Business Continuity Planning & Simulation Testing:

Transcription

1 Business Continuity Planning & Simulation Testing: Optimisation Techniques for a Better Response Presenter: Bruce L Scott,CBCP Partner Risk & Business Continuity Services 21 February bruce.scott@jm.pwc.com Phone: *connectedthinking

2 Presentation Outline What is a business interruption? What is business continuity planning (BCP)? Highlights of a successful BCP recovery: Fiduciary Trust Co. International (9/11) Statistics on the state of BCP readiness Selling the BCP investment An optimised approach in developing a BCP capability Critical elements for BCP success 2

3 What is a Business Interruption? Event Risk Response Controls (Optimised?) Measurement Strategic: Arrival of cheaper widgets from overseas on the local market Reduced sale & possible closure of the local business Risk Mitigation Investment in more modern technology to reduce production cost Unit cost of production Compliance: The bank being used by money launderers Significant reputationa l damage & regulatory penalties Risk Prevention Provide AML training & support to staff Number of AML training hours & undetected AML breaches 3

4 What is a Business Interruption? Event Risk Response Controls (Optimised?) Measurement Operational: Fire at corporate head office that hosts the data centre & key business units (trading, accounting, credit) Loss of lives & failure to give customer access to their funds Risk prevention & mitigation Development and implementation of a business continuity capability Business continuity plan test results KPI: BCP should be tested twice per year 4

5 What is Business Continuity Planning? A definition: Procedures that are instituted to continue the operations of your business despite a significant interruption (to its buildings, IT systems or employees) with the ultimate objective of restoring the business to pre-disaster levels. 5

6 What is Business Continuity Planning? Threats Your Business m e n t O p e Risk Ma n ag e Reputation Shareholder Value Corporate Governance Ethics r a ti o n al Res ilience Safety Net Emergency Response Planning (People) Business Continuity Planning (Business units) Disaster Recovery Planning (IT systems) 6

7 BCP Case Study: Fiduciary Trust Co. Int l (September 11) Key Learning Points and Challenges 1. This case highlights how a robust business continuity program mitigated the impact of the 9/11 disaster on Fiduciary Trust Co. Int l 2. They successfully recovered critical business processes within hours and today, the company is stronger than before 3. There were other companies that did not recover very quickly, or only had recovery plans that were IT centric 7

8 BCP Case Study: Fiduciary Trust Co. Int l (September 11) Key Learning Points and Challenges 4. Key questions to consider are: How did Fiduciary Trust manage to recover so quickly? Could you recover from a major interruption given the state of BCP readiness of your company? What if your phone rang right at this minute, and you were told that your office building was engulfed in flames? What would you do? 8

9 BCP Case Study: Fiduciary Trust Co. Int l (September 11) Company Profile 1. The company managed $40B in assets 2. Had over 6,000 institutional and high net worth individual investors 3. They had offices on the 93rd through 97th floors of the South Tower, right where the second plane struck. 4. They had approximately 500 employees 9

10 BCP Case Study: Fiduciary Trust Co. Int l (September 11) Sequence of Events 1. Steven Tall, the CTO and Disaster Recovery Coordinator of Fiduciary Trust received a call from his wife re the attacks while on his way to work 2. Given his position and the nature of the disaster, Steven did the following: Immediately declared a disaster (Disaster Declaration & Command & Control Procedures) Quickly called the firm s disaster recovery site in New Jersey to alert staff there that Fiduciary would need their services. (Access to Key Telephone Numbers & an Alternate Processing Site) 10

11 BCP Case Study: Fiduciary Trust Co. Int l (September 11) The Impact (Justifies the BCP budget/spend) 1. Eighty-six Fiduciary Trust employees were killed (People Impact) 2. Also, one employee from the firm s parent company, Franklin Templeton was killed 3. Several business partners who were visiting the offices were also killed 4. Loss of key IT systems (IT Impact) 5. Customers were inconvenienced (Business Impact) 11

