Auditing Business Continuity Management. DHIRAJ LAL Executive Director

Transcription

1 Auditing Business Continuity Management DHIRAJ LAL Executive Director

2 Agenda About us Relevance of Business Continuity in the UAE The UAE BCM Standard AE/SCNS/NCEMA 7000 Need for BCM in the UAE NCEMA BCM Action Model Key BCM Concepts and Terminology Video Quick Tips on BCM Audits Auditing BCM per the ISO Standard Sample Audit (Exercise)

3 About CORE Our Range of Specializations in Consultancy & Training cover: Crisis Management Crisis Communications Business Continuity Disaster Recovery Sustainability Information Security IT Service Management Project Management Quality Consulting Training Assessments Tools Advisory e-learning Support Country Middle East India USA Canada UK Europe Africa Global Experience Industry Financial Services Telecom Manufacturing Airlines Trading Oil and Gas Government FMCG, Nuclear, etc. Our Partnerships Institutions British Continuity Institute (BCI) UK for offering BCM Certification - CBCI British Computer Society (BCS) UK for offering the Green IT Certification 3

4 About Dhiraj Lal Nearly 3 decades of industry experience Over 1 decade in BCM and related domains FBCS and MBCI Lead Auditor ISO 22301, ISO Practitioner, trainer, consultant, assessor Asia s first BSI appointed Technical Expert for BS / ISO Earlier experience with Agilent Technologies Limited, American Express Financial Center, Citibank NA, Standard Chartered Bank etc.

5 BCM in The UAE The UAE Business Continuity Standard: NCEMA 7000 Mandatory by Royal Decree NCEMA (National Emergency Crisis and Disasters Management Authority) has released two documents: AE SCNS NCEMA (Specifications) AE SCNS NCEMA (Guidelines) NCEMA provides a Business Continuity Management Standard to build an organization s capability to continue functioning and delivering its prioritized activities when its operations are disrupted due to emergencies or crises.

6 NCEMA Standard Foreword by H.H. The National Security Advisor As our wise leadership endeavors to ensure the welfare and stability of our great nation at all times, we spare no effort to empower all UAE organizations, in all vital sectors, to perform their services and duties towards the society. This should not be restricted to normal conditions but should extend to include the capability to deal with sudden incidents by developing well-rounded and pre-coordinated plans. In doing so, such organizations would be able to continue performing their role and duties towards the community, when a disaster occurs. Hazza Bin Zayed Al Nahyan

7 Business Continuity..Holistic management process that identifies potential threats to an organisation and the impacts to the business operations those threats, if realised, might cause, and which provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities ISO 22301, Clause 3.4

8 Benefits Of BCM Helps to Recover fast urgent processes only.to pre-agreed levels In reasonable timeframes Maintain Stakeholder confidence and trust INCIDENT Organisation Overall performance Normal Operations B Effective BCM Program Minimum Level of Operations A No BCM Program Time

9 Benefits Of BCM Framework Resilience Reputation Competitive advantage Business improvement Continuous improvement Compliance Win more contracts Cost savings Delivery Capability for managing a disruption

10 Benefits Of BCM Helps to be prepared because we are always one disaster behind Recent Torrential rains and waterlogging Cyber Attacks Rita Terrorist attacks Financial scams Floods Earthquakes Volcano eruptions Civil unrest Power grid failures Katrina Other IT failures Global economic downturn Falling oil prices Fires (manmade, accidental, natural) What s next?

11 Benefits Of BCM BCI study

12 NCEMA Business Continuity Management Action Model

13 Key BCM concepts Business Impact Analysis (BIA) Risk Assessment (RA) Recovery Time Objective (RTO) Maximum Tolerable Period of Disruption (MTPD) Recovery Point Objective( RPO)

14 Video

15 ISO PDCA Cycle Context of the organisation Leadership Planning Support (Clause 4-7) Operation (Clause 8) Plan Do Act Check Improvement (Clause 10) Performance evaluation (Clause 9)

16 Auditing BCM per the ISO22301 Evidence if effectiveness related to : Interested Parties Regulatory Requirements Risk Appetite Business Impact Analysis Risk Assessment Strategies Development Plan Development Testing Training Audit Management Review Performance Evaluation Communication Continual Improvement

17 Mandatory Documents The following must exist: Policy Program Management Plan Interested Parties Risk Appetite Regulatory Requirements BIA(s) RA(s) Strategies Plan(s) incident/ emergency/ disaster/ crisis/ continuity/ recovery

18 Mandatory Documents Audit Plan, Reports Training Needs Analysis, Schedule, Competence Records Corrections, Corrective Actions and Preventive Actions Report Performance Evaluation Report Continual Improvement Report MR Schedule, Reports Incident Reports Maintenance Schedule, Reports Test Schedule, Plans, Reports Communication Records (general, specifically from the top management)

19 From the NCEMA Standard Foreword By H.H.. The National Security Advisor Today, business continuity management is being unquestionably recognized as an increasingly important element in the emergency and crisis management process. In this context, we call upon everyone to cooperate and comply with this standard, so as to ensure meeting the minimum technical, training, and administrative requirements are satisfied, providing reassurance and stability for the community at all times. Hazza Bin Zayed Al Nahyan

20 Thank You Continuity and Resilience (CORE) P.O. Box , Abu Dhabi, United Arab Emirates Tel: Fax: info@continuityandresilience.com Website: