BIA – moving from Assessment to Analysis via Automation Jason Scott-Taggart Global Head of BCM Technology, Barclays Capital March 2006

About Barclays Barclays has been involved in banking for over 300 years. Operates in over 60 countries with more than 120,000 permanent employees. For the year ended 31st December 2005, the group achieved a pre- tax profit of £5,280 million, up fifteen per cent on In November 2005, Financial News magazine awarded Barclays Capital ‘European Investment Bank of the Year’ in its annual Awards for Excellence.

Business Impact Assessment … Is the way to gather the firm’s resumption/recovery requirements. Gives one of the most comprehensive overviews of an organisation. Empowers you with an in-depth understanding of what is important to the business. BIA is your friend, your sword and your shield!

Time to Recover Cost Low High Slow (days – week) Fast (intra-day) Minimal No investment Dependent on ‘best endeavours’ on the day Basic Limited, if any, investment in recovery facilities Reliance on documented plans, procedures Adequate (take a hit and recover) Investment in a combination of recovery facilities and documented plans and procedures Some degradation of service, greater recovery capability Best in Class (disaster, what disaster?) Greater Investment in a combination of recovery facilities and resilience technologies Rapid recovery capability, with no to minimal downtime Target Profile Initial strategy justified by BIA

BIA at Barclays Relationship Managers create partnership. Has to be a business as usual activity to be ingrained and relevant. BCM are not experts in the business areas and the actual impact of interruption. Level of detail appropriate to them, not defined by BCM.

BIA at Barclays cont. Relationship Managers selected for business skills. Ask business people business questions and ask IT people IT questions. The key to engaging people is to make it easy whilst also making benefit obvious. Need senior management buy in to make this happen. Need senior BCM “co-ordinators”.

How did we automate Out with Word and free form templates. In with “whizzy”, easy to use frontend and database backend. Don’t reinvent the wheel. No retype and live updating. Can drive data quality improvements. Living documents not annual review. Automated online sign off so not chasing bits of paper.

Business Resumption Planning BRP is a checklist, a high level prompt. Produce resumption plan by commenting next to each critical task and add resumption only ones. Critical tasks flow through to lines in the BRP.

Business Resumption Plan Slide Content Removed

Tool’s Evolution - Spreadsheet

Tool’s Evolution - Database

Tool’s Evolution - Web

Obvious benefits Compact and multi format resumption plans. Relevant plans and contact details – only a day old. BRP just output from BIA – combining the process not a separate exercise. Easy to report live on compliance of sign off. Reporting for governance and/or senior management.

Instant Feedback Database contains statement of achievable 3 x R’s, as declared by System Owners: Recovery Time Objective Recovery Point Objective Revised Operating Level Compared with task level required 3 x R’s gives instant RAG reporting. System outage -> business unit affected -> tasks at risk -> potential impact to firm REAL TIME. Testing therefore vital to ensure accurate declaration: Crisis Management Invocation WAR Individual Applications

Other benefits Data changes, simple turn handle for new reports. Automated call notification – no more pretty PowerPoint org charts. Transparent reporting helps with senior management engagement. Seat Planner for WAR sites.

Seat Planner

From Assessment to Analysis … Assessment What do you do that is critical? What is the impact if you cannot do it? What tools/applications do you need to do it? Who do you depend on? Analysis Compare and contrast data in unique ways. High level reporting to senior management of gaps and risks. Prioritise by risk and impact. Further analysis by geography and function for example.

Relational Data Model Locations Business Units PeopleSystems Business Tasks Support/Ownership Relationships/dependencies

Analysis Reporting … Variables, Properties or Criteria Risk Modelling by … Business Function Number of Tasks Impact Scores Environmentals Size / Scale Technological Complexity Headcount Dependencies Business Function Number of Tasks Impact Scores Environmentals Size / Scale Technological Complexity Headcount Dependencies Location Business Units Systems Location Business Units Systems

Draw backs Complexity of data makes back up less straight forward. Need business skills to collate data. Need technical skills to store and link data. Front loaded effort. Can reveal unexpected gaps in capability. Resumption descriptions can be light.

Anyone can do this Have to be a multinational bank with team of developers? Started as Excel -> Access -> SQL. Table entry of tasks – relational. Need not be dashboards on web pages, can be simple query to Excel and mail merges in Word.

In summary Keep it simple and keep it relational. Use authoritative sources of data. Trust your subject matter experts. Emphasise DR should not be a separate consideration. Remember - the BIA is your friend, your sword and your shield!