12 BCP Case Study: Fiduciary Trust Co. Int l (September 11) The Response 1. Fiduciary employees knew to make their way to the disaster recovery facility as soon as possible (Alternate Site) 2. Within hours of the attack the company had done the following: Secured accurate backup data (Vital Records Management) 12 Re-established basic telephone and computer communication (IT & Communications Recovery Plan)

13 BCP Case Study: Fiduciary Trust Co. Int l (September 11) The Response 3. The following day (Wednesday) the firm was able to move money via wire transfers. (Business Impact Analysis & Department Level Recovery Plans) 4. On Thursday the company was trading bonds (Business Impact Analysis & Department Level Recovery Plans) 5. By Monday it was trading equities when the US stock market re-opened. (Business Impact Analysis & Department Level Recovery Plans) 13

14 BCP Case Study: Fiduciary Trust Co. Int l (September 11) The Response 6. Fiduciary was also one of the first companies to sign a new, long-term lease for office space after the attack. (Recovery Team Roles & Responsibilities) 7. They had parent company (Franklin Templeton) support (Tone at the top) 8. They had CEO (Anne Tatlock) and Board level support (Tone at the top) 14

15 BCP Case Study: Fiduciary Trust Co. Int l (September 11) Post 9/11 Improvements to Their BCP Capabilities 1. They enabled staff to work from home (Alternate Recovery Site) 2. They increased the number of individuals empowered to declare a disaster to include West Coast staff (in the event all the East coast managers are lost) (Disaster Declaration & Command & Control Procedures) 3. All managers now carry a card in their wallets with critical phone numbers and information in the event of a disaster. (Emergency response or people response planning) 4. The whole IT system is tested two or three times per year (Hot sites or alternate IT sites and plan testing) 15

16 Statistics on the State of BCP Readiness Many companies in the region are not comprehensively prepared (less than 10%) Plans tend to be IT centric and they often ignore business units such as treasury, accounting etc 16

17 Statistics on the State of BCP Readiness Recent Gartner survey findings: 85% of large companies (USA) have IT recovery plans Only 25% of these companies have business unit recovery plans (e.g. for treasury, accounts etc) PwC s Observation: Ironically BCP spend has only increased marginally since 9/11 and this is felt to be due to dollars being diverted away to deal with the increased cost of compliance due to financial reporting 17 scandals such as Enron

18 How to Sell the BCP Investment to your Board BCP Investments should be treated like other investments i.e. a business case should be made along the following lines: Competitive advantage Major customers who depend heavily on their suppliers for critical services are now requiring these suppliers to have a robust BCP capability» Major IT service bureaus» Call centres» 10 to 20% of companies are now requiring this level of assurance (Giga report 2002) 18

19 How to Sell the BCP Investment to your Board Competitive advantage Question: If your company were to be invited to tender on a major bid tomorrow, but a prerequisite for entering was having a BCP capability, would you miss out on the opportunity? 19

20 How to Sell the BCP Investment to your Board Compliance with regulatory requirements e.g. in Bahamas, USA, Europe. Thought: More Caribbean regulators (financial services) may soon start to require that financial services companies have BCP programs In May 2007 Central Bank of the Bahamas made it a requirement for licensees to have robust business continuity plans. Extract from the Regulatory Guideline PU1-0406» In the case of a licensee that is a branch of a foreign bank, the head office s BCP will suffice, if the plan makes adequate provisions in line with these Guidelines for the licensee. 20

21 How to Sell the BCP Investment to your Board Protection of people (most important) Protection of the life and safety of employees and customers The people cost was the highest cost in 9/11 Fidelity Trust lost 86 (17%) out of 500 staff Question: Would your staff know what to do and where to go if there was a major fire at work? 21 Commitment to client service delivery Especially providers of financial services, health care (protection of medical records) and other time critical businesses the cost of being down would be too significant, even if the chances of being down is low: Question: Does your company have a robust business continuity program which could provide seamless client service delivery? E.g. E-Government Systems

22 BCP capability Approaches to Developing a BCP Capability Traditional Recovery capability Impact Analysis & Extensive Documentation Testing Rewrite plan Contemporary (PwC s Optimised Approach) Impact Analysis & Framework Simulation & Plan Implement Cost 22

