Bank of Valletta plc

Kyle Boffa

Banking Continuity Steward

Kyle Boffa is the Disaster Recovery & Incident Manager at Bank of Valletta plc with over 17 years of experience at the institution. Based in Malta, Kyle has a deep background in disaster recovery, managing and enhancing the bank's resilience and response strategies in critical situations. Through this article, Boffa highlights the challenges and opportunities in Disaster Recovery Leadership. He emphasises the importance of a strong foundation in systems analysis and engineering, as well as the need for a comprehensive disaster recovery plan.

In my current role in Disaster Recovery, I leverage my experience as a system analyst and system engineer to understand the Bank’s infrastructure. Key milestones include contributing to the core banking transformation, gaining extensive knowledge of new technologies and the Bank’s strategy, and leading the transformation of Disaster Recovery over the past three years, achieving regulatory and framework compliance.

Unexpected Challenges and Shifts in Disaster Recovery

Since the actual concept of Disaster Recovery revolves around crisis management and being able to make rapid decisions based on the available information, the most unexpected challenge was more with regards to a culture shift mentality.

Before my taking over the area of DR, hardly anyone placed any significant importance on such preparedness, and most considered it to be extra additional work that would impact their resources and their BAU (business as usual) capabilities. However, with small iterations each year, a culture of accepting and recognising the importance of having accurate and tested DRPs has developed and is being given its due importance.

Developing and Maintaining a Comprehensive Disaster Recovery Plan

Creating a comprehensive disaster recovery plan involves several critical steps. First, conduct a risk assessment and document the findings in a Business Impact Analysis (BIA) to understand potential impacts on business operations. This helps determine the recovery time objective (RTO) and recovery point objective (RPO), guiding the development of recovery strategies. Each plan should include a detailed, step-by-step recovery procedure with assigned roles and responsibilities. Regular testing, drills, and employee training are essential to ensure effectiveness. Prioritising critical business functions, resource availability, and regulatory compliance are also crucial. Following these steps helps minimise downtime and ensure business continuity.

AI-Driven Disaster Recovery: Opportunities and Limitations

AI-driven disaster recovery is being touted as a significant advancement and offers various advantages such as speed and efficiency (thus reducing the overall RTO), predictive analysis to predict and identify potential failures, automation, and scalability.

However, it is my opinion that whilst AI will improve the area of Disaster Recovery, it will not fully replace the need for human intervention and involvement. The human touch would still be required for critical decision-making, especially in complex or unprecedented situations. Whilst AI will undoubtedly improve decision-making durations, humans can adapt to unexpected change and think creatively to solve problems that AI might not be programmed to handle.

“True resilience is built when every team understands its role and the organisation can adapt swiftly without waiting for a crisis to validate its plans.”

The Role of Regulations in Shaping Disaster Recovery Strategies

Whilst sometimes different entities consider regulations to be an extra overhead, which might necessitate extra resources to ensure compliance, they play a crucial role in shaping disaster recovery strategies, especially in an industry as critical as the banking sector.

At Bank of Valletta, our Operational Risk Department has specific teams that ensure compliance with all the regulatory requirements, highlight any shortcomings, and confirm that the Bank gets aligned as soon as possible. With the upcoming DORA regulation, the Disaster Recovery platform has quickly and rapidly changed to ensure a more robust resilience than ever before.

Future of Disaster Recovery Management and Emerging Trends

Whilst we have already touched on the topic of AI and the benefits it brings about assisting Disaster Recovery, several advanced simulation tools are also gaining traction and popularity. Such tools will help in simulating various disaster scenarios, which allows organisations to better prepare and test their respective recovery plans. If one considers the landscape that AI brings about along with the collaboration that these tools might offer, the future of disaster recovery management looks very promising.

Advice for Disaster Recovery Professionals

Being able to bring about transformation within an organisation, especially within the area of disaster recovery, requires a strategic approach as well as a willingness from different stakeholders to embrace change.

The first step that one should take is to assess the current capabilities that already exist within the organisation and identify areas for improvement. Taking such a stand should allow one to start building a strong business case about any shortcomings where the benefits get highlighted, and arguments such as improved resilience and reduced downtime are highlighted.

It is important to understand that one would not be able to achieve all the targets at once and that there is a need to focus on continuous improvement through regular testing and updates. Learning by experience is also an essential point and is not something to be taken lightly. The more experienced that one is, the more that s/he will be able to make informed decisions, help to promote awareness, and eventually help in fostering a culture of resilience.

Since the area of disaster recovery is a volatile one, and hardly one scenario is ever like the other, significant importance needs to be placed on being able to embrace change and being willing to adapt to the business environment and technology landscape.