable a service as possible. It also demonstrates to our customers, competitors, suppliers, staff and investors that we use industry-respected best practices. Achieving certification demonstrates to stakeholders that our business is run effectively. The process for achieving and maintaining the certification ensures that we continually improve and refine our activities whilst the regular assessment process ensures we maintain a high level of employee responsibility, commitment and motivation.

How did you go about deciding and limiting the scope of BCM for certification purposes? And was this decision informed by mainly external or internal factors (or both)?

When I initially took on the role it was my vision to build a sub-conscious BC competence across the entire company and when I proposed an all-inclusive scope it met with unanimous agreement on the condition that it realised tangible benefits for all stakeholders. So, I used this internal decision to maximise the advantages of a scope that would be of significant benefit, not only to our internal organisation, but also to our customers and suppliers.

What was your impression of the final audit - any comments or things that you would have liked to have either done differently or had done differently?

We were delighted with the result of the certification audit. The report was valuable in helping us focus on key areas where we could make improvements. Retrospectively, I would have been able to provide significantly more evidence of the auditor's requirements as the language used to identify the requirements had on occasion been open to misinterpretation. That said, this is a new standard and against which we were the sixth organisation to be certified, no prior experience was in existence to draw from. We were delighted with the result and are better prepared as a result to undertake ongoing assessments.

The audit was exceptionally well handled by the auditors who painstakingly accommodated debate and discussion to ensure compliance. Their flexibility, particularly in accommodating the time-constraints of a busy work environment on staff-interviewees, set the mood for a reasonably smooth and efficient audit process.

Were any new pieces of documentation developed for the certification? If so what were they?

Yes, but not many as the pre-assessment had already identified areas for improvement which would satisfy evidence sampling. The most important piece was the dependability chart of critical functions which was graphically hosted on our intranet. The function dependability chart presents a holistic view of the BC connections between all functions and identifies those which are critical. An added bonus was that each function's BIA could be accessed from the online dependability chart giving credibility to its rating as a critical function - or not.

Finally could you say if any of the following have happened or you expect them to happen after going through this process?

- Improved customer satisfaction

It is early days since achieving certification, and we have not yet had the opportunity to fully assess the level of improved satisfaction with our current customers. However, gaining certification and maturation of our BCMS significantly and increasingly supports our customer propositions and bid responses.

- Meeting legal requirements

There are no specific legal requirements at this stage as we are not directly regulated, but we are considering including BC requirements in the general terms and conditions of our supplier agreements. Additionally we are required to report to the Bank of England Oversight regarding our BC capability and arrangements due to keen focus on these business-critical areas from the FSA (and key European financial institutions). We actively participate in FSA market-wide industry exercises as these reinforce our company's commitment to BCM.

- Improved relationships with key suppliers

Our key suppliers are now required to submit a statement of their BC arrangements relating to their products or services which support and maintain our revenue-generating streams - both during BAU activity and during times of potential business disruption requiring extraordinary supply. In addition we ensure that our internal users of those suppliers identify possible points of failure that could emanate from a supplier failing to perform its obligations which are then discussed with key suppliers.

- Improved relationships with key customers

We continually collaborate with our customers to improve the way we work with them at all levels within our organisation. Many of our key customers are represented on our board which facilitates direct feedback.

- Improved relationships between departments in your organisation

Improved departmental relationships are an ongoing challenge due to the current post-merger level of reorganisation across the company in order to more effectively meet our customers' needs. There has however been a rewarding improvement to the responses required from BCM and I am proud to say that the 'sub-conscious' competence of all personnel has increased significantly.

- Reduction in costs

Tangible reductions are evident. For example, we reduced the reading time of BC documents by 60% by being pragmatic in our approach to the level of detail in our plans and offering practical solutions. By sharing responsibility for BC across a large percentage of our workforce (150) it enables those individuals to carry on their daily roles without creating a need for additional investment in extra staff dedicated solely to Business Continuity.

- Improved reputation for reliability

Our reputation for reliability is a key priority in maintaining and enhancing our customer base. Since certification there has been improved companywide understanding of the benefits derived through taking a holistic approach to BC.

Is there anything else that you'd like to say about your experiences going through this process (good or bad)?

For me, as the Company Business Continuity Manager and as an employee it really has been a heart warming experience. The following are some of the attributes that you'll need in order to successfully embed BCM in your organisation

• Advocacy - There will always be the challenge of internal scepticism about the value of BC in a commercially driven environment. By positioning the BC manager's role at a higher authoritative level within the organisation guarantees greater companywide commitment to BC.
• Time - Keeping abreast of business impacts on the structure of BCM requires dedication and an inordinate amount of administrative skills and time.
• Passion - you cannot gain subscription without passion for the subject and you need to be knowledgeable about your business and your subject. BC managers will never know everything as there are changes all the time. The best a BC manager can do is to remain current and use his or her experience to influence a robust BCMS - and spread the passion.
• Determination - A BCM implementer has to believe that what they are doing will work but they must also be prepared to take a step back, acknowledge failure occasionally and work with others - don't work in isolation.
• Temerity - You may have to find other ways of presenting yourself if you really believe there is a subject worth including in the BCMS. All too often we discount an important subject because of 'consumer resistance' which leaves us at risk of diluting the com's BC.
• Collaboration - It took time to build momentum in gaining commitment to BC, but most importantly it required a better understanding of the diverse roles, ways of working and priorities of colleagues across the differing internal business functions. Be receptive and balance others' priorities whilst aiming to achieve the BCM objective.