Disaster Recovery Journal Fall 2023

FROM THE PRESIDENT’S DESK

What AI Means for Business Continuity W ith the recent release to the general public of tools like ChatGPT and Google Bard, the long-heralded arrival of AI has now occurred, and in a big way. In the wake of the debut of these tools, there has been a tsunami of think pieces on what AI means for society at large. Will it help cure disease? Ruin children’s ability to think for themselves? Make it easier to plan trips and meals? Worsen the problem of misinformation? Boost cybercrime? Improve mental health? Change warfare? Cost people their jobs? Destroy civilization? For all anyone knows, it might be any or all of the above. Leaving the broader discussion to other people, I’ve been trying to come to grips with what AI might mean for the field of business continuity. Influencing my thoughts is the fact these technologies are in their infancy. There will probably be huge advances in the next 10 years. What will their capabilities be then? Nobody knows. It seems to me there are two areas to look at in thinking about what AI means for BC: the risks AI poses to organizations’ ability to keep their critical processes running, and the possibilities of using AI as a tool to help in doing BC. For a closer look at how resilience professionals might fear AI, use it to help write plans and devise exercises, you might take a look at recent online exclusive articles on the site: “AI Anger Management,” “Chat GPT Comes to Business Continuity,” and “Business Continuity and Artificial Intelligence.” The articles above feed into the first tip I would give resilience professionals, faced as we are with the need to get our heads around the implications of AI: read widely about it, educate your self, get into discussions about it. As uncomfortable as the rise of AI might be in some respects, putting our heads in the sand won’t make it go away. Another tip I’d offer would be to use caution in leaning on AI to help with your BC program. The reason why is simple. In scouring the internet for infor mation to answer your questions, the tools might grab up bad data or advice—garbage which they would then feed it to you in a tone of absolute certainty. Plus, when AI tools like ChatGPT don’t “know” the answer, apparently they have a tendency to “hallucinate” a response, making something up out of thin air. That being said, it has to be stated that tools such as ChatGPT have an extraordinary potential to help us in doing BC. This is not in the future. It’s right now. Here’s an example of what they can do right now, for anyone, for free. I asked ChatGPT if it had the ability to evaluate a BC plan against the requirements of the FFIEC standard.

BOB ARNOLD, MBCI Hon.

Its reply was pretty darn impressive: Yes, I can certainly evaluate a business continuity plan against the requirements of the FFIEC (Federal Financial Institutions Examination Council) standard. The FFIEC’s Business Continuity Planning Booklet outlines the principles and expectations for effective business continuity planning in financial institutions. The booklet provides guidance on the key components of a comprehensive business continuity plan. ChatGPT then named them (risk assessment, business impact analysis, business continuity planning, testing and training, main tenance and review), concisely explaining each one. It concluded: By evaluating your business continuity plan against the requirements of the FFIEC standard, I can identify any potential gaps or areas for improvement in your plan. I then asked if it could look at a BC plan for me and tell me if there were any gaps. It replied: Yes, I can certainly review your business continuity plan and provide feedback on any potential gaps or areas for improvement. Please share the plan with me, and I will be happy to review it for you. That’s pretty amazing, especially when you consider how much work it would be for a person to extract this kind of infor mation from a standard or review a plan for gaps. Of course, it’s important to reiterate that you should double check anything AI tells you or creates for you. It’s also worth pointing out the limits of AI in doing this kind of work. The information that makes a program meaningful for an organization doesn’t reside in public sources, therefore it’s unavailable to the AI tools. Most of the information that really counts is located in people’s heads. The task of getting SMEs to put the things they know about their departments and business processes into words is more art than science. That’s the most important piece of all in building a BCM pro gram and getting it still requires the human touch. We are having an initial discussion of the impact of AI on resilience at DRJ Fall 2023 in Phoenix (Sept. 10-13). More com prehensive coverage will follow at DRJ Spring 2024 in Orlando (March 17-20). I hope to see you at both.

PRESIDENT bob@drj.com

6 DISASTER RECOVERY JOURNAL | FALL 2023