Business Continuity begins with process transparency
Ever since it acquired ARIS over a decade ago, Software AG has actively used its own suite for process analysis, management, mining and automation. From the beginning, ARIS logically became a central part of its approach to Quality Management—with its carrier-grade risk and compliance capabilities. By deploying ARIS for quality-driven process mapping, Software AG enabled each team member to precisely understand their role and follow the step-by-step procedures required to ensure the highest standards.
“ARIS is crucial for us to meet customer demands for efficiency and excellence,” says Patrick Neumann, Director ARIS Quality Assurance. “It not only allows us to deliver consistent quality; it also provides proof that we are continually improving.”
Having achieved ISO 9001—the worldwide reference in quality management—in 2018, the ARIS team decided to set their sights higher. In 2023, they identified a new need for ISO certification. ARIS had been the first platform Software AG provided to customers as a cloud offer—and they recognized that this came with the responsibility of ensuring iron-proof Business Continuity for all cloud operations. Customers using the ARIS SaaS offer needed the assurance that their critical ARIS-related business operations would continue functioning, whatever the circumstances.
The ARIS BU therefore decided to extend its ISO 22301 certification for Business Continuity Management Systems to include the Cloud Operations team.
Identifying, analyzing and testing critical processes
“Business Continuity Management is about identifying the most critical operational processes,” says Patrick Neumann, “and then making sure teams are able to recover them as fast as possible.”
Among the many processes in the Enterprise Management System, the ARIS team established a list of the most important. “The aim was to identify processes that are crucial for our customers to perform their activities without disruption, and identify the tools and dependencies to assess risks in case of unavailability,” says Denitza Fuchs, VP ARIS R&D and Cloud Operations. “Ultimately, ARIS customers should not be impacted by any disruptions to Software AG’s processes and tools, or those provided by our third-party partners.”
The team took a systematic approach to BCM. After identifying the most critical processes, they carried out a Business Impact Analysis. “We used ARIS to send out questionnaires to our internal customers to fill in the gaps in the process flow,” explains Patrick Neumann.
Next came the Risk Analysis phase. Using the ARIS Risk & Compliance module, the team was able to evaluate the risk of operational disruption in four key areas: IT, location, people and external services. With the enterprise-wide view provided by ARIS, they could then check if the critical processes were aligned with the management of those risks. “During this phase, we considered all relevant process interfaces to make sure we were covering risks from multiple perspectives, including IT and Governance and Compliance,” says Denitza Fuchs.
Finally, complete testing was carried out for various scenarios. This included tabletop testing, crisis management testing, and critical asset testing—with team members enacting the response plan to assess its effectiveness and identify areas of improvement.
End-to-end BCM excellence in ARIS
Following the implementation of its Business Continuity plan, ARIS has been certified ISO 22301 with a 5-star rating for exceptional quality. The external auditor was particularly impressed by the maturity level of the processes. As the single source of truth for all the company, ARIS has long been used for process management and analysis in activities such as Management Systems. This helped ensure the robustness and maturity of processes when it came to Business Continuity.
What stands out about this solution is that ARIS itself was used to ensure its own continuity. “The entire BCM was conducted end-to-end through ARIS and for ARIS,” explains Denitza Fuchs. At every step of the plan, ARIS provided the structure, transparency and methodology to optimize the certification process.
“ARIS offers us process models to clearly visualize our processes and understand how they may be impacted by different risks,” says Patrick Neumann, “and it gives us the possibility to automate tasks so we save valuable time.” Furthermore, ARIS facilitates Change Management, because any adjustments made to processes are reflected immediately and that same information is instantly accessible to everyone involved in the day-to-day processes, as well as those who may need to enact a recovery plan.
The team is set to further integrate ARIS into its BCM strategy. During the complete testing phase, they are planning to further enhance process models by adding supplementary details about test results. This will make it simpler to retrieve the required information and make informed adjustments in the future. It’s all part of the continuous improvement process that ARIS enables in many areas of Software AG’s culture.
“ARIS has helped us build operational resilience and robustness into our business, and especially for our cloud offer.” says Denitza Fuchs. “Our success is a blueprint for our customers to use ARIS for their own Management System projects centered on Quality or Business Continuity—with the added benefit of our experience and expertise.”
