The secret of a successful Crisis Management & Continuity Plan

www.needhams1834.com
The secret of a
successful
crisis
management &
continuity plan
London
October 2017
1

Aim
• To provide guidance to delegates on the good and bad aspects of crisis
management continuity plans.
2

Its all in the name
• Incident Management Plan (IMP)
• Emergency Response Plan (ERP)
• Crisis Management Plan (CMP)
• Business Continuity Plan (BCP)
• Continuity of Operations Plan (COOP)
• IT Disaster Recovery Plan (ITDRP)
• Crisis Communication Plan (CCP)
• Fire, Health and Safety Plan (FHSP)
• The list goes on…..
3
IT
DOESN’T
MATTER!

Definitions
4
“Documented Procedures that guide an organization to respond,
recover, resume and restore to a pre-defined level of operation
following a disruption”
ISO 22301
“A documented collection of procedures and information that has
been developed, compiled and maintained in readiness for use in
an incident and allows an organisation to maintain the delivery of its
key products and services”
Business resilience
BCI Good practice guidelines

Definitions
• Sanity check what you put in it, ask yourself
– Is this going to be useful at the time of a disruption?
5
“A set of plans to aid you in dealing with a disruption”
Dummies Guide to Business Continuity

The ugly plan
• AKA its not ergonomic
• Full of jargon, lacks clear language
• Cumbersome and hard to handle
• Does not make full use of all the tools of clarity: flowcharts, bullet points colour coding
• Too much content – contains policy type content
• Contains mistakes
Avoid the jargons and black art
• Don’t be your own worst enemy
6
“BIAXX stipulates that Process XY has a MTPoD of 1.2 days therefore Dept. SAP
London has invoke and recover system QWE TO meet an RTO of 0.5 days”

The bad plan
• Out of date
• Assumption based
• Incongruent with other policies and procedures
• No linkage to other plans
• Doesn't conform to naturalistic decision making of group expected to use it
• Disjointed instrumentalism – the science of muddling through, measuring progress
• Gap between the plan and reality
• Does not consider all phases of an incident (response, continuity and recovery)
• Misaligned to stakeholder requirements
7

What signifies it’s bad or ugly?
• The ‘mm’ depth of dust on it!
• The fact it is not used during an exercise or incident
• It is not updated
• It receives negative feedback
• The audit did not go well
• You struggle to understand it!
8

The good plan
9
“Our BC Plans and Reponses should be elegant”
Head of Business Continuity, International Bank
“Everything should be made as simple as possible,
but no simpler”
BCI Good practice guidelines

What makes the plan good
It is axiomatic i.e. the opposite of a bad plan
• It is current
• Assumption are validated and stated
• Is aligned to procedures and policies
• Seamlessly links to other plans
• Aids decision making
• Allows progress to be measured
• What the plan requires can be achieved in reality
• Covers each phase of a disruption (response, continuity and recovery)
• Considers all stakeholder needs
10
Concise, accessible
and easy to use

Pre-requisites
11

BIA
Identify
• Key services/functions supporting your organisation’s objectives
• Critical activities that support these services
• Assess impact resulting from failure of each critical activity over time
• Establish maximum tolerable period of disruption and recovery time objective for each critical
activity
• Constraints and dependencies
12
Key
services
Critical
activities
Constraints and
Dependencies
Impact
MTO
and RTO

13
Time Zero
Business RTO
Maximum Tolerable Period of Disruption (MTPD)
• Emergency Response
• Incident Management
• Recover critical activities
• Business Resumption at pre-defined level
Business recovery to
business as usual

BIA
Identify
• Key services/functions supporting your organisation’s objectives
• Critical activities that support these services
• Assess impact resulting from failure of each critical activity over time
• Establish maximum tolerable period of disruption and recovery time objective for each critical
activity
• Constraints and dependencies
14
Key
services
Critical
activities
Constraints and
Dependencies
Impact
MTO
and RTO

Determining your BCM strategy/solution
• People
• Premises
• Technology
• Information
• Equipment and suppliers
15

Strategies and Tactics
Strategies
• Diversification – RTOs measured in minutes and hours
• Replication – RTOs under a day
• Standby – RTOs greater than a day
• Post Incident Acquisition – RTOs measured in days or weeks
• Do nothing – generally for specialist equipment
• Subcontracting – generally a gap for diversification or used in manufacturing
16

Strategies and Tactics
Tactics
• People – skills and knowledge
• Premises – buildings and facilities
• Resources –IT, information, equipment and materials
• Suppliers – products and services supplied by a 3rd party
17

Developing dependency strategies
• Identify potential options to meet the RTO of a critical activity
• Select most appropriate
• Implement
• Continually review/amend
18

19
The business resilience and continuity framework

Executive
management
board
(Strategic level)
• Priority focus – reputation, revenue, major
capital assets
• Sets aim and objectives for business recovery
• Media
• External strategic communication with major stakeholders
• Resolve major resource issues
• Horizon scanning
20

Crisis
management
team
(Tactical level)
• Manage resources to achieve strategic aim and objectives
• Plan, resource and coordinate recovery of critical activities
• Ensure effective communication and liaison (internal and some
external)
• Resolve/escalate Bronze/Operational level resource issues
• Assess/manage risks “how bad can this get/what happens
next?”
• Plan for/manage return to business as usual
21

Departments
and sites
(Operational level)
• Undertake tasks to recover critical activities
• Escalate resource constraints
• Communications (internal and external at
operational level)
• Liaison with emergency services and other responders at
incident site
• Set-up, occupy and operate a business recovery site (as
appropriate)
22

What we want – the TAM
23

24
Immediate
Response
• Invocation
• Initial Meeting
Stabilising
the situation
• Considered response
• Supporting information
Business
Continuity
• Strategies
Structure and contents
• Considerations:
– Flow of incident?
– Context / culture of your
organisation
– User friendly

Up front - flow chart?
• Quick guide to what is required
• Detail covered in the main plan
• Don’t over complicate
25

26
Your intent / objectives
• Communicates vision and overall
direction succinctly
• Acts as a guidance point
for everyone involved in managing
a disruption to your business
• Conveys precise goals and authority
(permissions) to levels of management to take
control of an incident or crisis, recover critical
activities and protect the business
“Fight on”
Winston Churchill, May 1940

Examples of an intent
• Law firm managing a no access situation
– Minimise interruption to normal levels of operations and service for all stakeholders
• Mining Company
– People
– Environment
– Assets
– Reputation
27

Invocation – When, how, who and where
• Escalation criteria
28
Escalation Level
Dealt with at a
function level
Crisis
Management
Team notified
Crisis
Management
Team invoked
Strategic Team
notified
Crisis Management Team invoked
Strategic Team invoked
Type of Impact
Impact Rating
Insignificant
1
Minor
2
Moderate
3
Major
4
Catastrophic
5
Operating Loss
Inconsistent
operating
cost/waste
elimination
M&W KPI’s
performance
Declining
performance of
operating
cost/waste
elimination
KPI’s causing
potential failure
to achieve AOP
M&W quarter
objectives
Declining
performance of
operating
cost/waste
elimination KPI’s
causing failure to
achieve AOP
annual objectives
Potential major
(double digit)
deviation from
the AOP
operating cost
objective.
Verified major
(double digit)
deviation from
the AOP
operating cost
objective
Reputation
In house
(Plant/DC’s)
product quality
issue
Potential
product quality
issue
Potential for
product recall or
contamination
Verified product
recall or
contamination.
Potential
consumer health
negative impact
and media alert.
Verified product
recall or
contamination
that impacts
consumers or
results in
negative media
reporting
People
Staff
absenteeism %
causing
manufacturing
plan changes
(production
schedule)
Isolated minor
staff injury
Staff
absenteeism %
causing
potential failure
to deliver
month
production plan
Serious staff
injury
Staff
absenteeism %
causing potential
failure to achieve
the AOP volume
Multiple serious
staff injuries
Staff
absenteeism %
which may cause
major (double
digit) deviation
from the AOP
sales demand
Death of a
member of staff
Staff
absenteeism %
causing major
(double digit)
deviation from
the AOP sales
demand
Multiple deaths of
members of staff

• Notification protocols
– Business as usual and out of hours
– Communications
– Who will invoke – the full team or a decision making quorum
• Team membership
– Primary Team
– Alternates
– Core team and full team or full team
29

• Notification protocols
• Team membership
• Roles and responsibilities
– During an incident
• Locations – primary and alternate
– At your premises
– Loss of building
30

31
Meeting Agenda
• Support timely decision making
Ser Action Responsible Remarks Time
1 Assign roles:
 Allocate crisis management team support
staff
 Set ground rules of the meeting
Team Chair 1 minute
2 Receive update on disruption
 What is the nature of the disruption?
 What is the status of staff?
 When and how did it occur?
 What is it impacting?
 What is being done about it?
As per
disruption
2 minutes
3 Thinking time for each member to identify issues
and action for their function
All Done in silence 2 minutes
4 Round table presentation of immediate issues
and actions by function
All Only to present
on own
function
7 minutes
5 Confirmation of actions and strategic direction
that might be required
Team Chair 2 minutes
6 Time and location of next meeting
 Determine which team members are
required at next meeting
Team Chair 1 minutes

Initial Considerations:
32
Ser Considerations
Complete

1 Have you got a clear understanding of the disruption and its potential impact?
2
Do you need to take any immediate action to ensure that staff are not exposed to any
further or unnecessary danger
3 Does the disruption impact any of the core processes or the reputation of XXX.
4 Does this require the Strategic Team to invoke?
5
Is a conference bridge required for members to dial in on?
Set up Lync conference call
6 What immediate direction needs to be given to staff?
7 Are all staff, contractors and visitors accounted for?
8 Do government authorities need to be notified?
9 Are you able to receive a situation update from the Incident Controller?
10 Does production need to be prioritized to fulfil demand?

Role specific recovery considerations:
33
Ser. Considerations
Recovery Time
Objective
(if applicable)
Completed

1 Coordinate accounting procedures for all staff, visitors and OEM’s
2
Obtain list of current employees, visitors and contractors and bring to Crisis
Management Team meeting
3 Manage and advise on all people issues during the crisis management meetings
4
Staff management:
 Provide advice to those affected on what HR assistance they can be given
 Consider religious requirements, and arrange for relevant clerics if appropriate
 Ensure XXX. representation at any hospital utilized by casualties
 Monitor in-house impacts (morale, problems, rumours)
5
Emergency contact management:
 Is there a requirement for a location in which emergency contacts can be met by
a XXX. representative?
 Ensure appropriate management of calls to and from people affected
6 Assess need for additional assistance (ongoing process)
7
Consider employment contracts and implications of temporary or permanent changes
to staff terms and conditions
8 Confirm welfare information

Stakeholder plan:
34
Stakeholder
What is
communicated
Means Responsible Point of contact Comments
Regulator
Impact and scale of
disruption.
Guidance required.
Phone.
Face to face briefing.
Chief Operating
Officer.
XXXX.
Regulator must be
notified if the
Strategic Team are
invoked.
Maybe needed to
provide influence at a
government level.
Key supplier
Impact and scale of
disruption.
Immediately
informed of any
fatalities.
Phone.
Email.
Chief Operating
Officer.
XXXX.
XXX are responsible
for all media
communications.
Customers
Clarity regarding
any product recall
or food safety
issue.
Face to face briefing.
Written communication.
Sales Director.
Head of Sales.
XXXX.
Any external
communications to
customers must be
aligned to XXX
approved messages.
No message can be
sent to customers
until the XXXX
message has been
issued.

Annexes or other contents
35
• Key continuity information – detail information in operational plans
• Specific contingency plans
• End of crisis procedures
• Decision making tools:
– Information / Issues / Action work sheets
– Timeline
• Casualty tracking boards
• Logging sheets
• Battle box contents / locations

TIME
IMPACT
Planned Performance Level
Critical Performance Level
Survival Performance Level
Trained Team
BCP
Untrained Team
Hot Plan
Disaster
Ad Hoc Team
Some
Signif
Hrs Days+
So the secret for me actually is…

Cost of Complacency
TIME
IMPACT
Improved Shareholder Value
Immediate
Loss
BCP
Cost of Poor Training
Hot Plan
Disaster
Poor
Planning
Cost
Hrs Days+
Some
Signif

38
• Validation:
– Workshops exercise
– Talk through
• Staff awareness:
– Their role
– Plans in place
• Team competence:
– Training
– Exercising
– Learning from lessons
Validation and training:

ISO 22301 Training Courses
 ISO 22301 Introduction
1 Day Course
 ISO 22301 Foundation
2 Days Course
 ISO 22301 Lead Implementer
5 Days Course
 ISO 22301 Lead Auditor
5 Days Course
Exam and certification fees are included in the training price.
https://pecb.com/iso-22301-training-courses| www.pecb.com/events

?
admin@needhams1834.com www.needhams1834.comNeedhams1834
THANK YOU
+44 (0)20 7353 9498 @Needhams1834
4th Floor, 2-3 Hind Court, Fleet Street, London EC4A 3DL, UK

The secret of a successful Crisis Management & Continuity Plan

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to The secret of a successful Crisis Management & Continuity Plan

Similar to The secret of a successful Crisis Management & Continuity Plan (20)

More from PECB

More from PECB (20)

Recently uploaded

Recently uploaded (20)

The secret of a successful Crisis Management & Continuity Plan