Business Continuity Basics David Tickner MBCI

Business Continuity Planning What is it? Why is it so important? What part can you play? What’s in it for you?

What is BCP? the processes by which business can be maintained to an acceptable level until full processes and systems are restored the plans and supporting procedures that guide the continuity or timely recovery of business operations following an unplanned interruption to business operations over an extended period BCP is about minimizing the impacts of critical events on an organisation and its stakeholders [internal and external]

Business Continuity in context Disaster Recovery - the creation & execution of plans to recover the data & systems of an organisation to the point immediately prior to the interruption Contingency - the physical or process alternative to a single point of failure eg. Back up generator for power failures Operational Continuity - the alternative processes implemented during a failure, which allow the “process” to continue, whilst relying on the contingencies or DR Plans to restore full operations Business Continuity - the processes by which business can be maintained to an acceptable level until full processes and systems are restored

A Key Component of Compliance & Business Resilience Where does BCP Fit In A Key Component of Compliance & Business Resilience MYTHS & ASSUMPTIONS If you have an IT DR Plan you don’t need BC Planning Contingency planning and risk management cover BCP We’ve already got Evac. Plans We’re well insured against losses We’ve been OK until now and survived a few problems – we’ll be OK! BCP is a minimalist approach Emergency Management Risk Management BR IT/DRP BCP Crisis Management

Goals of BC Planning To identify the organisation’s key processes To identify the critical underlying technology & services To identify the critical stakeholder relationships To identify the alternative approaches To establish a plan[s] that can be readily and effectively activated To provide real operational alternatives To identify the key processes that ensure “business as usual” during any major operational interrupt To identify the critical underlying technology & services that support those processes To identify the critical stakeholder relationships without which the business could not effectively operate To identify the alternative approaches to be employed in the event of technology/service failure To establish a plan[s] that can be readily and effectively activated on the occurrence of an interrupt “event” To provide the organisation with real operational alternatives, whilst recovery processes/backups are being activated

In the event of……. The nature of the major impact incidents would be those that result in: Extended loss of, unavailability of or denial of access to the organisation’s major location at .....................................; Extended loss of, or unavailability of key personnel required to deliver the key functions; Extended and significant interruption to critical supply chain goods and services; Extended loss or unavailability of critical infrastructure necessary for the operation of the organisation or the delivery of its services; Extended loss of or unavailability of key information/vital documents, including electronic data & systems, Or the combination of or consequential impacts of any of the above impacts.

Why is BCP so important? Recent international and business crisis events September 11 - Hurricane Katrina Asian Tsunami - Christchurch ‘quakes BP Oil Rig blow-out - Carbon Tax Corporate governance/compliance Sarbanes-Oxley, APRA, ASIC/ASX, because of failures like HIH Insurance, Enron Protecting assets, employees and stakeholders The influenza pandemics Government - for the public good New fire warning and evacuation regulations Public transport, public safety

The Basic BC Planning Model

Identifying Key Stakeholders Supplier’s Supplier(s) Customer’s Customer(s) Supplier Customer A C S Your Organisation C S A S C B B Potential impacts on you Potential impacts you could create

Recovery Actions – too soon? Or too late? COST/IMPACT Short RPO RPO Long RPO RTO MAO Recovery solution Impact without action TIME Unrealistic - Cost Realistic - Optimal time, cost & Impact Unrealistic - Impact & Time

Everyone has done BC Planning before. Just take a holiday…..seriously A Simple BCP Everyone has done BC Planning before. Just take a holiday…..seriously

The Safeway Warehouse Fire A perfect scenario…..

In review What went right? What went wrong?

The Real Benefits of BCP Maintaining a viable ongoing business Continuity of key services Reduces and manages uncertainty An aid to meeting legal and moral commitments Protection of: Staff & staff confidence Assets Reputation Economic position A firm level of security for both suppliers and customers

Establishing a lasting & effective culture Business Continuity Essentials: Corporate Commitment Staff understanding & training Stakeholder engagement Planning & testing Continuing Review and Revision

Consulting Principal – Computrix Services P/L Your Presenter David Tickner MBCI Consulting Principal – Computrix Services P/L