23 Traditional Approach 1. Do threat assessment e.g. fire, flood, earthquake, virus etc Risk accept, prevent, mitigate or transfer Do Report (e.g. See Sample Facilities & IT Risk Report & Questionnaire) See case the Morphy Richards case - UK 23

24 Traditional Approach 2. Do business impact analysis (BIA) Key processes and recovery time objectives (RTOs) E.g. For an Accounts Dept: Payroll, Statutory Reporting, Bank Reconciliations Minimum resource requirements (people, technology etc) Impact on the company (financial, reputational & legal) Identify internal and external dependencies Do Report (e.g. See Sample BIA Report & Sample BIA Template) 24

25 Traditional Approach 3. Identify recovery strategies that meet RTOs Do a short list of the possible recovery options Do nothing Replicate everything Choose strategy between do nothing and replicate everything Highlight the advantages and disadvantages of each Estimate the cost (one time and recurring for each) 25 M k d ti t th B d

26 Traditional Approach 4. Extensive documentation of the plan.over 200 pages in some cases! See sample plan template 5. Testing of the business continuity plan 6. Rewrite or amend the plan based on the test results 7. BCP is not seen as a living part of the company, but the problem of one or two persons 26

27 PwC s Optimised BCP Approach Threat assessment (same as traditional approach) Do business impact analysis (same as traditional approach) Do simulation of a disaster Airlines are now doing simulated hijacking on actual flights (June 2005 ABC news) Document a focused plan based on simulation results...much less than 200 pages 27

28 PwC s Optimised BCP Approach No need to rewrite the plan as the plan is documented after the simulation BCP is seen as a living document, that is integrated naturally into the parts of the organization where it fits 30 to 40% reduction in project time and cost The simulation exercise results in a higher level of BCP awareness among the participants 28

29 PwC s Optimised BCP Approach This approach builds a least cost route for a robust BCP capability by setting BCP into the organisation s context Where does BCP fit in the organisation and how to get maximum leverage? Corporate links/fit Organisation How much are we going to spend and how? Strategy Model What parts will be centralised? command, control, communication 29

30 PwC Optimised BCP Approach Why corporate links? BCP Complaints BCP is very expensive on its own (why spend all this money on something that may never happen?) Optimised Solutions 1. Need to leverage all existing functions and management structures to reduce BCP cost Excess office space across a large group e.g. training rooms, meeting rooms Standardising IT systems Strategically locating staff and business processing various geographies Leveraging the corporate security department to lead the emergency response planning, Using your corporate communications department to handle most of the PR and communications issues 30

31 PwC Optimised BCP Approach Why corporate links? BCP Complaints BCP is a symbiote (now that we ve got a plan we can forget about BCP) Optimised Solutions Treating BCP as a project will doom it to failure it is not normally a front of mind activity. It must move from project stage to becoming an embedded process as is preparing the financial statements at the end of the month 31

32 PwC s Optimised BCP Approach What is the overall recovery strategy? Do nothing Replicate everything Choose a strategy that is between doing nothing and replicating everything 32

33 PwC s Optimised BCP Approach How to choose a BCP model? By subsidiary By geography Centrally controlled (Head Office) By industry 33

34 PwC s Optimised BCP Approach How is the Simulation done? Scenario Tailored, realistic crisis situation Build response capability through experience Test assumptions Learning and awareness exercise Team building Plans Fit for purpose Thin Assigned roles and responsibilities Recovery strategies for each process Resources available to support recovery High-level action plans to achieve recovery 34

35 PwC s Optimised BCP Approach Live Demo of How the Simulation is Done 35

36 PwC s Optimised BCP Approach Simulation exercise - what to look for People Natural leadership Ability to remain calm Ability to communicate clearly Understanding of individual (own and others) roles and responsibilities Team work Process Information gathering and confirmation Clear objective setting Actions to control and contain Recovery strategy development Monitor and follow up Communication strategy 36

