Preparing for the Unknown

Elite 8 2005 honoree Mike Byam spearheads The Hartford's aggregated risk management movement.

As a diversified financial services and insurance company, The Hartford (Hartford; $337 billion in assets under management) spends a great deal of time analyzing and preparing for risks -- taking on our customers' risks is our business. But what about a crisis striking the company itself?

Since receiving Elite 8 recognition last year, I have moved from driving the transformation for The Hartford's P&C technology organization to overseeing the company's business continuity planning efforts. We are taking the same enterprise risk management principles we apply to managing our insureds' risks and aggregating our companywide risks.

I lead The Hartford's newly formed Business Resilience Office, a cross-functional, cross-business team of 30 people charged with planning for the known and preparing for the unknown. Our purpose is to prepare The Hartford to recover continuing operations in the event of a disaster. We are focused on setting policy and procedures, governance and management of business continuity plans for business operations and technology disaster recovery.

We are doing this work in an aggregated manner, taking into account all of our businesses, all of our customer obligations and all of our employees -- not an easy task for a global enterprise such as The Hartford, a Fortune 100 company with 30,000 employees. Our team is focused on four key areas: risk assessment, risk mitigation, recovery capability and cultural change.

Risk Assessment: Risks can be significantly different based on geographic location, business model, technology, staffing, environmental conditions, partners and other factors. For example, when we evaluate our Japan-based operations, we take into account that they are located in one of the world's most earthquake-prone nations. In Florida, we consider hurricane preparedness and how to effectively shift work to other offices in the event of an evacuation. And we are not only considering The Hartford's operations, but also those of our partners.

Risk Mitigation: My team is analyzing various business functions and making recommendations on ways to mitigate risks. For example, by splitting critical business operations between two different locations, documenting manual business processes or investing in highly redundant infrastructure for survival-critical applications, The Hartford can improve its risk profile significantly. We also discuss telecommuting as a solution for business disruption, focusing on critical business processes and determining how remote workers and telecommuters can be leveraged effectively for those key processes. Taking into account the full operations of the business can help mitigate risks in a crisis.

Recovery Capability: Establishing plans to return to business operations after a crisis is crucial. Business resumption and application recovery plans should be accessible and up to date, with the priorities of recovery clearly defined and well-tested. Since the business itself is dynamic, the plans must be embedded within the change processes for business and software governance. My team will test and validate manual business processes and our ability to transfer workloads to alternate sites, including employees working at home.

Cultural Change: Finally, cultural change must be addressed in order for employees to understand their accountabilities in supporting business continuity, whether it is maintaining recovery plans, annual testing of plans or just understanding their role in a crisis event. Business continuity is everyone's responsibility to ensure our ability to protect our employees, assets and customer obligations.