Business Continuity Good Data Is Critical

This information is from my new book, The Ultimate Business Continuity Success Guide: How to Build Real-World Resilience and Unleash Exciting New Value Streams. Happily it is now Amazon’s #1 searched business continuity book. I hope you enjoy the chapter. and the book.

Business Continuity Tips, Techniques and Secrets

Business Continuity Good Data Is Critical

Your are only as Good as Your Data – So Let’s Make it Better

‘You are only as good as your contact data.’

(Suggestions in this chapter focus mainly on employee contact data but are helpful with vendor and customer data as well).

In the previous chapter, we discussed how to select a good mass notification system. In this chapter, we will discuss contact data quality and integrity. They go together. The greatest system in the world with poor employee, vendor, customer contact data will not succeed. You need a great system and great data for world-class success.

Combining a great system with great data has enabled me to:

  • During Hurricane Sandy I performed numerous notifications to 38,000+ employees. We quickly accounted for everyone.
  • During the Boston Marathon I did notifications to employees located in towns that were on lock-down. The ability to create custom dynamic notification lists on-the-fly was a great benefit to recipients and enabled us to account for employees and produce comprehensive reports for management.
  • During tornadoes, I often did notifications to cities in Oklahoma, Texas, Iowa and Ohio. I released multi-modal messages to employees in a timely manner. We practiced and practiced and each time we shaved precious seconds off ensuing notifications

It might surprise you to know each time I implemented a mass notification system the biggest challenge was improving the quality of employee contact data. The technical implementation of the mass notification system was relatively easy. I have heard similar accounts from many organizations throughout the world.

Tip – When you plan your mass notification system implementation and estimate a production date make sure you leave ample time to:

  • Get your initial employee data upload approved by your Legal and HR departments. This can take time especially if the data will be stored in a vendors data center in the cloud
  • Insure the quality of the data is at the level you require. If the data is of poor quality, contacting people will be difficult or impossible, which defeats the purpose of the system. Improving the quality of data is something I have been through many times and I will share some tips that have worked for me

Tip – Whether you use manual call trees to communicate with employees during a crisis or an automated mass notification system each is only as good as the quality of the underlying HR contact data.

Tip – Data quality and integrity is often a challenge, especially in mid-size and enterprise companies.  In my case I have worked with employee databases between 23,000 and 82,000.

Tip – In some cases you might even be breaking new ground in your organization to improve the quality of employee data across the enterprise. I have encountered this in many organizations and I promise you that the effort you put into improving the data will benefit your employees and your company in many ways beyond crisis management and business continuity.

For example, while implementing an automated mass notification system for a fairly large company I reviewed the employee contact data in SAP (a popular HR system) and for many people their contact data had never been updated. I did some random testing by trying to manually contact employees. It was no surprise to me that many phone numbers were incorrect. I encountered many disconnected numbers, numbers no longer in service, pizza places (we have a lot of pizza places in NY), a stationary store and even a bar (perhaps the employee spent a lot of time there).

 The Road to Better Data

Even before you evaluate and purchase an automated mass notification system it is important to speak with HR and legal about what type of employee data you can and cannot use to contact employees. Depending on your policies and procedures you may or may not get permission to add personal contact information to the system without specific ‘opt-in’ from employees. In most of my implementations we had to implement an opt-in or opt-out process for personal data. Work data can usually be used by default without opt-in, but verify that with HR and legal just to be certain.

Implementing an opt-in process can be time consuming. You must consider how you will communicate the program to employees and how you will capture the opt-in permission from them.

I suggest when you go out to the employees for their permission to include their contact information you offer them the opportunity to also review and update their current contact data. When people move and/or change landline and mobile phone numbers the last thing they think about is updating their employee contact information with HR. Do not be surprised if a large percentage of your data needs updates. Getting this important data up-to-date and accurate is a big win for you and your organization.

There are many options you can offer employees to review and update their contact data. You may already have a self-service portal for employees. Another option is to send them an email with a secure link. When they click the link they can sign-into a form which will display their current contact information. They can then review the data, add or update contact methods and click the opt-in checkbox.

