CONFIDENTIAL1 ISO22301 Accreditation Finance and Technology Examples, Ken Clark April 2015

CONFIDENTIAL2  Experienced BCM professional in Oil, Banking and Technology sectors  Manage BCM at ARM Holdings in Cambridge 4000 staff across 34 locations globally  ISO22301 certified 2012 and re-certified in 2014  Barclays Bank International Retail Division  Head of BCM with responsibility for 4 x EMEA, 10 x Africa, 1 x Middle East and 1 x India  India BCM program was ISO22301 accredited in 2014  Shell Exploration, Bank of America The views in this presentation are my own and do not necessarily represent the position, strategy, or opinions of ARM Background

CONFIDENTIAL3 ISO22301Test Cases  Barclays Shared Services India  A subsidiary of Barclays Bank  Outsourcing of Back-office and support functions from UK, Europe, Africa and US to low-cost centre in India  Based in Noida, Chennai and Mumbai  ARM Holdings  The world's leading semiconductor intellectual property (IP) supplier  ARM is at the heart of the world’s most advanced digital products. Our technology enables the creation of new markets and transformation of industries and society. We design scalable, energy efficient-processors and related technologies to deliver the intelligence in applications ranging from sensors to servers, including smartphones, tablets, enterprise infrastructure and the Internet of Things.

CONFIDENTIAL4 Why ISO22301?  Barclays Shared Services India  Culturally the operation in India was keen to be formally recognised and accredited.  Seen as confirmation that the program is effective.  Generates pride in the organisation and recognition of the team.  BAU very process driven and having an external validation is a positive reflection on the team, organisation and management.  …although not a view shared in other locations: Singapore, UK, US, Africa  ARM  BCM team based in UK needed to establish the program 3 years ago.  No formal BCM previously in place.  Business Assurance introduced ISO’s as a means to ensure appropriate processes in place across the organisation  ISO22301 seen as providing guiding principles to develop, implement and manage BCM.  Provided a framework to base the program around.  Gave Mgt something to measure against

CONFIDENTIAL5 Achieving Buy-in  Barclays  Lack of engagement from most BCM teams (6 entities all with global reach)  No interest from Senior Mgt teams outside India  Seen as resource and cost overhead for no real benefit  Concerns that the ISO approach did not mirror the internal approach to BCM  Focus was on Impact rather than Risk  Agreed to an initial pilot in India and to look at how the process worked before discussing whether to adopt globally  ARM  Supported by Business Assurance/Audit  Culture of self-assessment  Executive support

CONFIDENTIAL6 The Process  Barclays  Local BCM manager attained ISO Lead Auditor accreditation  Internal pre-accreditation review supported by Operational Risk team  Engaged local consultancy to review program against ISO requirements prior to submission for accreditation  Developed a compliance schedule for documentation reviews and updates  ARM  Led by Business Assurance, working with external partners  ISO22301 guidelines used to develop the program and identify any gap  Working closely with LRQA during inspection process  BCM team attained Lead Auditor accreditation in Dec 2014

CONFIDENTIAL7 Barclays Shared Services  Pro’s  Training of key BCM staff as Lead Auditors  Achieving accreditation to ISO22301 was relatively easy  Little overhead as majority of documents and processes were already in place and available for review  Received good recognition and feedback from local Mgt in India with company-wide announcement on achieving ISO22301 accreditation  Confirmed program was following industry-wide guidance  Cons  A snap-shot in time  Not a measure of capability or maturity of the program  By-line on signature, but little other benefit  Not recognised by UK Mgt as adding value

CONFIDENTIAL8 Arm  Pro’s  Gave structure to the team, none of whom were experienced BCM practitioners  Helped to establish the program  Set a schedule for accreditation and deadlines for having processes in place.  Raised awareness of BCM with the Executive  Set the bar for compliance  Con’s  Developed into a documentation exercise  Lost focus on capability and maturity

CONFIDENTIAL9  Helps to establish a new program and give assurance to Mgt  Follows the BCM Life-cycle and BCI Good Practices  Doesn’t measure capability or maturity  Existing program  Sanity check of processes and documentation  Show-case to customers, regulators, industry forums etc..  Is there a desire for external validation and accreditation  Does your Executive aspire to accreditation So…. ISO22301 or not?

CONFIDENTIAL10 Questions?

CONFIDENTIAL11 Thank You The trademarks featured in this presentation are registered and/or unregistered trademarks of ARM Limited (or its subsidiaries) in the EU and/or elsewhere. All rights reserved. Any other marks featured may be trademarks of their respective owners