BUSINESS CONTINUITY & DISASTER RECOVERY: LESSONS FROM PALESTINE

Transcription

1 International Journal of Management (IJM) Volume 7, Issue 1, Jan-Feb 2016, pp , Article ID: IJM_07_01_003 Available online at Journal Impact Factor (2016): (Calculated by GISI) ISSN Print: and ISSN Online: IAEME Publication BUSINESS CONTINUITY & DISASTER RECOVERY: LESSONS FROM PALESTINE Riyad Mustafa Mohammad Abu Shehadeh Research Scholar, RTM Nagpur University INTRODUCTION Acts of terrorism and various widespread natural disasters have underlined the substantial risk of major operational disruptions to the financial system. Financial industry participants have common interest in promoting the resilience of the financial system to such disruptions 1. The Palestine Monetary Authority 2 (PMA) being the regulatory authority for the banking system in Palestine has paid great attention to this vital issue due to its importance to the stability of the Palestinian banking system especially in the light of the huge political risk in Palestine resulting from the Israeli occupation and the impact of occupation on all spheres of the Palestinians' life mainly the economic sector. As part of the ongoing efforts of the PMA to preserve the safety and soundness of the banking sector, enhance the confidence of the public in the banks, continuity of the financial services and maintaining the financial stability in Palestine, the PMA has adopted a strategy, plans and processes to mitigate different kinds of risks facing banks, especially in disasters, contingency and emergency cases. The business continuity and disaster recovery regulations issued by the PMA to the banking system in 2012 was tested practically during 2014 Israeli war against Gaza. Key words: Disaster Recovery, Business Continuity, Risk Management, Crisis Management, Alternative Sites (AS). Cite this Article: Riyad Mustafa Mohammad Abu Shehadeh. Business Continuity & Disaster Recovery: Lessons from Palestine. International Journal of Management, 7(1), 2016, pp IMPORTANCE & OBJECTIVES Palestine is a unique country. It is not fully independent and does not have full control over its own land, economy and borders. This has added more challenges and risks that the banking system had to face, absorb and mitigate. The PMA was proactive to adapt its supervisory systems and regulations to the best international practices including in the field of business continuity and disaster recovery. The World Bank 26 editor@iaeme.com

2 Business Continuity & Disaster Recovery: Lessons From Palestine (WB) and the International Monetary Fund (IMF) have commended PMA on its experience in the field of business continuity and disaster recovery 3. The WB requested the PMA to participate with the group of payment systems development with other central banks and the WB aiming to develop crisis management manual for the payment systems 4. This paper aims at highlighting the singularity of the Palestinian experience in this field and the impact of the achieved results on financial stability. BROAD PROBLEM AREA Palestine is a unique country with unusual circumstances due to the Israeli occupation, incursion, curfews and wars that severely impact banks' business continuity and ability to maintain banking services in stress scenarios. Two years after the inception of the Palestine National Authority (PNA) in 1994, Intifada (Uprising) erupted in 1996 and has seriously affected lives of the Palestinians. Economy was severely hit. The second Intifada erupted in 2000 and it has seriously affected the business continuity of the banking system, in 2008, 2012, and 2014 several wars were started by Israel against northern governorates (Gaza). PMA had to take several measures to coupe up with the results of the wars and its impact on the banking system and continuation of services to the customers. LITERATURE REVIEW Basel Committee on Banking Supervision (BCBS) The issue of business continuity in the financial industry has attracted international importance. To this end a joint forum from BCBS and International Organization of Securities Commissions (IOSCO) and International Association of Insurance Supervisors (IAIS) was established and issued a paper titled "High-level principles for Business Continuity" in The paper has set the definitions of the alternate site as "the site that is held in readiness for use during a business continuity event to maintain an organization's business continuity. The term applies equally to the work space or technology requirements. Organizations may have more than one alternate site. In some cases, an alternate site may involve facilities that are used for normal day-to-day operations but which are able to accommodate additional business functions when a primary location becomes inoperable". The paper has also identified the business continuity as "a state of continued, uninterrupted operation of a business. Business continuity management is a whole-of-business approach that includes policies, standards, and procedures for ensuring that specified operations can be maintained or recovered in a timely fashion in the event of a disruption. Its purpose is to minimize the operational, financial, legal, reputational and other material consequences arising from a disruption". The high-level principles for effective business continuity management are applicable to both financial industry participants and financial authorities. Below are a brief of those principles as set by the (BCBS): Principle 1: financial industry participants and financial authorities should have effective and comprehensive approaches to business continuity management. An organization's board of directors and senior management are collectively responsible for the organization's business continuity. Principle 2: financial industry participants and financial authorities should incorporate the risk of a major operational disruption into their approaches to business 27 editor@iaeme.com

