Business Continuity Management 2022: Where we have been? Where are we going?

Transcription

1 Business Continuity Management 2022: Where we have been? Where are we going?

2 Agenda Introduction Business Continuity Management (BCM) 2022 overview BCM 2022 highlights Methodology BCM skill set Crisis management Vendor resiliency Wrap-up PwC 2

3 Introduction PwC 3

4 Introduction Business continuity management is a continually-evolving initiative that is impacted by and must constantly adapt to: Updated technology and software Changing business models Unforeseen and emerging risks New regulations and standards Internal and external demands Recently, several clients have asked us to give them a crystal ball view for BCM 2022 how business continuity has recently changed, and may continue to evolve, over the next ten years. PwC 4

5 BCM 2022 overview PwC 5

6 Traditional BCM Typically siloed with minimal inter-departmental coordination and lack of integration with larger cross-organizational initiatives Criticality of functions and processes based solely on impact to revenue or IT s view of criticality Detailed survey-based data collection processes for business impact analysis Focus on IT disaster recovery and life safety only Comprehensive and voluminous plans based on specific scenarios Mostly manual function with limited automated tools Very few widely-recognized BCM standards and limited customer inquiries PwC 6

7 What has changed? BCM integrated with other organizational initiatives such as Enterprise Risk Management Criticality of functions determined in an efficient manner with executive input and evaluated across multiple quantitative and qualitative lenses (brand/reputation, customer impact, legal/regulatory, financial) Focus on crisis management, functional recovery and third party resiliency Streamlined, all-hazards approach to plan development and documentation Use of BCM software and tools to automate planning and maintenance Several new BCM standards and accreditation programs Significant increase in customer and supplier inquiries into BCM capabilities PwC 7

8 For discussion What aspect of BCM has changed the most at your organization? PwC 8

9 BCM 2022 highlights: methodology PwC 9

10 BCM 2022 highlights: methodology Several factors have led to the enhancement and refinement of traditional approaches to the BCM methodology. While no one single factor can be pointed to own its own as having the responsibility for the change, the following items are leading to the updated enhancements BCM practitioners are utilizing to facilitate their programs. Operational resource constraints, requiring a quicker and more pragmatic and user-friendly approach to non-standard responsibilities such as BCM Real-life events, such as the Japan earthquake / tsunami and Hurricane Sandy, which highlight the need for organizations to be prepared for events that may simultaneously impact many facets of operations for an extended time Increased reliance on third party vendors, suppliers and service providers for critical operation support Global expansion creating the need for business continuity training and capabilities to exist in non-hq locations PwC 10

11 BCM 2022 highlights: methodology Program management & governance Cross-functional steering committee instead of "siloed" ownership Integration of business continuity management with other organizational initiatives Risk assessment / BIA Evaluating "simultaneous impact" risks instead of risks that may only impact one area of operations Rethinking worst case definition of risk Expedited business impact analysis (BIA) process through workshop approach instead of survey approach Strategy development Increased reliance on automated tools and social media for incident communication and notification Utilizing non-hq and/or global locations to help support incident response and recovery efforts Planning "Plan in your pocket" and quick reference documents instead of extensive documents that are inefficient during an incident Focus on crisis management planning as the most critical component of an overall business continuity program Exercise & maintain Enhanced testing that involves external parties, such as vendors or emergency agencies Implementation of BCM software to automatically update and help lessen administrative maintenance of program documentation PwC 11

12 For discussion Has your organization recently updated specific aspects of its BCM methodology? PwC 12

13 BCM 2022 highlights: BCM skill set PwC 13

14 BCM 2022 highlights: BCM skill set The ability to find successful BCM practitioners, who possess the right capabilities and experience for the modern approach to business continuity being taken by many organizations, has become an increasingly important task for BCM program owners. Many organizations are struggling to find resources with the appropriate mix of skills, both business and technical, and experience needed to undertake the unique role that a BCM practitioner has within an organization. In addition, organizations are continually considering the insourcing vs. outsourcing debate for their BCM function. Organizations must understand how to fill the role of the modern BCM practitioner to help ensure a successful BCM program that meets the needs of an ever-changing business world. PwC 14

15 Traditional BCM skills Many within the current population of BCM practitioners entered their roles with an emergency management background Traditionally a male- dominated field Focus on hands-on technical skills involved in responding to an incident or crisis Less formal business training Technical Skills Business Skills PwC 15

16 Changing skills focus BCM skill set scale being tipped in favor of more traditional business skills, that requires broader knowledge of the business of the organization BCM practitioners expected to have a better understanding of overall operations and risk management functions (e.g., ERM, Internal Audit, Insurance) Coordination with executives and other important organizational stakeholders requires strong communication skills Technical Skills Business Skills PwC 16

