Insurers Prepare for the Worst by Strengthening Business Continuity and Disaster Recovery
Related Sidebar: Mutual of Enumclaw Has Built Potential Mt. Rainier Eruption Into Its Disaster Response
By the time Hurricane Ike struck the U.S. mainland on Sept. 13, 2008, American National Insurance Co. was better prepared to avoid business interruptions than it had been earlier in the year. Just in time for hurricane season, the Galveston, Texas-based multiline insurer ($3.1 billion in annual revenue) had completed a move of some of its staff from the coastal island of Galveston to a new facility in San Antonio to limit exposure to hurricanes and strengthen the carrier's business continuity/disaster recovery (BC/DR) capabilities.
"We had been looking to move certain operations off the island, and we chose [the San Antonio] site in 2007," relates J.D. Johnson, American National's SVP and corporate CIO. In June 2008 the San Antonio facility became home for first-available representatives for the carrier's health, life and annuity call center operations, but it was also chosen to eventually replace an existing Dallas site that accommodates personnel in American National's investment and financial areas.
"We have about 80 employees in San Antonio, but the facility is built in such a way that we could balloon that up to 450," Johnson adds. "It was a lot of hard work to get it finished and operational by June."
The move followed a decision made in 2000 to relocate American National's data center 25 miles north to League City, Texas. Construction of the new facility began in 2003, and the data center went into production a month before Hurricane Rita delivered Galveston a glancing blow in September 2005. "It is a state-of-the-art facility designed to take a direct hit from a Category 5 hurricane with 30-foot storm surge and continue to run through the event and thereafter as an island," Johnson relates. "It has the water, the food, the sleeping facilities, the diesel -- everything is duplicated."
The League City data center played a critical role during Hurricane Ike, as did both the San Antonio and Dallas facilities, as it became clear that American National's headquarters were going to be closed for longer than the carrier's BC/DR plan accounted for. At no time in the century-old company's history had it been absent from the building for more than a week, according to Johnson. But Galveston city services were so devastated that it was clear that returning would not be feasible for a considerably longer time. The Galveston location finally reopened on Oct. 13, more than three weeks after Ike's landfall.
"We continued to build out our facilities when it was clear we were not going to get back on the island in the time frame that was typical for this type of event," Johnson explains. "We started enhancing our continuity plans to put more and more people into the League City and San Antonio locations."
Both the intensity and duration of the event exposed opportunities for improvement, Johnson acknowledges. But American National's real-life execution of its BC/DR plan, he says, surpassed any "paper test" Johnson had ever gone through in his career before arriving at the carrier in 2007. "The technology was very good -- we had a good plan. But our people really made the difference," he says.
"Our data center operated as it was designed to do: ride-out teams stayed in the building Sept. 12, we continued to run our cycles that night, and all the online systems were up the next morning as scheduled," Johnson adds. "The operations in Dallas and San Antonio were online, and it was literally business as usual, in a scaled-down mode based on the number of employees."
To some extent, American National's example reflects the superior preparedness typical of the financial services industry. According to Forrester Research (Cambridge, Mass.) analyst Stephanie Balaouras' July 2008 report, "What Your Business Can Learn About Disaster Recovery From Financial Institutions," financial services firms take a more disciplined approach to DR than do companies in other industries. Responding to a survey of 250 DR decision makers and influencers undertaken in October 2007 by Forrester and the Disaster Recovery Journal, 88 percent of financial institution respondents said they already have a formal and documented disaster recovery plan in place, compared with 76 percent of respondents across all industries.
"In addition 36 percent of financial institutions will conduct at least two full DR tests per year versus 30 percent of all other industries," Balaouras writes in the report, adding, "67 percent of financial institutions will update their plans at least twice a year versus 54 percent of other industries."
But American National's performance is also attributable to the heightened appreciation of danger by companies located in disaster-prone areas. As flattering as the Forrester study may be as a comparison to other industries, it nevertheless calls attention to the fact that 12 percent of financial services companies don't have a documented DR plan, 33 percent will update their plans less than twice a year, and little more than a third uphold the highest standards of testing. The bottom line is that for many financial services companies, natural disaster can still spell business disaster.
Constant Evolution
Perhaps the greatest lesson from American National's experience is that BC/DR preparedness is a process that is constantly evolving. Not only does technology continue to present opportunities to improve BC/DR preparedness, but changes of all sorts -- whether in the company, business or natural environment -- require constant adaptation. Many insurers made BC/DR a regular strategic priority after 9/11, but it's less clear how up-to-date their preparations are, according to Gail McGiffin, a partner with Accenture (Chicago).
"Insurers have made great progress in fortifying their operations, but I'm not sure that the discipline and regularity of testing is organic to their organizations yet," McGiffin comments. "The question is whether they test their plans on a regular basis, or are they waiting for an actual disaster to see if the plan is going to work."
Even when testing is sufficiently frequent, questions may still remain about its adequacy, McGiffin cautions. Tests should replicate the conditions of actual disasters as closely as possible, including activation of remote sites, execution of phone tree and other communications measures, and simulations of logistical challenges, such as traffic congestion slowing evacuation, McGiffin recommends.
Anthony O'Donnell has covered technology in the insurance industry since 2000, when he joined the editorial staff of Insurance & Technology. As an editor and reporter for I&T and the InformationWeek Financial Services of TechWeb he has written on all areas of information ... View Full Bio
Tweet This