3 Riyad Mustafa Mohammad Abu Shehadeh continuity management. Financial authorities business continuity management also should address how they will respond to a major operational disruption that affects the operation of the financial industry participants or financial system for which they are responsible. Principle 3: financial industry participants should develop recovery objectives that reflect the risk they represent to the operation of the financial system. As appropriate, such recovery objectives may be established in consultation with, or by, the relevant financial authorities. Principle 4: financial industry participants and financial authorities should include in their business continuity plans procedures for communicating within their organizations and with relevant external parties in the event of a major operational disruption. Principle 5: financial industry participants and financial authorities communication procedures should address communications with financial authorities in other jurisdictions in the event of major operational disruptions with cross-border implications. Principle 6: financial industry participants and financial authorities should test their business continuity plans, evaluate their effectiveness, and update their business continuity management, as appropriate. Principle 7: business continuity management should be reviewed by the financial authorities. Financial authorities should incorporate business continuity management reviews into their frameworks for the ongoing assessment of the financial industry participants under their jurisdiction. PMA's Business continuity regulations PMA has developed a road map keeping in mind to maintain soundness, stability and resilience of the banking system in Palestine. Since 2006 it started to update the entire required legal infrastructure to meet these objectives including revisiting laws, regulations, instructions and circulars meant to enhance banking supervision 5. The business continuity instructions no. 2/2009 that the PMA issued to the banks was a milestone in this direction. Business continuity management in banks is considered an important risk management tool. Due to the nature of the political and security situation in Palestinian that is characterized by instability and volatility, additional risks resulted that banks in Palestine have to mitigate in addition to the operational risks and risks of natural disasters. So, the PMA required banks to develop and have a predetermined business continuity plans. In brief the PMA instructions to the banking system covered the following main areas: Definition of business continuity management The business continuity management means "standardized methods set for the operational continuity of the business in any bank in emergency situations. It also includes policies, standards and procedures to be taken to ensure continuity of operations in emergencies and/ or restore normal operations in a timely manner, in order to reduce the operational, financial, legal and reputational risks and other substantial effects of business disruption and emergency cases". All banks in Palestine were instructed to follow pre identified steps to maintain business continuity in the event of risk. The business continuity management plan should be defined, written 28 editor@iaeme.com