17 Resources for identifying BCM practitioners Education Higher education degrees / certifications in BCM BCM software training BCM methodology training Certifications Certified Business Continuity Professional (CBCP) Project Management Professional (PMP) Building the BCM Skill Set of the Future On-the-job / historical knowledge from previous BCM professionals Staffing rotations within the organization Outsourced technical support Internal Conferences / Expos (DRJ, Continuity Insights) Industry networking events BCM professional organizations (ACP, DRII) Events / Organizations PwC 17

18 For discussion What skills are most important to you in recruiting future BCM practitioners for your organization? PwC 18

19 BCM 2022 highlights: crisis management PwC 19

20 BCM 2022 highlights: crisis management Crisis management has recently emerged as one of, if not the, most important aspect of an organization s BCM program without a good crisis management process, an organization may not even get to the point of recovering its operations. Some organizations have implemented or matured their crisis management programs in recent years, while others still rely on their leaders to figure it out and react instinctively to an unexpected event. Organizations with leading crisis management programs have numerous contingency plans customized to address specific risks such as product recall plans, crisis communications plans for handling reputational incidents and incident management plans for dealing with supplier issues. However, it is important for these plans to be fully integrated. Otherwise, during a given crisis an organization may actually be suffering from more than one event and not know it because the response teams are operating independently instead of cohesively. PwC 20

21 BCM 2022 highlights: crisis management Social media has been one of the main game changers in how organizations approach crisis management. Its uses within crisis management include: Communicating internally and externally in the absence of available traditional communications channels Understanding public reaction to my organization's response to a crisis event Monitoring for potential emerging crisis events Crisis management, like all aspects of BCM, is never finished and organizations will need to address the following challenges as they work to continue enhancing their crisis management efforts: Integrating global / regional locations into a consistent crisis management framework Quickly rightsizing the response to "medium" sized crisis events (aside from everyday minor issues and large-scale crises) Loss of crisis management team knowledge and experience due to turnover or other organizational forces PwC 21

22 For discussion How has your organization recently enhanced its approach to crisis management? PwC 22

23 BCM 2022 highlights: vendor resiliency PwC 23

24 BCM 2022 highlights: vendor resiliency It is no longer enough for an organization to only focus on its own BCM capabilities. Understanding the resiliency of key third parties (vendors, suppliers, business partners, service providers) is becoming increasingly more critical for organizations in meeting stakeholder expectations for BCM. Key questions to consider: How should the organization rank and tier its vendors given that not all vendors are created equal? Has the organization communicated to its critical vendors how critical they are in a crisis and what it expects of them? Has the organization integrated appropriately with other internal groups that are also assessing critical vendors to determine where synergies can be created to reduce assessment efforts and costs? Has the organization discussed its requirements with its contracts or procurement groups? PwC 24

25 BCM 2022 highlights: vendor resiliency Basic Identify vendors as critical or not Request responses to basic questions on vendor BCM program May request, receive and review vendor BCM plans but issues follow up is not addressed Vendor contact information included in the organization s plans Vendor requirements during a disaster are not well-defined Contracts do not include resiliency requirements Maturing Identify critical vendors and initial tiering of vendors Establish recovery requirements for vendors (e.g., service resumption guarantees, increase / changes in support) High-level assessments or site visits of vendors Review vendor BCM plans and test results Include vendor in the organization s BCM testing Build resiliency requirements into vendor selection and establish vendor requirements in contracts Leading Integrate vendor tiering that considers multiple elements (centralized database across the organization) Vendor criticality and resiliency built into procurement / contracts Detailed vendor assessment program Understand the organization s impact on the vendor s business (e.g., % of their business) Understand the organization s position within the vendor s recovery prioritization Conduct BCM tests jointly with vendor PwC 25

26 BCM 2022 highlights: vendor resiliency Vendor resiliency is not just about the resiliency of an organization s vendors, but also how the organization proves its own resiliency to external parties for which it serves as a key vendor or partner. Determine how the organization will respond: Centralized vs. de-centralized Summary vs. detailed plans Determine what is confidential ensure everyone knows what is not to be shared as part of external inquiries Understand implied action if the organization s resiliency is not enough If necessary understand how the organization will determine the costbenefit of meeting the requirements of key relationships Consider using the organization s proven resiliency to assist in winning sales and justifying product / service costs PwC 26

27 For discussion How have you begun to integrate vendor resiliency into your organization s BCM program? PwC 27

28 Wrap-up PwC 28

29 Questions? PwC 29

30 Speaker information Lynne Silverstein PwC 30

31 Reviewing Business Continuity Programs 2013 PricewaterhouseCoopers LLP, a Delaware limited liability partnership. All rights reserved. PwC refers to the United States member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.