It is important to sell the opt-in as a win-win for employees. Let employees know that the opt-in contact information will only be used in emergencies as part of the crisis management program. You can give a few examples of scenarios during which it is critical and advantageous that you can reach them. For example, if there is an ice storm in their area and their work location will have a delayed opening you can contact them to try to prevent them from needlessly driving to work.

In my experience, you still might have a low opt-in percentage. The opt-ins will likely improve when you have the system implemented and you begin doing call-list exercises. During these exercises, typically people that had not opted-in hear that their friends received cool notifications the night before and they did not receive any. At that point you must first check if they are in the system. It is possible they had opted-in and the system did not contact them or it did contact them and perhaps someone in their family listened to the call and did not mention it to the employee.

You can check the notification reports for details of what occurred. Most likely the employee had not opted-in. You should have an easy process for them to opt-in at that point. Perhaps, an email could be sent with a form to review their contact information and an, ‘Opt-Me-In’ checkbox. Otherwise, if your opt-in process is not automated you can use paper opt-in forms.

Unfortunately, in my experience some people still will not opt-in. When a crisis happens and they do not get a call they will probably then want to opt-in but of course it is too late for that event. Well, you did your best.

IMPORTANT TIP – If you are a global company and have international employees located in various countries pay close attention to laws regarding where employee data is permitted to be stored. Can it be maintained in a server based in the United States? I encountered this type of issue when running a global program spanning 30+ countries. Work closely with the international countries, HR and legal to get it right.

But wait, there is more!  

If you are working with a vendor, where will the employee data reside? In your local network or in the cloud? Most likely it will be stored in the cloud in their data center or probably in an outside data center such as AWS (Amazon Web Services).  If that is the case here are some tips:

Tip – Ask the vendor which data center they use. Do some analysis on their infrastructure. Make sure they are solid and well secured. I know of major data centers compromised by hackers that were down for days! Research their history. Do some Googling. Do your homework.

Tip – Vendor resilience – Review the vendors disaster recovery and business continuity plans. Ask if they run hot-hot for system recovery. Can they instantly flip from one data center to another? Ask about single points of failure. Have your network, cyber security and IT teams join in the conversation so they can ask hard questions to make sure all is great and you won’t lose sleep over their up-time down the road.

Tip – Vendor security -Imagine if the vendor is hacked and your employee data is stolen.  Make sure you do an audit of their infrastructure or have them send you recent independent audit findings. Ask if your data will be encrypted ‘at rest’ and ‘in-flight’.

Tip – Vendor disaster recovery testing and results – Ask how often they test their backups. Ask for the results of the three most recent disaster recovery exercises they conducted. Ask about their uptime SLA.

Ok, let us assume all is great and you did a comprehensive pilot of the system and finally you have a signed contract for the system. You will meet with the vendor to map fields from your HR system to their mass notification tool. The data will be stored in a database table in the vendor’s data center. The data may be stored in a flat file as part of a relational database. Some mass notification vendors do not normalize their data model. This can be ok in this use case. Had this been a BCM system, red flags would go up if the system were not normalized.

You will work with IT and the vendor to map your internal fields to their database. It is relatively easy. The good vendors provide you with a lot of flexibility for core contact fields plus additional custom fields you can define. Custom fields plus boolean logic will enable you to slice and dice the data in a great many ways.  For example, you may want to initiate a notification to one or more cost centers or zip codes. Some systems make that impractical and others make it ‘easy peasy’.

What you do not want to do is to manually maintain the employee contact information directly on the vendor system or manually upload spreadsheets every night. I strongly urge you to set up an automated secure ftp (SFTP) process from your internal network to the vendors site. When the nightly file arrives, it should trigger a job on their end that automatically imports the contact information – adding, updating and deleting records without any manual intervention.

Ask the vendor how long the process of importing the data takes on their end. You would be surprised. Even a small upload of 10,000-15,000 employees could take an inefficient system hours to import. It really should only take a matter of seconds. Anything over 10 minutes, I would question. Stress test this BEFORE you buy the system. You should use masked data for the test.

