POS Systems And Risk Management

Is your POS prepared for the perfect storm? The #TorontoFlood last night seemed to have caught everyone by surprise. Especially folks in West Toronto! Power was knocked out to over 1 million customers and a major communications hub at 151 Front Street was under water affecting phone systems and internet causing a variety of communications problems all over Southern Ontario. To add insult to injury, an outage of banking debit services seems to have been related to the flooding of communications systems in Toronto, which affected thousands of merchants across the Province. As most of our POS clients are using integrated credit and debit with their point of sale systems, they immediately started calling Armagh to report that their POS transactions weren’t going through. Naturally, they couldn’t get through due to telephone outages, and the problem snowballed from there. In conversations with customers this morning, I have been reminding them that they need to be prepared with backup solutions in the event that their systems fail. In this case, their systems did NOT fail – it was the infrastructure that those systems rely on that failed. In either case, they need to be prepared. System failures, for any reason, and as rare they may be are inevitable. For retail store and restaurant owners, the events in Toronto are an important reminder of how critical these systems are to the way we live our lives and operate our businesses. Another important lesson is how interconnected these systems are to our operations and to each other. Who would have thought that a single minor flooding incident on a street three cities away could directly affect your POS systems? This begs the question, are you ready for a major systems outage? This question reminds me of an article I read that quoted a 2005 study that surveyed 1200 businesses and reported that 33% of businesses had no continuity plan in place (in my experience it’s far more than that), and that 93% of businesses that lose their critical systems data for 10 days or more declare bankruptcy within a year of the event. The topic of risk management and continuity planning looms large over most business managers and seems like it’s an impossible project to tackle – causing most managers to stick their head in the sand – but it doesn’t have to be. It just requires planning – as I have always said, failure to plan is planning to fail. An evaluation of risk and disaster recovery for mission critical systems like POS systems – basically revolves around three major areas: 1. Critical System and Vulnerability Identification The way to avoid an unforeseen disaster is to foresee it. Retail store and restaurant owners need to determine the most important systems – such as the point of sale system, phone system, network and internet connectivity, and determine their vulnerabilities. Electrical power could go out, internet may go down, power surges may damage critical systems, hardware may fail, and phone lines may stop working. 2. Prevention Planning Once you know where your weaknesses are, how can you prevent them from being realized? Is your plan proactive or reactive? When disaster does strike, will you be ready to mitigate the damage to your business? Do you have battery backups on your POS system that work? Surge protectors that haven’t already been damaged by surges? When your DSL internet goes down, do you have a cellular internet failover setup so you can keep pumping the transactions through even if Bell or Rogers is down? Failing that, do you know where your credit card slips and credit card imprinter is if you have to go manual? Does your main system have RAID hard drive protection? Do you have a backup of your critical POS databases, documents, and files? What if the building burned down? Do you have an offsite backup of your data? Are your people informed and trained on what to do in the event of a systems failure? If all else fails, are you prepared with the right business insurance? Will your insurance cover the sort of failures you foresee? Do you have business interruption insurance that will cover income loss in the event that a major disaster caused the business to lose income? 3. Recovery Planning So you have the prevention and backups in place. Great. Do you know what to do with them? Have you tested them? Will they work when you need them? Do you have all the necessary file locations and passwords prepared and procedures documented so that anyone, specifically your managers and service providers could easily follow those instructions and get your POS back up and running with minimal downtime? Better yet, will your team be able to do it on their own? Remember, in a real disaster your service providers may be overwhelmed with the sheer volume of calls and requests for service. As important as we like to think we are, I’m pretty certain we’re not the hydro or telephone company’s only customer – it might take a while for them to get to you. If this process sounds like it could cost you time and money to complete, you’re right, it can. If you’re wondering if it’s worth it, well, that depends on how much money you can afford to lose if a major disaster was to befall your company and affect your major systems. Sometimes this backup and recovery stuff can be expensive, so how much time should you spend on it and how much money should you spend? The practical answer is that your disaster prevention, backup and recovery systems should be proportional to the amount of loss you would be likely to incur in the event that a major systems failure were to occur. How much tolerance for failure do you have? Can you imagine running your store or restaurant without your information systems? What if your point of sale system was down? What if you couldn’t process a credit card? What if… Read More