A CIO’s Perspective: Reconciling Risk Management with Disaster Recovery Tactics by Sanjay Verma, Global Business Process, IT Risk & Compliance Manager, Foster’s Group (SABMiller) at the Australian CIO Summit 2012

1. establishing relationship
RISK Management
and
DISASTER Recovery
Sanjay Verma
source: Microsoft templates

2. DRIVERS
REGULATORY
LEGISLATIVE
BUSINESS
Good business practices
source: Google images

3. OUTCOME
source: Google images

4. the FIVE
PRINCIPLES

5. 1 BUSINESS
IS
KING

6. source: Google images

7. Financial Reporting
YOUR
BUSINESS

8. 2
RELATIONSHIP

9. BUSINESS
IT
source: Google images

10. Financial Reporting
BUSINESS PROCESS
CONTROLS
IT CONTROLS
source: Google images

11. OPERATIONAL RISK
Risk Management Business Continuity
Management
Key Method ………….. …………..
Key Parameters ………….. …………..
Type of Incident ………….. …………..
Size of events ………….. …………..
Scope ………….. …………..
Intensity ………….. …………..

12. OPERATIONAL RISK
Risk Management Business Continuity
Management
Key Method Risk Analysis Business Impact Analysis
Key Parameters Impact & Probability Impact & Time
Type of Incident ………….. …………..
Size of events ………….. …………..
Scope ………….. …………..
Intensity ………….. …………..

13. SINGLE
3 INTEGRATED
FRAMEWORK

14. BUSINESS CONTINUITY MANAGEMENT
INTEGRATION OF 3 DISCIPLINES
CRISIS
MANAGEMENT
(Corporate issues)
DISASTER BUSINESS
RECOVERY CONTINUITY
(IT system (Process
availability) contingencies)

15. 4 ENABLING
HOLISTIC
APPROACH

16. Financial Reporting
Internal / External Audit
Business Process
Controls
IT Risk & Security
Professionals
IT Environment
source: Google images

17. Risk Assessment Selection of Controls
Leads to
reduces Deterrent
Threats
Controls
exploit
reduces Preventive
Vulnerabilities
Controls
causing triggers
discovers Detective
Incidents
Controls
affecting
triggers
Assets
producing
reduces Corrective
Business Impact
Controls
source: http://sabsa.org

18. SEPARATING
5 GOVERNANCE
& MANAGEMENT

19. Department People, Seats, Cost Centre, Plan Owner
Worst Time,
Process #1 Process #2 Process Workflow State
Frequency, Criticality
Work- IT IT Special Internal
Network Vital
station Applicat- Special Require- Depen- Suppliers Roles
Drives Records
Builds ions Needs ments dencies
All-Hazards Approach to “Loss of Resource Type”
source: BCM Ina Box

20. BRIDGING
GAPS “CORE” of RISK MANAGEMENT
THE INFORMATION ‘BRIDGE’
Owner RTO RPO
BNZ BNZ BNZ BNZ BNZ BNZ NAB Cert NAB
LOC Auk Auk Auk Auk BNZ BNZ BNZ BNZ BNZ BNZ Mel Mel Mel Mel Mel Mel Mel Mel Mel Mel Mel Mel
Analytical Marketing Database
Alpha Orange Alpha
IT Service Name
Over10 database
SIG database
Connectivity
FTP/XCOM
CLS server
SDR tags
AQ Pack
Genesys
BRAINS
Encoder
Connex
TRIAD
CDS
CPS
TDP
BTZ
B2K
BIS
CIF
AP
Process / IT Services matrix
Name of Critical Process Name of Sub-Process MAO
Payments / Clearing and Settlement
Obligations
g g g g
Cards Settlements Credit Card Issuing 24
Cards Settlements Process Merchant Acquiring 24
g g g
Cards Settlements #1 EFTPOS Debit Cards 24
g g
g g
Cards Settlements ATM Settlement 24
Inward & Outwards
g
Retail Interchange Interchange positions
Same day Cleared 24
Payments (Assured Value
g g g
Retail Interchange Payments)
Process #2
24
Cheque and Lodgement
g
Retail Interchange Processing 24
g g g
Retail Interchange Direct Debit Processing 24
g g
Retail Interchange Direct Credit / Bill Payment 24
g g
Retail Interchange Automatic Payments 24
g
Retail Interchange Foreign Cash 24
g g g g g
Retail Interchange Dishonours 24
PROCESS-BY-IT SERVICES VIEW
source: BCM Ina Box

21. source: Google images

22. Risk
PROFESSIONALS No COMPANY can
are divided as to make a profit
how to determine without taking risk
risk appetite
Taking RISKS without
consciously managing it can
lead to the downfall of
organisations

23. Thank You