Important Mass Notification System Tip – Deleting Employee Records

I separated this one out as I have heard horror stories of people no longer with an organization getting contacted. It is critical that a foolproof process is in place to delete employees from the system who are no longer with your organization. You must do everything in your power to insure the system does not send notifications to these people.

You do not want to call the family of an employee who is no longer with your company. Possibly the employee could have passed away.

I have also heard of occasions where people fired by an organization were subsequently contacted during a call list exercise. You do not need the aggravation.

There is also the important issue that you may have personal data sitting in a third-party database when the individuals are no longer part of your organization. This is a liability. Imagine if the vendor was hacked and you had to notify the people to explain why their contact data was still in the cloud! It is important that the vendor deletes the employee records and does not simply tag them as deleted and leaves them in the database.

Make sure you pay close attention to the delete process. Test it thoroughly. It is critical.

Improve your data over time:

With all of the above you will still most likely have data challenges. However, you are making progress. Often you are doing something that has never been attempted in your organization. It can be a big project. It takes time. You will get there if you do not give up.

You must continually test and improve the quality of your contact data. Analyze your data and improve it until you reach a threshold you feel is acceptable.

Your mass notification system must be able to provide you with detailed reports indicating wrong numbers, busy signals, hang-ups, etc. This will allow you to finely focus on where you must continue to improve the data. Create a feedback loop with employees so they can update their record with the correct information and test again.

Each test you perform will improve your contact connection results. Employees will contact you to opt-in after you launch the first few call list exercises. Word-of-mouth will encourage employees, who may have been wary of opting in to do so, as they will want to be included in future alerts.

I do have to warn you if you test to a couple thousand employees you will get questions from some employees as to why they did not receive a call or email. Be prepared to comb through the call list results. It is all part of the effort to build data integrity, prior to a disaster. Been there, done that many times.

Tip – The more contact methods you have for an employee the greater the probability you will be able to reach them in an emergency. Strive to have employees list as many work and personal contact points as possible including voice text and email.

Tip – Report the results of the call list tests to management. Let people know the results go to management and they will be eager to participate.

In summary…

In my experience improving contact data quality can be a challenge. Do not minimize the time and effort this endeavor may require, especially if you are a large organization.

Tip – HR should own the employee contact data. Purchasing can own vendor contact data. Sales can own customer contact data. You should provide support and guidance, but they own it. If you decide to own it, it will sap your time. If they say you own it, you might want to ‘push back!’

Tip – Expect to find a lot of disconnected or wrong home phone numbers, cities and states. People move and do not always update their information with HR.

Tip – You may discover disconnected work cell phone numbers that you may still be paying for. Check out the chapter in the book entitled ‘How to Spin Data Into Gold’. It can be a big opportunity for you beyond business continuity.

Tip – You will find incorrect personal email addresses. There will be a lot of bounce-backs. Be ready.

Tip – Instruct people to white-list the email address you are using to send email to their personal email account. Otherwise, it can be rejected or go into spam,

Tip – Have HR request, on a regular basis, that users update their HR information. Make it easy for the users to do so.

Tip – Gamify your automated call list exercises. Get management involved. Make it a friendly competition for the divisions. See who can get the highest connection percentage and send praise their way. Send ‘gentle reminders’ (as we say in Corporate America) to the lowest scoring divisions that it is in their best interest to improve their contact data.

FINAL IMPORTANT TIP – Opt-in versus Opt-out

Each organization is different and the decision to have an opt-in or opt-out policy to load contact data is an important decision in terms of the percentage of data that gets loaded into the mass notification system.

If the decision is that each user must opt-in to have their data included in the system, you will likely start with a low percentage of contact information. However, if you are permitted to use an opt-out process to load the initial data into the system your initial user contact information will SKYROCKET! This may be a decision for HR and legal.

I hope you enjoyed the information in this chapter. We go into a lot more detail in The Ultimate Continuity Success Guide. In fact, this is only one of 112 chapters packed with 1001 tips, techniques, ideas and those important lessons-learned. Have fun and please contact me with any questions!

UltimateBusinessContinuity.com