Jennie Clinton, Pearce Global Partners May 10 th, 2012

Transcription

1 Jennie Clinton, Pearce Global Partners May 10 th, 2012

2 Workshop Overview Workshop will focus on three area of business resiliency: Business Continuity Plans and Crisis Response Look at how these plans integrate and enable a more efficient response Key components every program should consider Employee Preparedness Critical area often overlooked and how to address Benchmarking and Program Maturity where do you stand?

3 Business Continuity Planning I tell this story to illustrate the truth of the statement I heard long ago in the Army: Plans are worthless, but planning is everything. There is a very great distinction because when you are planning for an emergency you must start with this one thing: the very definition of 'emergency' is that it is unexpected, therefore it is not going to happen the way you are planning. Dwight D. Eisenhower

4 Key components Policy, Charter and Partnerships Document standards, purpose Create a governance board Identify key partners (IT, Risk Management, Human Resources) Business Risk Assessment and Impact (Discover) Business Continuity Plan (Design & Deploy) Crisis Management Plan Personal and Employee Preparedness covered next sessions Program Maturity Covered last session

5 Disaster Event Timeline* Emergency Response Team Immediate life safety tactical response Personal Preparedness Employee/Family Response Crisis Management Strategic / executive response Technical Recovery Critical Technology-based response Business Recovery Business unit response Business as Usual Significant Event Response Phase Recovery Phase Resumption / Restoration Phase * Note that multiple processes could be activated simultaneously

6 Program Structure Program Business Continuity Management Standardized & Consistent Response to Disruptive Events Processes Emergency Management Crisis Management Business Resumption Technical Business Recovery Recovery Immediate Tactical Localized Strategic Executive Cross functional Company-wide Business supporting application / network / systems Escalations Department level Contingency planning Third party vendors Executive planning Key Activities Immediate Response (People/Safety) Triage Decisioning Escalation (Event Mgmt.) Network Recovery (Systems) Workplace Recovery (Process) Triggering Event Medical Fire Power outage Major natural disaster Breach of IT systems Act of terrorism Event driven Business Continuity Management Office coordination Event driven Business Continuity Management Office coordination Standardized Format for distributed application Centrally coordinated response process Integrated technical and business recovery process to disruptive events

7 Business Continuity Plan Development Discover (Impact Analysis) Hierarchy Critical Resources Process RTO & Tier Dependency Design (Strategy & Planning) Location Strategy People Strategy Technology Strategy Internal/External Contacts Gaps Deploy (Exercises) Drills Business Continuity Readiness exercises Maintenance Cycle Begins Criticality 1 < 72 Hours Example of Business Continuity Plan Maintenance Requirements Criticality days Criticality days Criticality 4 2 wks - 3 months - Quarterly BC Plan Update - Quarterly BC Plan Update - Quarterly BC Plan Update - Quarterly Plan Update (Call tree) - Annual BIA/Strategy Refresh - Annual BIA/Strategy Refresh - Annual BIA/Strategy Refresh - Biennual BIA Refresh - Annual BC Plan Exercise - Annual BC Plan Exercise - Biennual BC Plan Exercise * Limited Plan/ no plan exercises 4

8 Plan Components Template is provided at your table Customize to meet the needs of your organization Make sure it is in a format that is: User friendly Scalable Ease of use in an event Relevant At a MINIMUM Immediate actions checklist Critical contacts Scope/process covered Recovery information (resource, steps, dependencies) Recovery strategy

9 Crisis Management & Emergency Response Model National/Corporate Incidents National Crisis Management Team Executive Crisis Manager Senior Leadership Team Regional/Local Incidents and Outages Regional Crisis Management Team Regional Crisis Manager / RVP Emergency Response Plans (ERP) Incident Management Plans (IMP) Business Unit Recovery Plans People & Property Impacts Network & Infrastructure Impacts Business Unit Impacts People Buildings People People Buildings/Call Centers National/Regional Data Centers National Distributions Centers/ Warehouses Retail Stores Data Centers Outages/Escalations for: Information Technology Network Services Critical Business Processes Handle Customer Calls Maintain Billing Process Fund Bank Accounts/Pay Employees Manage Reputation and Brand Impact

10 Working Session 1 Manila has just experienced a 7.2 magnitude earthquake. Impacts have been severe and widespread. Time of the event was 10:00 in the morning

11 Working Session 1 For the next 20 minutes work in groups at your tables. You have a worksheet labeled Session 1 workshop activity Read through the questions and rate yourselves Identify your top three areas for improvement or areas where your business continuity program may have a gap Share your findings and any solutions at your tables We will spend 5-10 minutes sharing findings with the group

12 Personal Preparedness The only thing tougher than planning for disasters is explaining why you didn t. Tim Serban, VP Providence Regional Medical Center

13 Personal Preparedness Why Do It? Corporations care about their people and it is recognized that a higher level of personal preparedness at companies is generally correlated to a faster and more effective response in a crisis. The Philippines are prone to disasters. Known vulnerabilities include: Earthquakes : statistically we are looking at 20 tremors daily, average of four per week that are perceptible. Major earthquakes are fewer and further between. Tsunamis Typhoons: An average of 20 major typhoons annually Floods and landslides Volcanic eruption Best business continuity plan won t work without the people. Almost 40% of small businesses that close due to a disaster event never re-open.

