Business Continuity Planning



       by Brian Andrews
Business Continuity Planning
• What is it?

• Why do it?

• How do you do it?

• Who does it?
Strategic Approach to Business Continuity


 Phase      Risk and Business Impact Analysis                   Business Continuity Plan Development          Phase
   1        • Review Existing Documents                         • Master Business Continuity Plan:              2
            • Validate / Prioritize Mission Critical Business         •   Crisis Management, Command Center
              Functions                                               •   Disaster Recovery, Hot Site
            • Perform Risk Assessment                                 •   Business Resumption
            • Conduct Business Impact Analysis                        •   High Availability
            • Analyze Alternative Solutions                           •   Plan Monitoring Strategy
            • Present Findings and Recommendations




Phase
                                                                                                                Phase
  3
                                                                                                                  4
  Testing of Business Continuity Plans                                      Cost of Downtime
  • Create Enterprise Testing Strategy
                                                                            • Productivity
  • Prepare for Plan Tests                                                  • Damaged Reputation
        • Test Scenarios
        • Test Cases
  • Execute Plan Tests
  • Revise Plans (as required)
Risk Impact Analysis
       Formulating Continuity Strategies
Without a plan, a natural or man made disasters are;
•Loss of work to competitors
•Failures within the supply chain
•Loss of reputation
•HR Issues
•Health and Safety Liabilities
•Increased Insurance Premiums

Worst Case: Failure of Business
Business Impact Analysis
   Understanding the Balance between Costs, Likelihood of a Disruption
                          and Business Impact

                                                     Disruption       • Likelihood
                                                      Occurs          • Magnitude
                                                                      • Financial Impact




                                                                           Recovery Cost            Resume
                                                                                                     Ops

                                                                  •   Recovery Performance
                                                                  •   Time to Recover
   Normal
                      Protection Investment           Event       •   Scope of Recovery
    Ops
                                                                  •   Crisis Management

• Identify Critical     • Prevention / Preparation
  Functions               Strategy Based on ROI
• Risk Assessment       • Plan and Response                                  Business Impact
• Business Impact         Development
  Analysis              • Scope of Protection                     • Lost Revenue
                        • Ongoing Incremental                     • Customer / Partner Confidence
                          Expense                                 • Regulatory / Legal Issues
Business Continuity Plan
           Development
                         PROCESS                               Ongoing
Change Management Education            Testing       Review    Process

                          Testing
 Group Plans               Risk              Implement
and Procedures           Reduction        Standby Facilities
                                                               Project
               Create Planning Organization

                     Recovery Strategy
                       Risk Analysis
                 Business Impact Analysis

  Policy        Organization        Resources         Scope

           Business Continuity Planning Initiation
Updating & Testing Plans
• Your Continuity plan MUST BE EMBEDDED in how
  each business unit operates every day
• Business Function Managers MUST BE
  RESPONSIBLE for ensuring that strong change
  management controls are in place!
• Change Control ensures that NOTHING GETS INTO
  PRODUCTION without Continuity Team sign-off!
• Constant TESTING IS IMPERATIVE!
• QUARTERLY AUDITS & executive reporting are
  essential!
• Training off staff is imperative
                                                  7
What Is Your Cost of Downtime?
     Productivity                                   Revenue
     • Number of                                    • Direct loss
       employees impacted                           • Compensatory
       X hours out X                                 payments
       burdened hourly rate                         • Lost future revenue
                                                    • Billing losses
                                                    • Investment losses

Damaged Reputation                                  Financial Performance
• Customers                                         • Revenue recognition
• Suppliers                                         • Cash flow
• Financial markets                                 • Lost discounts (A/P)
• Banks                                             • Payment guarantees
• Business partners        Know your downtime       • Credit rating
                         costs per-hour, -day, -two • Stock price
                                 days ...
   Other Expenses
   Temporary employees, equipment rental, overtime costs,
   extra shipping costs, travel expenses
Conclusion
• Development and implementation of BCP
  maintenance processes are critical to ensure
  that the BCP is in a state-of-readiness

• Management will only realise the value of
  their investment in business continuity
  when a real disaster situation strikes the
  organisation

IMI business continuity presentation

  • 1.
  • 2.
    Business Continuity Planning •What is it? • Why do it? • How do you do it? • Who does it?
  • 3.
    Strategic Approach toBusiness Continuity Phase Risk and Business Impact Analysis Business Continuity Plan Development Phase 1 • Review Existing Documents • Master Business Continuity Plan: 2 • Validate / Prioritize Mission Critical Business • Crisis Management, Command Center Functions • Disaster Recovery, Hot Site • Perform Risk Assessment • Business Resumption • Conduct Business Impact Analysis • High Availability • Analyze Alternative Solutions • Plan Monitoring Strategy • Present Findings and Recommendations Phase Phase 3 4 Testing of Business Continuity Plans Cost of Downtime • Create Enterprise Testing Strategy • Productivity • Prepare for Plan Tests • Damaged Reputation • Test Scenarios • Test Cases • Execute Plan Tests • Revise Plans (as required)
  • 4.
    Risk Impact Analysis Formulating Continuity Strategies Without a plan, a natural or man made disasters are; •Loss of work to competitors •Failures within the supply chain •Loss of reputation •HR Issues •Health and Safety Liabilities •Increased Insurance Premiums Worst Case: Failure of Business
  • 5.
    Business Impact Analysis Understanding the Balance between Costs, Likelihood of a Disruption and Business Impact Disruption • Likelihood Occurs • Magnitude • Financial Impact Recovery Cost Resume Ops • Recovery Performance • Time to Recover Normal Protection Investment Event • Scope of Recovery Ops • Crisis Management • Identify Critical • Prevention / Preparation Functions Strategy Based on ROI • Risk Assessment • Plan and Response Business Impact • Business Impact Development Analysis • Scope of Protection • Lost Revenue • Ongoing Incremental • Customer / Partner Confidence Expense • Regulatory / Legal Issues
  • 6.
    Business Continuity Plan Development PROCESS Ongoing Change Management Education Testing Review Process Testing Group Plans Risk Implement and Procedures Reduction Standby Facilities Project Create Planning Organization Recovery Strategy Risk Analysis Business Impact Analysis Policy Organization Resources Scope Business Continuity Planning Initiation
  • 7.
    Updating & TestingPlans • Your Continuity plan MUST BE EMBEDDED in how each business unit operates every day • Business Function Managers MUST BE RESPONSIBLE for ensuring that strong change management controls are in place! • Change Control ensures that NOTHING GETS INTO PRODUCTION without Continuity Team sign-off! • Constant TESTING IS IMPERATIVE! • QUARTERLY AUDITS & executive reporting are essential! • Training off staff is imperative 7
  • 8.
    What Is YourCost of Downtime? Productivity Revenue • Number of • Direct loss employees impacted • Compensatory X hours out X payments burdened hourly rate • Lost future revenue • Billing losses • Investment losses Damaged Reputation Financial Performance • Customers • Revenue recognition • Suppliers • Cash flow • Financial markets • Lost discounts (A/P) • Banks • Payment guarantees • Business partners Know your downtime • Credit rating costs per-hour, -day, -two • Stock price days ... Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses
  • 9.
    Conclusion • Development andimplementation of BCP maintenance processes are critical to ensure that the BCP is in a state-of-readiness • Management will only realise the value of their investment in business continuity when a real disaster situation strikes the organisation