Aviation is a safety critical industry. Traffic growth puts increasing demand on the automated systems that support a congested infrastructure. These are increasingly dependent on the reliability and accuracy of information and the availability of power, systems and communications. Aviation business continuity plans provide a structured framework within which to manage the continuity of key processes in the event of a crisis or disaster, hence maximising shareholder value, safeguarding reputation and retaining market share. The need for best practise in this area is supported by IATA ACI BCI
Virtual extended enterprises ( ie internet bookings and reservations) are a dominant feature of the airline industry and this is becoming increasingly the case. Extended business enterprises present special challenges to how leaders will manage business continuity. Traditionally an organisation would write business continuity plans and disaster recovery plans for critical processes and applications. However as the infrastructure around a business becomes more complex, an organisation needs to consolidate and streamline continigency planning processes because these virtual assets are exposing organisations to a whole new set of risks in the virtual world. As businesses move closer to real time solutions ( internet bookins / reservations / scanning etc ) the cost of down time goes up as its direct financial consequences become greater. This often leads businesses to have a new appreciation of the risk of disaster. This is what s known as a great paradigm shift.
A useful way to assess the current state, as well as estimate future needs is to benchmark or map current risk exposure. An organisation can ascertain the effectiveness of its current policies by mapping exposure and commitment to risk and value. This can also help leaders evaluate aleternative scenarios as they consider future courses of action.
BCP is the overall strategy - crisis management is how this fits in with the general processes and procedures implemented by the organisations management.
A tiered approach to crisis management is more effective. This allows an organisation to activate its response mechanism quickly yet not over-react or over-deploy. This approach empowers staff at key levels to tackle an event and bring it to more senior levels of management when appropriate and without delays,. This three tiered approach includes alert systems, activation procedures, escalating criteria and staff duty rosters, all of which will have been practised at many levels in scenario based training.
Contingency Planning and Crisis Management An Introduction
<ul><li>The lead body promoting business continuity to the aviation business is the International Air transport Association </li></ul><ul><li>It has established the ABC project which aims to support the non-competitive exchange of information and experience in the development of business continuity plans. </li></ul><ul><li>It works closely with the BCI </li></ul><ul><li>Business continuity within aviation has to cope with a complex web of interdependencies. Serious interruption to one company can have a costly impact on another. </li></ul>
<ul><li>Other factors which to add to this complexity are a reliance on airport authorities, increasing use of third party contractors and vast legislative and institutional regulations. </li></ul><ul><li>Financial institutions/audit requirements now specify that publicly quoted companies must have risk management strategies in place. (responsibility for not having them lies with the company directors) </li></ul><ul><li>Automation of the industry has changed the risk profile unrecognisably </li></ul>
Why Business Continuity? Disrupted Operations can cause; loss of operational capacity loss of data loss of intellectual property loss of reputation loss of confidence diminished shareholder value lost profits lost customers
Phases of Business Continuity <ul><li>Phase One - Preliminary Planning </li></ul><ul><li>Business Impact Analysis </li></ul><ul><li>Dependency Modelling </li></ul><ul><li>Risk Identification and Analysis </li></ul><ul><li>Business Contingency Strategy </li></ul>
Phases of Business Continuity <ul><li>Phase Two - Continuity Plan Management </li></ul><ul><li>Training of personnel in theories of risk, disaster management, plan development and implementation </li></ul><ul><li>Validating plan through crisis simulations </li></ul><ul><li>Implementing maintenance programmes to address industry changes </li></ul>
<ul><li>Phase Three - Crisis and Disaster Management </li></ul><ul><li>Safe evacuation of premises in a crisis </li></ul><ul><li>Liaison with emergency services and security teams at disaster scene </li></ul><ul><li>Communication with the media, customers, suppliers and other key stakeholders </li></ul><ul><li>Relocation of business operations </li></ul><ul><li>Initiation of manual business operations </li></ul>Phases of Business Continuity
Traditional Emerging Focus Minimising the financial impact of disasters Ensuring financial continuity, customer satisfaction and productivity despite a disaster Approach Recovery from single episodes of downtime only Business driven continuous availability through management of information and operational risk Risks Low frequency - high impact disasters Traditional and emerging threats to infrastructure Benefits Recovery of downgraded service expected 12-72 hours after event Up to 99.9% availability of critical infrastructure expected + performance improvement immediately. Enablers Documentary plans reply on after-event recovery Emerging technologies