14 How prepared are we? Recent survey results from an area prone to disaster and access to public awareness campaigns: Over 50% did not feel prepared 64% had no family communication plan Emergency Supply Kits: 43% had something in place at home Resulted in creating a program more focused on company employees as a whole

15 Approach Obtain executive support Determine preparedness baseline Create and maintain awareness Provide the how Develop Personal Preparedness SharePoint Site

16 Obtaining Support Often overlooked not easy to justify Focused on creating awareness with leadership Crisis Management Team and Business Continuity Council, key executive champions Worked into exercise scenarios with top executives Provided program outline with a phased approach Determined baseline with company-wide survey General culture of the company

17 Awareness Quarterly sessions with guest speakers Focus on one aspect of preparedness General sessions for all employees, closed sessions for executives Speakers have included State and Local EMD; Dept. of Health; National Weather Service Prizes and giveaways focused on preparedness items Internal communication News articles Monthly preparedness tips Staff Meetings New employee orientation Monthly lunch-n-learn course Focus on one or two elements How to build kits

18 Provide the how Path to Preparedness Breaks into 12 specific steps to help associates prepare Incentives for each step completed Looking for recovery workers to complete these Easy access to 3-day kits, supplies (vendor discounts) for employees Emergency kits provided at subsidized cost Interactive SharePoint Tracks metrics for executives Share resources, tips, events Continuous and immediate feedback

19 What is a Kit? An Emergency Kit is a collection of basic tools and supplies that, if prepared in advance, can help you and your family survive after a disaster! The Basic Components of a Emergency Kit Enough for a MINIMUM of 7 Days : Contact information and a copy of your family emergency plan Food Water Basic First Aid Materials Comfort Items Personal Hygiene Materials Flashlight Tools Basic Shelter from the elements Prescription Medication/eyeglasses We ve provided the American Red Cross Disaster Get a kit Make a plan Be Informed disaster sheet on your CD

20 Working Session 2 We lead by example for our employees. For the next 10 minutes go through the Workshop Session 2: Personal Preparedness Survey Among your table discuss: What was the average score? Most common area scored high? Most common area with a gap? Share thoughts, findings with the group at the end of the 10 minute breakout

21 Working Session 2 We lead by example - Goal: 100% of you to take the first steps towards preparedness: 1. Purchase or create a personal 3-day kit 2. Get a communication plan in place with your family document the following: Complete a wallet card with contact names/numbers for family, friends, work Identify an out-of-area contact that everyone can check in with if communications are unavailable Identify where your child can go if your are separated Identify a meeting place outside your home where your family will rendezvous Identify a neighbor or someone to check on family members that may be in your care, and pets Practice you plan (conduct a communication drill; Call your out of state contact; have everyone meet at the rendezvous point)

22 Benchmarking The best way to retain your clients or customers is to please them beyond their expectations and to keep doing so. unknown

23 Why do we benchmark? Way to assess program against the industry and what has been shown to work Assess program maturity Communicate to Board of Directors or Executive Management Prepare for audit or react to audit findings Determine what type of program fits the culture Best in Class Meets expectations

24 Business Unit Readiness

25 Program Maturity The Business Continuity Maturity Model depicts how companies will achieve their desired resiliency level by providing answers to the following questions: Where are we now, and what will it take to become a World Class Business Continuity Program? Risk Tolerance Low Medium High Source: IBM = IT Industry Common Practice = Retail Industry = MY COMPANY? No strategies or plans Little if any awareness Focused on technology Aware and acknowledge the need Disaster Recovery Plans documented Strategies developed for some systems Cross enterprise recovery requirements understood Business Continuity Program in place Business alignment/ Tier Refresh Executive focus Crisis Management process Regular tests of plans conducted Regular review and update of plans Multi-point Recover Time Objective Regulatory and Supply Chain compliance Recovery plan testing Value derived with customers System failover process validated and routinely exercised Business Requirement validated Monitored Executive Dashboard Unfocused Aware Capable Mature World Class Maturity Level 25 Note: In order to move along the business continuity maturity continuum, all components in the column must be fully established.

26 Working Session 3 A series of questions have been provided at your tables. Spend the next 15 minutes using the worksheets provided spend some time working through these individually or as a group. Identify: Two areas you feel you would rate at the high end Two areas that may need improvement What types of standards or industry comparisons you might incorporate into your survey Spend last few minutes sharing with larger group

27 Resources Disaster Resistant Business - DRB Toolkit (free resources on the site) Red Cross (Preparedness planning and supplies) Generally Accepted Practices Disaster Recovery Institute International Business Continuity Institute

28 Questions? Jennie Clinton Phone: