Business Continuity

How to create a culture of continuity

3 March 2009

Abdulrahman Al-Onaizan, Head of Business Continuity Management at Arab National Bank, explains how his organisation succeeded in establishing award-winning BCM practices.

View photos

Related Categories

• BUSINESS CONTINUITY

From this Section

• FEATURE

No one could accuse Abdulrahman Al-Onaizan of being a slouch at his job.

The Saudi was hailed Business Continuity Manager of the Year in the 2nd Asian Business Continuity Awards. His organisation, Arab National Bank (ANB), won the Business Continuity Management Award.

In the same year, Al-Onaizan was selected by a UK-based Business Continuity Journal (CIR) as BCM Manager of the Year for being able to “translate his approach to BCM into tangible results with what the Judges considered to be exemplary vision”.

In a nutshell, his job is to manage the setting up of the Bank’s state-ofthe- art Business Continuity Centre. Completed in 2005, the centre earned the bank an award from the UK-based Business Continuity Institute (BCI) the next year.

Headquartered in Riyadh, Saudi Arabia, ANB is one of the top ten banks in the Middle East. It has 150 branches spread throughout Saudi Arabia and one in London.

Al-Onaizan attributes the success of BCM at ANB to five major factors: clear vision, senior management’s support, buy-in from business functions, commitment of operational and support sectors such as IT and administration, and the dedication of BCM staff.

Clear vision, as Al-Onaizan explains, means “knowing what we want and tailoring BCM to the bank’s needs and being realistic and consistent”.

Strong support comes directly from the Managing Director. In addition, the senior management formed a BCM Steering Committee, which conducts weekly reviews of the bank’s BCM operations.

To make the whole organisation believe in BCM, an awareness campaign was launched to show the entire workforce the consequences of major disruptions to the business and the benefits of BCM. Al-Onaizan’s team used quantified figures to demonstrate how much such disruptions will cost each business unit. “Figures always work very well in a bank,” he adds with a dash of humour. “They now understand BCM as insurance in which they must invest.”

The BCM team involved the bank’s various business units in the Risk & Business Impact assessment process. “This not only helps us better understand the risks. It helps us work out how to control them,” Al-Onaizan says. “It also prepares them mentally to take action in case of any disruption.”

Site visits were organised to make sure that people “can see that BCM is not only about planning on paper, but it is something real that we are committed to, and ready for.”

Al-Onaizan says that these efforts, which worked very well, aimed at embedding BCM into the bank culture, so that everyone is on the same page, knows what to expect and is supportive of the necessary measures.

The award-winning BC Centre built and maintained by ANB is fullyenabled. It includes a DR data centre based on a Storage Area Network (SAN) to ensure resilience and scalability. Advanced network enables instant replication of data changes from the head office.

Each business unit has a place of work at the BC centre. The command centre is equipped with all the communication facilities needed to ensure that management is able to keep contact with the rest of the bank. A call centre is set up to maintain communications with the outside world. Canteens, meeting rooms and bedrooms are also available.

“It is the complete setup. We call it a ‘minibank’,” says Al-Onaizan. “In case of a major disaster where we lose the main office, all Critical Operations can be resumed.”

While the data centre contains most of the bank’s services, the work space can accommodate around a quarter of the company’s Head Office employees.

The centre is built and run exclusively by the bank for the bank. But could the function have been outsourced? Al-Onaizan argues that the operation is more solid in the knowledge that “we know how to maintain it.”

A major challenge, says Al-Onaizan, is in coping with changes at the bank. “The bank is very dynamic, with changes happening almost every day,” he notes. “While implementing services, we have to accommodate the upgrades the bank is making.”

“This is an on-going process, even though we have completed the facilities infrastructure and carried out tests and simulations,” he adds. “We have to add new services, expand existing ones and accommodate all other changes the bank puts in place.”

The BC Centre itself isn’t immune to change either. Lots of technologies have been added since it was first set up, including an upgrade to the servers and network infrastructure to accommodate the load and traffic.

Working with external consultants, ANB not only assesses risk for the bank as a whole, but also for each individual business unit. Technological tools including self-risk assessment and business impact analysis are used. Al-Onaizan says that, using the automated process, the bank is able to view reports with updated figures on a regular basis.

Six exercises were carried out in 2008 based on a variety of different disaster scenarios, with 1,700 employees, or around 40 per cent of the workforce, mobilised to resume work from the BC centre.

Five of these exercises focused on testing a particular part of the recovery plan, including the recovery time, branch network resilience, the load that the centre could accommodate, and so on; a combination of all these components was tested in a later exercise.

ANB is more prepared than most organisations, thanks to Al-Onaizan’s efforts. But he is not the kind of person to rest on his laurels. The push to embed the culture of business continuity into ANB’s corporate culture is ongoing, he says.

However, when pondering the evolution of ANB’s BCM over the next few years, Al-Onaizan thinks that the focus will be more about business resilience than business continuity alone. “The global trend is to be proactive as well as responsive,” he concludes.