A Growing, Potentially Costly Capabilities Gap The gap between the cost of downtime and the ability to deliver is widening Increasing cost of unplanned downtime Ability to deliver through traditional mechanisms
Value layers in a business continuity framework. Commitment and Value Risk Exposure Can I Recover my Physical Assets Can I recover my automated processes Am I always able to be there for my customers I am able to offer value chain excellence to all stakeholders React / Control / Transform
PROBABILITY SEVERITY 1 Year 5 Years 10 Years 25 Years 50 Years 100 Years Negligible Marginal Critical Catastrophic
Action/controls already in place Controls to limit severity Controls to limit Responsibility for action Critical success factors and KPI’s Review/test frequency Key Date
Team members Actions in first 24 hours - Stage 1 Action in next 3-5 days - Stage 2 Action from day 5 onwards - Stage 3 Person responsible for completion Review/frequency Test Date
Questions to ask business leaders <ul><li>Is the BCP event driven, risk driven or, stakeholder focused? </li></ul><ul><li>Is the BCP aligned to organisational strategy? </li></ul><ul><li>Who are our stakeholders and what is their tolerance for unplanned downtime? </li></ul><ul><li>Does the BCP address people, processes, technology and the extended enterprise? </li></ul><ul><li>Does the BCP eliminate single points of failure? </li></ul>
Crisis Management Caroline Sapriel “ A Crisis is, by definition, ‘an event, revelation, allegation or set of circumstances which threatens the integrity, reputation, or survival of and individual or organisation.” To be effective, crisis management must be embedded into the corporations management System
<ul><li>Crisis Management gained more corporate focus as we moved into a new millennium. </li></ul><ul><li>Conversion to 2000 in IT </li></ul><ul><li>The events of September 11th </li></ul><ul><li>Crisis by type in the 1990’s </li></ul><ul><li>(source - Institute of Crisis Management) </li></ul><ul><li>65% sudden </li></ul><ul><li>35% Smouldering </li></ul>
The Link Between BCP and Crisis Management Source Journal of Communication Management vol 7, 4 349 Risk Identification Risk Evaluation Minor Loss Severe Loss Pre-loss Loss Post loss Crisis Management Plan Business Continuity Plan Business Recovery Plan <ul><li>Transfer </li></ul><ul><li>Prevention </li></ul>Retain?
Crisis Disaster Emergency Another area of crisis response , made necessary by the attacks on Sept 11th is managing the human element of a crisis. Indeed managing the public, family and employee communication is an increasingly important component of contingency planning.
<ul><li>The airlines had procedures in place to deal with next of kin but, the companies in the world trade centre had very few. </li></ul><ul><li>Major airlines have established processes and ongoing training programmes. </li></ul><ul><li>When an incident occurs, airlines immediately activate their passenger information call centres and mobilise despatch teams to provide support at the accident site. </li></ul><ul><li>Singapore airlines established its next of kin buddying system in 1992 </li></ul>
Reputation Management <ul><li>In a crisis, reputation management best practise consists of </li></ul><ul><li>Preparedness </li></ul><ul><li>Robust yet flexible strategy throughout </li></ul><ul><li>Transparency </li></ul><ul><li>Integrity and honesty </li></ul><ul><li>Two way communication with stakeholders </li></ul><ul><li>Sensitivity </li></ul><ul><li>Ownership and Responsibility </li></ul>
Image - jaso hawkes photography.com Dragonair 2002 embarked on a FAST programme Since Sept 11th = all major industries have expanded their family support programmes. The management of next of kin is often linked with enhanced security procedures .
<ul><li>Workshops to train leaders </li></ul><ul><li>Often scenario based to enable CMT’s to experience the difference between consensus based and command and control styles of management </li></ul><ul><li>Taught to work with stakeholder issues too / risk mapping procedures </li></ul>Image - jaso hawkes photography.com
Image - jaso hawkes photography.com Examples of Aviation Risk Exposures <ul><li>Damage to wide body aircraft - (valued at $200,000,000 per aircraft - up to $300,000,000 with new generation aircraft) </li></ul><ul><li>Injury to passengers, meeters and greeters (settled in UK in excess of £6m for a single life) multiply this by thousands in a terminal and losses could run in to billions. </li></ul><ul><li>Fire risk - if recovery plans are not sufficient - could you rely on insurance £ to re-establish your business? </li></ul><ul><li>Terrorism </li></ul><ul><li>construction issues - I.e. financial performance / failure of contractors / gap in contractors programmes / revenue losses through delay. </li></ul>
Image - jaso hawkes photography.com Conclusion Organisations that are serious about embedding crisis management into the overall corporate strategy have done the following things: Ongoing risk assessments Sound and tested processes Training and practice A strategic approach