Latin Finance - July 2008 - (Page 46)

guide investment banking Preparing for Disaster By Agustin Abalo, President - Latin America, Terremark Worldwide, Inc. Introduction When a group of bankers get together for lunch these days, the subject of conversation has shifted away from conventional banking and towards risk management. The topics of internal controls, anti-money laundering, security, and disaster recovery are trendy these days. For as long as banking existed, bankers worked with two fundamental risks: market risk and credit risk. Good bankers were those who empirically learned how to evaluate risks in any given operation. With the assistance of rudimentary tools, limited financial information, and a first-hand knowledge of the client, many bankers became quite good in credit risk determination. Very few, however, have the ability to accurately forecast market conditions and external and internal disasters that can adversely affect day-today operations. Unfortunately, we have learned that risk, defined as the probability of an event occurring, is a statistical concept. Because technology is now one of the most important tools used by all bank processes, any risk occurrence affecting it can easily be catastrophic. This article deals with the ultimate risk event for a financial institution and the total incapacitation of its information processing facilities. business continuity plan by creating a mirror image of the main bank-processing center and providing for the databases in the alternate center to be replicated online in real time. In addition, you would need to replicate the communications network and of course the people that operate, feed, and control the data flow from these centers. One problem with these solutions is that operational costs double; you lose money and quite often close down. Amusingly, the end result of a great business continuity plan is the same as having no plan at all. Organizations must pursue a business continuity plan that optimizes the risk mitigation on the basis of a costbenefit analysis. We start with the premise that a redundant data center located a distance of at least 60 miles from the original provides an acceptable level of mitigation. This redundant center houses a redundant IT equipment configuration, runs out of a separate communications network and is staffed by redundant personnel providing the optimal business continuity package. Unfortunately, this sort of risk mitigation is too expensive for the majority of corporations. Built-In Redundancy Disaster Recovery The need for IT disaster recovery is generally accepted as a necessary mitigation tool for banks residing in areas where natural disasters such as hurricanes, earthquakes or tornados are common occurrences. Others banks may reside in areas subject to social unrest or terrorist attacks, while all are subject to an incapacitating pandemic flu epidemic or other variants of risk events that are less probable but more destructive. Again, the level of mitigation, the areas to address, the maximum time to recover, the cost to the institution in money and reputation and the maximum time to operate under disaster recovery conditions are some of the variables involved in the disaster recovery algorithm that more often than not, are left unanswered. To clarify this last statement and for purposes of this article ‘disaster recovery’ is defined as the capacity to restore your application systems after a catastrophic risk event and ‘business continuity’ as the capacity to restore your business functions after the event. Business continuity requires disaster recovery but disaster recovery does not imply business continuity. When an aircraft is designed, it is done with internal redundancy in mind. After all you cannot replace failing parts in mid-flight or for that purpose change planes. A bank continuing to operate after a serious IT risk event is similar to an aircraft continuing flight after a major failure; both depend on a rather quick recovery for survival. In the case of the aircraft, having a second aircraft waiting will not always do the trick, particularly if the failure happens when you are at 30,000 feet. In the case of a data center, having a second data center is not financially feasible for most. A wiser and more practical solution is to seek the necessary security and redundancy within the primary center and maintain a second center only for data replication and backup. There are 4 tiers of investment – size, sophistication and depth – a company can make when choosing their disaster recovery infrastructure. For each tier level, the investment in electromechanical infrastructure doubles. A tier 4 infrastructure in the United States today, can cost on the average $20,000 per square foot. It would appear that the additional cost once you exceed a tier 3 installation can only be justified by only select businesses of great size that operates on a real-time environment. Building and maintaining a data center for self-use, whose infrastructure will be able to withstand most known risk events 99% of the time, is not an economically feasible alternative for most. Business Continuity A sommelier once mentioned that “anyone can select a good $300 bottle of wine, the difficulty resides is selecting a good wine for $20.” By the same token, anyone can design a great 46 LATINFINANCE 2008

Table of Contents Feed for the Digital Edition of Latin Finance - July 2008

Latin Finance - July 2008 Contents Investment Banking Outlook Compensation Survey Colombia Investment Banking Borrowers vs. Investors Banorte Profile Braskem Financing Strategy Brazil Hydro Finance Peru Port Privatization Panama Money Flows Argentina Local Markets Guide to Banking Technology Who Said That?

Latin Finance - July 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.