University Business - September 2006 - (Page 23)

VIEWPOINT Business Continuity Planning George Mason University's executive enterprise risk management approach has helped in building responses to what-if scenarios. By Joy R. Hughes, Keith Bushey, Cathy Hubbs, and Robert Nakles H URRICANE KATRINA AND oped a timeline by which the top 10 could other natural disasters, the on- be assessed within the first year. They cre- going threats of terrorism, and ated a four-year cycle for every department the auditing profession's increased em- and associated subdivision to be assessed phasis on business continuity planning before the cycle begins again. have captured the attention of higher The chief safety officer and the IT education executives. security coordinator distribute a 20-page Most now realize that they ought to be risk assessment questionnaire regarding doing business continuity planning but departmental assets, policies, and proce- aren't sure where to begin. George Mason dures. The team conducts interviews to Risks identified by University's Va. Enterprise Executive clarify questions and conduct on-site secu- Risk Management Group EERMG is rity assessments, and then identify risks. department heads never building the organization's business con- The risk identification process, still seem to make it to the tinuity plans and capacity. in progress, has already resulted in reme- top of the priority list. After hearing a Motorola information diation steps. For example, to limit after- security executive predict that more and hours personnel risk, police escorts were people with very different viewpoints tend more corporations would create risk man- provided and evening hours were reduced. either to overwhelm with detail or, con- agement programs that incorporate cyber- Several risk assessments were out- versely, include generalizations that give risks, GMU's CIO Joy Hughes proposed sourced to vendors such as Protiviti www them limited practical use. an EERMG be chartered there. .protiviti.com . Because the university Department heads devote significant President Alan Merten appointed team had bundled the risk assessment amounts of both mental energy and time Maurice Scherrens, senior vice president in with business continuity and disaster to fill out myriad forms, yet the unit-level for Finance and Administration, to lead planning, the effort could be funded by problems identified never appear to make the group. The team was charged with a grant that Mason had received for busi- it to the top of the priority list. High-pri- assessing information technology risks, ness continuity. ority items for remediation funding usu- physical risks, and risks from departmen- ally are the central ones rather than the THE CONTINUITY PIECE tal procedures and processes, as well as unit ones because they affect more people overseeing the development of business The departmental risk assessment ques- and processes. Unfortunately, this ap- continuity plans. tionnaire also requests a business continu- proach ensures that the concerns of many ity plan. Most departments do not have individual departments will be left out of THE TRADITIONAL MODEL such a plan and really have no idea how the final risk analysis. University risk assessment projects are to develop one, nor is there really much often elaborate paper drills designed to expertise in central administration. GMU'S NEW MODEL satisfy an outside audience such as an Rather than require every department in auditor. Reams of documents and an ex- A t George Mason University Va. , Joy R. Hughes is chief information officer and vice the university to fill out risk assessment haustive collection of plans may satisfy president for Information Technology, Keith forms, GMU's EERMG members first an external audience, but they're generally Bushey is assistant vice president and chief identified which departments were most impractical to implement without a very safety officer, Cathy Hubbs is director of IT se- relevant to business continuity planning. significant infusion of resources. curity, and Robert Nakles is executive director The group prioritized the list and devel- Plus, large sets of plans prepared by of the ITU Project and security office. www.universitybusiness.com September 2006 | 23 Vwpt.indd Vwpt.indd 23 8/21/06 4:05:37 PM http://www.protiviti.com http://www.protiviti.com http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - September 2006

Contents
College Index
Company Index
Advisory Board
Editor's Note
Behind the News
Viewpoint
Marketing
Human Resources
Money Matters
Community Colleges
Summer Conference Report
Learning After Loss
Not Your Typical Textbook Advice
A Greener Attitude
Mobile Technology: One For All
Lessons in Landlording
Business Technology
What's New
Calendar of Events
Direct Connect
End Note

University Business - September 2006