Dear Banks: Uptime within one hour, please!

By Cat Yong

For the better part of a working business day, CIMB’s online banking services were down. Having put up a notification on Facebook for their nearly 900,000 fans, that their CIMB Clicks service would be down for maintenance from 11.45pm 17th May, 2013 (Friday) till 8.30am the next day (Saturday), the expected re-emergence of the online banking portal never happened. A full 48 hours later when Monday rolled around, ATM services for CIMB branches as far away as in Melaka and Pahang, it would seem, also began to fail to work.

Every financial service institution, face the dread of such a nightmare happening to them, on a daily basis. Aside from having to face the ire and wrath of very irate customers online and offline, the loss of productivity, not to mention revenue from at least 5 hours of downtime, must surely amount to millions of ringgit.

But, what are our local FSI’s business continuity plan (BCP) in the event of a disaster like above?

According to the Global IT Architect Professional Body’s (IASA) chairman in APAC, Aaron Tan Dani, a good BCP would have ensured bank systems were back up within the hour.

Other local banks have had similar outages, although maybe at smaller scale and with smaller impact. The inconvenience to customers are no less real however.

Tan also observed that  2 other banks in Singapore, DBS in 2010 and OCBC in 2011, each had systems failure for nearly 8 hours.

Tough reprimand… in Singapore
Regarding DBS Bank’s outage in 2010, the Monetary Authority of Singapore (MAS) had said, “MAS takes a serious view of this incident. We expect all financial institutions to put in place a robust technology risk management framework that will ensure the reliability, resiliency and speedy recoverability of the institution’s IT systems and infrastructure, whether outsourced or in-house.  We have recently written to the CEOs of all financial institutions to remind them of this. MAS will not hesitate to take appropriate supervisory action against any financial institution which fails to meet the standards set in the IBTRM or Internet Banking and Technology Risk Management Guidelines.”

Tough luck for OCBC Bank because the next year, it was their turn to face an outage.

Its CEO, David Conner had issued a statement, “”We regret that the system outage of 13 September disrupted services at our branches and affected our ATMs, online banking platforms and credit card system. With numerous customers inconvenienced, we are grateful to the many who were patient and understanding as we worked to quickly restore normal service.”

He had also added, “We have learned from this event and we will comply with the directions set out by the Monetary Authority of Singapore. We remain committed to ensuring that our channels are operating for customers at all times.”

In contrast, our local regulator seems pretty silent about the recent outages and service issues faced by banks in Malaysia. When the corporate communications departments of these banks were contacted, the (generally flustered) response was, “We will have an official statement about this later today.”

System offline: At one of the local bank’s MidValley branch at 2.30pm yesterday

If it weren’t for the irate comments on social media like Facebook, or notice signs at bank branches alerting customers that the bank’s systems are offline, this reporter could have easily mistook the corp. comm departments’ initial response of, “What service outage?” to mean that everything is fine and dandy with our good ol’ local financial service institutions.

The fact is, it was far from business-as-usual for these banks’ hundreds of thousands of customers that rely on banking systems to work reliably, in order for them to get on with their own businesses.

This isn’t the first time that the need for good business continuity plan has cropped up. In 2009, Deputy Finance Minister at that time, Datuk Kong Cho Ha had acknowledged that due to the economic slowdown, banking and FSIs in the United States were experiencing heavy job losses, ultimately affecting daily operation of the world’s largest FSIs.

He had cautioned at that time, “This is an opportune time to review business continuity planning standards.”

Fast forward, four years later and with the way things are of late in the FSI industry, perhaps it’s high time that more decisive steps are taken by the Ministry of Finance and yes, even the local regulator, Bank Negara.

Business continuity planning
Because of the integral role that IT plays in enabling and supporting businesses, the enterprise architecture (EA) methodology has a crucial role to play when it comes to BCP.

Tan described, “BCP is ranked as second out of 8 focuses that are important in the Infrastructure Architecture Body of Knowledge. This is because it has direct impact on business operations. As long as leading brand experiences a systems failure and prolonged downtime, there is loss of business confidence and negative customer experience.”

Business downtime is also one of the major risks that must be addressed and managed by both business and IT divisions, prior to development and deployment of any system. The main driver behind enterprise architecture is that IT speaks the language of business in order to help it achieve business goals. One of these goals is a good BCP.

“Today, we live in an environment surrounded by advanced technology. As long as the fundamentals of EA are adhered to, BCP is actually just a matter of system configuration. To have effective BCP, requires the sound implementation of the four domains of EA –  Business Architecture, Software Architecture, Information Architecture and Infrastructure Architecture,” said Tan.

It then stands to reason that both business and IT need to integrate together. “BCP is not only about the technology, but also about business and proper contingency plans that need to be in place in order for the business to have minimum interruption.

“Proper briefing and procedures are required, on how and when the contingency plan can be activated. All these would be identified and captured in the Business Architecture domain, so that in the event of a system failure, the business has contingency plan as part of risk management to handle the operation.”

Tan also opined that regular disaster drills can help organisations practice, plan and practice how to hasten recovery.