4 Business Continuity & Disaster Recovery: Lessons From Palestine and a comprehensive action plan which sets out the procedures, processes and systems required for the continued restoration of operations at the bank in cases of disruptions and emergency. The plan should be determined according to the needs and the vision of each bank for the business management in emergency situations and risks. The risks and threats faced by banking system Banks face different risks and each of them requires a different mitigation measures. Banks being deposits takers can suffer a huge lose in case of business disruption since it has a severe impact on the customers confidence. Some of the risks that banks may face are fraud, theft, extortion, armed robbery, human errors, terrorist operations, civil disobedience, riots, internal disturbances, strikes and wars. Banks may as well face natural disasters including fire, flooding, bad snow storms, heavy rains and tornadoes. Banks may also face air pollution and chemical spill, earthquakes, volcanoes, epidemics and infectious diseases. Banks are also subject to technical disasters like communications outages, blackouts, deficiencies in equipment, and shortcomings in the software. The scale of the disaster The scale of the disaster might include one room or set of rooms, entire floor, the whole building, the entire facility, entire industrial or commercial sector or the entire State. The objectives of developing business continuity plans In addition to the goal of protecting the reputation of the bank through development of the business continuity plan, there are many other objectives that include reduction of impact of losses or injuries among individuals and fixed assets and information systems, promptly and effectively respond to the threats and risks, flexibility and management capacity in the abnormal conditions characterized by significant imbalances, enhancement awareness of the banks' staff about the importance and purpose of business continuity, recovery of the critical processes and the costs, compliance with the legal requirement of the contracts and relevant laws as well as maintaining the integrity and quality of business continuity plan and keep readiness through regular review and update. The relationship between business continuity management and risk management The risk management process is associated with the business continuity plans and they complement each other as business continuity is integral part of operational risk management. The period covered by business continuity management plan Developing business continuity plan must be made keeping in mind that it should run to a period not exceeding one month. If the event or the risk continues more than a month then it becomes an integral part of the environment in which the bank operates and therefore the bank should develop and have in place working procedures for the event and not a contingency plan editor@iaeme.com

5 Riyad Mustafa Mohammad Abu Shehadeh Responsibilities of the Board and senior management The responsibilities of the board of directors and senior management include: 1. Adoption of the business continuity plan and any amendments thereto, and the development of appropriate policies to improve the ability to work in the event of irregular operating business. 2. Establishment of a special committee to handle business continuity management. 3. Approval of a working team. 4. Ensuring that there is a policy of risk management processes, developed and constantly updated and to make sure their application. 5. Allocation of the necessary resources, including financial and qualified human resources. 6. Receiving reports regarding the progress of the of business continuity, including the results of the implementation and examination of the plan, and the errors found in the application process of the plan. 7. Ensuring review of the plan by an independence party such as internal or external auditor. The use of historical data and databases All banks must prepare and create a detailed database of all operations and functions in the bank and that the data include: 1. All the detailed operations and functions in the bank and the time to complete them as well as the required number of needed staff. 2. Detailed customers data and the nature of the services provided to them and their addresses. 3. Detailed data on staff and their skills and the processes and functions. The review and update of the plan The plan must be reviewed and updated periodically, based on the following: 1. Examination results. 2. Change in the plan for the team, and employees of an organization that affects the plan. 3. Use of new technology that affects the work environment. 4. Introduction of new banking services or abandon of other services. 5. Opening of new banking branches, closure or shifting of branches/offices. 6. Adoption of a new marketing policy. Plans of business continuity management Business continuity plans vary from one bank to another depending on the nature of the business, the size, the geographical spread of its operations and the environment in which it operates. But it is proposed to divide the business continuity management plans to the three main components: 1. Business Continuity Plan for departments and branches It should contain establishment of the business continuity team and choosing representatives of relevant departments on the command center in charge of branches and departments 30 editor@iaeme.com

