Post-Merger Maintenance and Maturity Assessment
Summit Care Network operates 11 clinics and two hospitals. After a merger, it inherited three different continuity plans, 14 vendor contracts with varying recovery commitments, and a BIA that still lists a retired electronic health record module. A recent internal audit found that 9 of 40 critical contact records were outdated, two clinic managers had never completed continuity training, and the disaster recovery test for the patient portal had not been run in 18 months. The board wants a maturity assessment against a recognized standard and a maintenance calendar. The new resilience director has a budget of $150,000 and two staff. The CIO argues that maintenance should wait until the EHR migration finishes in nine months. The audit committee meets quarterly and expects measurable improvement.
1. How should the director scope a maintenance and assessment program given the budget and the CIO's request to defer? What should be done in the first 90 days?
Read the worked answer
Do not accept a nine-month deferral. The audit findings are current risk, and the EHR migration increases, not decreases, the need for maintenance because it changes systems, vendors, and process dependencies. In the first 90 days, perform risk-based triage. Fix the 9 outdated contact records immediately and set a monthly validation cycle for all 40 critical contacts. Assign the two untrained clinic managers to the next available session and set a training completion target for all managers. Run the patient portal DR test within 60 days, even if scoped, and document results.
Reconcile the three inherited plans into one core plan with clinic annexes. Update the BIA only for the retired EHR module and any changed processes, then schedule a full refresh. Build a vendor register from the 14 contracts and request recovery evidence from the highest-risk vendors first. Use the $150,000 for targeted DR testing, training, and a maturity assessment, not a full rewrite.
Treat the EHR migration as a trigger for a post-migration BIA and plan review. Report progress to the audit committee quarterly.
2. What metrics and governance should be reported quarterly to demonstrate measurable improvement?
Read the worked answer
Use a balanced scorecard with measurable, trendable metrics. Suggested quarterly metrics: percentage of critical contact records validated within 30 days; percentage of managers and incident roles trained; percentage of critical suppliers with current recovery evidence; percentage of corrective actions closed on time; number of plans reviewed on schedule versus trigger-based; DR test success rate and time to recover against RTO; BIA currency for tiered processes; and maturity score against the chosen standard. Report baseline and target for each, with trend arrows and exceptions.
Governance: the resilience director owns the program, section owners own content, and the audit committee receives the scorecard quarterly with a risk register showing overdue items. Escalate any critical finding within 30 days.
Use the maturity assessment to set a 12-month improvement roadmap, not a one-time grade. This gives the board measurable evidence and prevents maintenance from being deferred behind the EHR migration.