The software products developed by Intuit^® have become so synonymous with financial management, that if you completed an individual tax return in the United States last year, there is a one in four chance that it was done using one of them. Founded in 1983, Intuit has nearly 7,000 employees with major offices in 13 states across the U.S., and offices in Canada and the United Kingdom. Two of their more popular products, TurboTax^® and Quicken^®, have certainly left their mark in the bustling market of personal finance software products.

Catherine Nichols, Intuit’s Business Resumption Planning Program Manager has five years of Business Continuity Planning experience and is both a Certified Business Continuity Planner and a Certified Information Systems Security Professional.

Nichols leads a team of experts who are constantly looking for methods that will allow them to perfect their plans. Often, these new approaches require that outdated systems be expelled and that fresh business recovery techniques be acquired. For instance, Nichols explained how they once used word processing documents to create Intuit’s business continuity plans (BCP), and that it became increasingly difficult to oversee and maintain all of their plans. “We were looking for a consistent approach to planning, a centralized place to store and manage our business continuity plans and a flexible way to create our own Table of Contents, and that just wasn’t happening with what we were using. That’s when we turned to Strohl Systems.”

Plan
Now an LDRPS Web customer, it’s hard to imagine Nichols and her team achieving their Business Continuity Planning goals via word processing documents. “At Intuit, we plan for our employee's safety and continued employment, we plan for our customers to continue to receive our products and services, and we plan to deliver on the bottom line for our shareholders.” While these are very traditional goals, Nichols and her teams’ methodologies certainly are anything but typical.

“We’ve streamlined our BCPs so that our Table of Contents only contains the most necessary documents needed for a successful response and recovery,” explained Nichols. Using the Table of Contents builder in LDRPS assures that all plans for the various locations and departments have the same basic contents and structure. “We find that it’s a very effective way to guide plan owners and administrators through the development and maintenance of their BCP.

“Also from our Table of Contents we’ve developed a checklist to assist us with the auditing of all our plans.”

Want to be in our spotlight? If you’d like to share your unique planning methodology or an interesting BCP-related experience, the Recovery Chronicles’ Client Spotlight is a perfect forum to share with your peers. Please contact Peter Leonowitz at pleonowitz@strohlsystems.com for more information.

A few of the LDRPS reports in their Table of Contents include an employee call tree, BCP team listings, a listing of critical processes by recovery time objective, requirements of software and equipment over time, immediate action tasks, recovery strategies and workaround tasks.

As mentioned before, plan administrators are granted access to LDRPS and are responsible for entering data and maintaining their department’s plans. “We don’t stop there though,” said Nichols, “our plan administrators must attend monthly training sessions and focus on the different strengths of LDRPS like the Plan Assistant, which we find to be a great guide for them in building and maintaining their BCPs.”

In addition, Nichols added that she utilizes a direct download of employee contact information from Intuit’s directory right into LDRPS. “Doing this assures us that LDRPS is equipped with a current list of employees and their contact information, which makes maintenance of call trees and BCP teams easier on the Plan Administrators. We also download plan status metrics captured in the Overview section of LDRPS to a database to create graphs and charts to communicate plan status and disconnects to executives.”

Practice
Nichols and her team also exercise the BCP and Technology Recovery plans on an annual and semi-annual basis in order to increase plan owners’ familiarity with their business units’ recovery plans. “We test everything from workaround tasks and recovery strategies, to the advanced arrangements required to support each business unit's recovery needs, to the effectiveness of communication and decision-making processes between our teams,” said Nichols, regarding the importance that her team places on the preparation that goes into their exercises.

Intuit’s exercises are based on realistic probabilities including natural hazards (earthquakes, hurricanes, flooding, tornados, winter weather, etc.), technological hazards (loss of information processing infrastructures, viruses, etc.), human-caused hazards (errors, omissions, attacks by employees/outsiders, etc.) and socioeconomic issues (vendor strikes, political upheaval, war, etc.). Intuit requires annual BCP exercises and semi-annual disaster recovery testing. “This year we combined our Site Emergency Response and Facility Operations tests with our BCP tests to bridge the recovery gap between support groups and business unit BCP teams. It went very well and we learned a lot from our results,” stated Nichols.

More specifically, Nichols considers Intuit’s exercises as cumulative and progressive. “The cumulative nature of testing insures that every test includes every aspect of recovery that has been tested previously,” she explained. “Progressive testing allows us to keep adding additional systems, applications, recovery processes and integration points, moving towards ever increasing resumption capability.”

Going beyond testing, Nichols and her team keep their plans in their best and most capable form by keeping track of them in LDRPS by utilizing the Overview section. “There we’ve added fields to capture plan metrics including whether or not the plan has been completed, the date of completion, the date the plan was last tested, the date the plan was last audited and an audit score, and the date the plan was last maintained and updated.”

The business continuity and disaster recovery group is responsible for updating these metrics for each plan and using the metrics to report plan status to Intuit’s executives on a monthly basis. They also compile reports from LDRPS, including software and equipment requirements and critical processes by recovery time objective, to provide to support groups (IT, Facilities, etc.) so that they can prepare for the business unit’s business continuity recovery requirements.

Prevail
When asked how she and her team prevail in performing their jobs every day, Nichols’ answer was “through executive support and business unit commitment to BCP planning for Intuit.”

“Our team’s experience and dedication coupled with LDRPS Web has resulted in a business continuity program that is maintainable in the long term. We accomplished this by developing any and all underlying aspects so that our BCPs can be updated, added on to, audited and tested with a standard approach. This eliminates the workload of reinventing the wheel each year.”

Intuit uses LDRPS to build, house and maintain business units, support groups (HR, Finance, Legal, Communications, etc.), site emergency response and facility operations, IT support, call center, data center recovery and corporate incident management team response and BCP plans. “Currently we have approximately 250 plans in LDRPS which account for groups across all of Intuit’s locations including international locations.”

For more information on how LDRPS or any other Strohl products can help you prevail, contact us at 800-634-2016, +1-610-768-4120 or info@strohlsystems.com.