6 Business Continuity & Disaster Recovery: Lessons From Palestine business continuity. Contact details of the chosen team members should be clearly written. Substitute for each member should also be identified. The critical functions, how to restore them in case of disaster and the required staff to do so need to be clearly identified. Required budget need to be arranged and the plan need to be tested on regular basis. 2. Disaster recovery plan (DRP): this plan aims to restore all operations relevant to information technology in a quick and efficient manner in case of risk and threat. It includes going back to the normal conditions after overcoming the disaster situations. This plan works consistently with the business continuity plan of the departments and branches. This plan makes available to the business continuity plan the needed physical needs required for the business continuity in the departments and branches. 3. Crisis Management Plan: this plan comes to complete the previous two plans as the first plan describes the necessary written procedures that need to be taken as to face the expected risks and threats, whereas the second plan is aims to preserve the information technology environment that the bank works within. And ultimately preserve the bank's information that is considered to be critical for the bank maintain operations, whereas the third is crisis management plan that accomplishes business continuity plans as a whole and it depends on how to deal with the risk or threat when it happens and the required procedures from all the staff and providers to seal with those risk. The main reason to develop disaster recovery plan is to preserve lives and health of the staff in addition to the aims meant to achieve through business continuity plans. 4. Business continuity measure taken by the PMA: Implementation of an effective business continuity management at the PMA He PMA being the regulator of the banking system has developed its own business continuity plan and the (AS) to ensure the continuity of its operations in case of disasters and crisis. PMA has taken several steps to put in place an effective and efficient business continuity plan for its own operations. Those steps are listed below: 1. Develop Strategies and business continuity policies within the PMA. 2. Surveyed all the PMA departments aiming to defining critical operations within the PMA. 3. Defined the PMA's necessary staff that is needed to perform all the defined critical operations. 4. Made ready the business continuity plan. 5. Made ready the needed logistics. 6. Trained and qualified the staff assigned to follow up the implementation. 7. Information technology. 8. Premises and (AS). 9. Conducting periodical tests to ensure viability. 10. Review the procedures and steps in light of recent developments in this field issued by the regulatory bodies' i.e Basel Committee editor@iaeme.com

7 Riyad Mustafa Mohammad Abu Shehadeh The PMA processes adopted for the implementation of an effective program for business continuity management at banks: PMA has taken many steps to build up and enhance its' capabilities in the field. Following are the most important steps taken by the PMA: 1. Training and qualifying of the staff assigned to follow up the implementation of business continuity management program. 2. Developing the business continuity and information technology supervision unit within the Supervision and Inspection Department (SID) that follows up the banks' commitment to implement an integrated program for the business continuity management and audit of information technology in the banks. 3. Issuing instructions to the banking sector to prepare a comprehensive business continuity programs and preparation of the (AS's). 4. Development of several pre requisites that should be available in the banking premises prior to granting the necessary licenses to start the banking business. The most important criteria was the presence of emergency exits and first aid equipment, doors, windows, safes, and manual and automatic fire extinguishing equipment, and providing multiple sources of energy licenses (alternative electricity generator and a central UPS), as well as providing a stockpile of fuel, which is enough for a month. 5. Centralization of the banking operations: executing the large banking operations centrally, rather than through branches have many advantages.i.e. providing the adequate supervision and the alternative procedures from other sites to implement in the emergency situations. 6. Alternative sites: in addition to centralization of the banking operations, the PMA has required the banks to provide alternative working sites located at least 50 kilometers from the main head office so as to run the main operations through the (AS) when necessary. The (AS s) have been tested to guarantee its smooth functioning at emergency and crisis time. 7. Disaster Recovery Sites (DRS): running operations through the DRS makes it easier to control, fulfils better security requirements and provides public safety. 8. The formation of liaison groups (PMA & banks) to follow up and better manage any crisis on timely basis. 9. Rationing banks working hours to ensure the continuity of financial services during the crisis. 10. Intervene in the arrangements of transporting banks employees in Gaza in ambulances during and after the war and during the truce. 11. Facilitating availability of hundreds of thousands of liters of the needed fuel through coordination with fuel stations to keep Gaza banks operational. 12. Green energy: the PMA encouraged the banking system to utilize the green energy to help overcome shortage of electricity. 13. Efficiently managed the available liquidity with the Gaza banks to avoid liquidity crisis. 14. Helped and facilitated cash shipments amongst banks to feed ATM s with needed cash during the war. 15. PMA managed efficient and effective communication methods including the use of timely mobile messaging system editor@iaeme.com