37 Contemporary Approach Simulation exercise - debrief Formal debrief What worked What didn t work What could we do to improve What are our strengths Perspectives from all Capture follow up implementation actions Plan development Confirm BCP model Confirm structure for this component Use skeleton plan to input process with each role separately Build on any existing processes or procedures if possible Discuss implementation implications 37

38 Client Feedback: Major Regional Entity: PwC Ja. Led BCP Project BCP Simulation Exercise Evaluation Results: 2007 Overall, the exercise was a success I understood my role The exercise opened my eyes to many problems The exercise will help me in a real life disaster I would encourage other companies to do a similar exercise I now better appreciate the importance of having predetermined recovery decisions I now have a better appreciation for the need to have a robust system of accounting for staff I enjoyed the exercise Max Rating (5.0)

39 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI (Interestingly many of the lessons learned here correspond to the actions that led to success by Fidelity Trust Co. Int l) The need for information management Classification of information: assess all document types and assign an information classification e.g. critical, necessary, public Digital storage and retrieval Clear desk policy and disciplined use of vaults & fire proof cabinets Consider the viability of staff working from home during a crisis Working from home policy must be developed Information security and equipment must be in place 39

40 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Media communications must be properly managed Develop policy about media communications and authority levels Leverage your own staff that is trained in media relations Ensure staff is aware of message to give to media, regardless of the incident 40

41 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Building evacuation Designate assembly points and ensure that the staff know where these are Print a special telephone number on staff s IDs for them to call to confirm their whereabouts in the event of disaster Keep current list of staff contact details Ensure all emergency exit lights work and stairways are clear of hazards Insist on use of visitors log and employees swiping into the building ; will help to account for visitors and staff on the building the day of the disaster 41

42 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Board level support and BCP structure Establishment of a BCP Committee and a BCP Coordinator Visible and public support from the CEO (Anne Tatlock Fiduciary Trust) and other executives (e.g. attendance at the simulation) BCP is not the IT manager s problem Consider locating key employees and business processes on separate buildings 42

43 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Command & control immediately after an incident Identify teams and alternates with specific roles to take command of an incident Develop clear procedures for liaising with public authorities Develop clear disaster declaration procedures and authority levels 43

44 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Information technology If possible, avoid having the data centre on the same building as the business units (e.g. accounting, treasury etc) where possible Establish backup telecommunication links (online data replication for very time sensitive business processes) Save company data on network drives 44

45 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Alternate Sites Leverage unused office space at other subsidiaries A hot site is not necessarily the most cost effective option: do a proper BIA to confirm if this is so Ensure contracts with alternate site providers are robust and consider data privacy issues (e.g. overseas based alternate sites) 45

46 Optimisation Keys for BCP Success Lessons Learned from recent PwC Jamaica Led Simulations for companies in Jamaica, Trinidad & BVI Business Processes Develop pre-determined and specific recovery strategies for all time sensitive business processes (e.g. payroll, payment of client funds that matures on the day of the disaster etc) - Fidelity Trust recovered as follow: - Payments 24 hours (Tuesday, 12 Sept 2001) - Bond trading 24 hours (Wednesday, 13 Sept 2001) - Equities trading 5 days (Monday, 18 Sept 2001) Identify all vital records that are required to support the business processes (e.g. transaction data, contracts, etc) 46

47 Conclusion Michael Magdol, vice chairman of risk management, Fidelity Trust Co. Int l: A DR plan will never work if it s not driven from the top down from people who say they are deadly serious, says Magdol. That s the most important thing. There also has to be an allocation for it in the budget. It s going to cost money to put it in, and there has to be a belief in the need for it. 47

48 Presenter Profile Bruce L Scott FCA,FCCA,CISA,MBA,CBCP, CISM,CIA,CPA,CFE Bruce is a certified business continuity professional (CBCP), with the Disaster Recovery Institute International, USA and has developed and worked on business continuity plans for Jamaican, Regional and Canadian companies. In Jamaica, he is the partner in charge of risk assurance services, which include internal audit outsourcing, internal controls optimisation, business continuity planning and systems and process assurance. Bruce has conducted simulation testing and developed IT, business unit and emergency response plans for major government and financial institutions in the Caribbean. 48

49