8 Business Continuity & Disaster Recovery: Lessons From Palestine PROBLEM STATEMENT How to enhance banks' ability to continue providing banking services during crisis? Hypothesis H1: The PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in 2014? RESEARCH METHODOLOGY Taking into consideration the importance of the issue, the researcher adopted sampling population aiming to arrive at accurate results. The researcher has used the questionnaire tool to collect the needed data and he used Likert scale to measure the variable (banks' ability to continue banking services during war time in 2014). A: Target populations and Sample Size Our target population will be Gaza based banks that operated and provided services to the customers in Gaza during war time of The same will be our sample size. B: Source for the data To collect primary data questionnaire will be distributed to all banks that operated in Gaza during The PMA reports relevant to the banking system in Gaza will be used. DATA ANALYSIS By using SPSS model the results were as follows: Banks' ability to continue banking services during crisis time 47.5% 31.3% 8.4% 12.4% 0.4% strongly don t don t abstain strongly 33 editor@iaeme.com

9 Riyad Mustafa Mohammad Abu Shehadeh Banks' ability to continue banking services during war time 2014 strongly don t don t abstain strongly Mean Std. Deviation Banking services provided by branches are acceptable during crisis time..0%.0% 2.4% 58.5% 39.0% Banking Hours are sufficient during crisis time..0% 4.9% 12.2% 48.8% 34.1% Types of banking services are sufficient during crisis time..0% 2.4% 9.8% 61.0% 26.8% Non continuity of banking services during crisis time did not affect customers' needs. 2.4% 39.0% 19.5% 29.3% 9.8% ATM's are distributed in a way that meets customers' needs..0% 7.3% 19.5% 43.9% 29.3% ATM's are operational continuously. 2.4% 7.3% 14.6% 31.7% 43.9% ATM's make available continuously all currencies..0%.0% 7.3% 46.3% 46.3% Cash withdrawals are made per the need..0% 2.4% 17.1% 58.5% 22.0% Banking services are easily provided during crisis time..0% 22.0% 9.8% 53.7% 14.6% Needed time to get banking services during crisis is sufficient..0% 7.3% 22.0% 41.5% 29.3% All banking services are provided during crisis..0% 14.6% 19.5% 36.6% 29.3% Sufficient staff were present in the banking during crisis time.0%.0% 4.9% 53.7% 41.5% There was efficient communication with all branches during crisis time..0% 2.4% 2.4% 53.7% 41.5% PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in % 8.4% 12.4% 47.5% 31.3% RESULTS 1. According to our analysis as shown in the annexure no. 2 the hypothesis (The PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in 2014) is accepted. 2. There is a huge positive impact for the regulation on the ability of banks to continue the banking services during crisis as we obtained 78% of the results as strongly and. RECOMMENDATIONS We recommend the following: 1. Continue application and development of the regulations online with best practices since it has a positive impact on the banking system services during a crisis. 2. Continue regular meetings of the crisis management liaison group the PMA established with the banking system. 3. Adoption of the Palestinian model of crisis management in the countries facing same circumstance editor@iaeme.com

10 Business Continuity & Disaster Recovery: Lessons From Palestine REFERENCES [1] [2] [3] [4] [5] [6] M.Rajeswari. A Study on Credit Risk Management in Scheduled Banks. International Journal of Management, 5(12), 2014, pp [7] Dr. Shivakumar deene, An Empirical Examination of Liquidity Risk Management with Special Reference To Vijaya Bank. International Journal of Management, 6(11), 2015, pp NOTES [1] High-level Principles for Business Continuity, A paper published on BIS.org [2] PMA was established as the regulatory authority in Palestine after the peace process in the early 90's and took charge from Bank of Israel in [3] Source: PMA reports. [4] PMA, the Banking Anchor issue no. 88, December [5] Source: editor@iaeme.com

11 Riyad Mustafa Mohammad Abu Shehadeh ANNEXURE 1 Questionnaire Greetings This questionnaire is developed as a part of a research titled (Disaster recovery & Business Continuity: Lessons from Palestine). You are kindly requested to complete the questionnaire using ( ) in front of the choices ahead of each statement. The analysis will be solely used for the research purposes only. Thanking you No Availability of banking services during crisis (2014 aggression) Statement Banking services provided by branches are acceptable during crisis time. Banking hours are sufficient during crisis time Types of banking services are sufficient during crisis time. Non continuity of banking services during crisis time did not affect customers' needs ATM's are distributed in a way that meets customers' needs. ATM's are operational continuously ATM's, make available continuously all currencies Cash withdrawals are made per the need Banking services are easily provided during crisis time Needed time to get banking services during crisis is sufficient All banking services are provided during the crisis Sufficient staff were present in the bank during crisis time. There was an efficient communication with all branches during crisis time Agree Abstain Don't Agree don't 36 editor@iaeme.com

12 Business Continuity & Disaster Recovery: Lessons From Palestine ANNEXURE 2 Banking services provided by branches are acceptable during crisis time. Frequency Cumulative Abstain Agree Banking Hours are sufficient during crisis time. Frequency Cumulative Don t Abstain Agree Types of banking services are sufficient during crisis time. Frequency Cumulative Don t Abstain Agree Non continuity of banking services during crisis time did not affect customers' needs. Frequency Cumulative don't Don t Abstain Agree editor@iaeme.com

13 Riyad Mustafa Mohammad Abu Shehadeh ATM's are distributed in a way that meets customers' needs. Frequency Don t Abstain Agree Cumulative don't ATM's are operational continuously. Frequency Cumulative Don t Abstain Agree ATM's, make available continuously all currencies. Frequency Cumulative Abstain Agree Don t Cash withdrawals are made per the need. Frequency Cumulative Abstain Agree editor@iaeme.com

14 Business Continuity & Disaster Recovery: Lessons From Palestine Banking services are easily provided during crisis time. Don t Frequency Cumulative Abstain Agree Needed time to get banking services during crisis is sufficient. Don t Frequency Cumulative Abstain Agree Don t All banking services are provided during crisis. Frequency Cumulative Abstain Agree Sufficient staff were present in the banking during crisis time Frequency Cumulative Abstain Agree editor@iaeme.com

15 Riyad Mustafa Mohammad Abu Shehadeh There was an efficient communication with all branches during crisis time. Don t Frequency Cumulative Abstain Agree strongly don t don t abstain strongly Mean Std. Deviation Banking services provided by branches are acceptable during crisis time..0%.0% 2.4% 58.5% 39.0% Banking Hours are sufficient during crisis time..0% 4.9% 12.2% 48.8% 34.1% Types of banking services are sufficient during crisis time..0% 2.4% 9.8% 61.0% 26.8% Non continuity of banking services during crisis time did not affect customers' needs. 2.4% 39.0% 19.5% 29.3% 9.8% ATM's are distributed in a way that meets customers' needs..0% 7.3% 19.5% 43.9% 29.3% ATM's are operational continuously. 2.4% 7.3% 14.6% 31.7% 43.9% ATM's make available continuously all currencies..0%.0% 7.3% 46.3% 46.3% Cash withdrawals are made per the need..0% 2.4% 17.1% 58.5% 22.0% Banking services are easily provided during crisis time..0% 22.0% 9.8% 53.7% 14.6% Needed time to get banking services during crisis is sufficient..0% 7.3% 22.0% 41.5% 29.3% All banking services are provided during crisis..0% 14.6% 19.5% 36.6% 29.3% Sufficient staff were present in the banking during crisis time.0%.0% 4.9% 53.7% 41.5% There was efficient communication with all branches during crisis time..0% 2.4% 2.4% 53.7% 41.5% PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in % 8.4% 12.4% 47.5% 31.3% editor@iaeme.com

16 Business Continuity & Disaster Recovery: Lessons From Palestine PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in % 31.3% 0.4% 8.4% 12.4% strongly don t don t abstain strongly H1: The PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in 2014? According to the data shown in the figure above we can accept the study hypothesis, which says that PMA's regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in 2014 with value of Mean reached 4.00, the percentage in and strongly together above 78% editor@iaeme.com