Objectives. Controlling the Risks An Integrated Approach. David s Background. Would you be in control.?

Transcription

1 Objectives 1. Provide an appreciation of the relationship between business continuity, emergency response and risk management Controlling the Risks An Integrated Approach David Teed Teed Continuity Ltd 2. Outline examples of how business continuity management can be approached 3. Present thoughts on how you can improve your organisation s preparedness for dealing with unexpected incidents and disruptions IOSH 27 th March 2014 David s Background 10 years as a commercial insurance broker Designing insurance & risk management programmes for hundreds of organisations Started Teed Continuity in years as a business continuity consultant Managed BC & DR projects for 200 organisations Facilitated over 2,500 Impact Analysis (BIA) discussions Developed 300 BC & DR plans Coordinated 250 BC & DR exercises Member of the Continuity Institute (MBCI) Continuity Consultant of the Year 2010 IOSH Award of Merit 2011 Would you be in control.? Buncefield 2005 London 7/7/ Dawlish

2 Examples of incidents The owners of a plastics factory which exploded with the loss of nine lives have lost a legal battle to force one of its suppliers to pay them compensation. ICLPlastics Ltd wanted Johnston Oils to make a contribution to the payments made to those who were injured in the May 2004 blast at the Stockline Factory in Maryhill, Glasgow. Johnston Oilssupplied ICLPlastics with liquid petroleum gas (LPG), a chemical whichwas used in the manufacturingprocess at Stockline. The LPG was stored in underground pipes which leaked due to their poor condition. Health and safety experts concluded that the leaks fromthe pipes caused the explosion. 1. Fire or explosion 2. Severe weather e.g. flooding, snow 3. Denial of access 4. Extended loss of IT, Comms, Utilities, Critical Equipment 5. Damage to brand, reputation, corporate image 6. Malicious act 7. Supply chain disruption 8. Staff unavailability e.g. mass illness, industrial action, lottery 9. Environmental issue caused by us 10.Terrorism Lawyers acting for ICL wanted Johnston Oils to hand cash over to them so they could pay people who were injured in the explosion. They told the Court of Session that Johnston Oils had a duty to inspect and maintain the faulty pipes. RM + ER + BC Understand & control risks Integrated Planning Risk Management Maintain & recover critical activities Continuity Emergency Response Safeguard people & assets Objective: Protect Market Share / Shareholder Value Integrated planning Risk management strategies Plan Analysis & Planning Incident Management Plan ER Plan Review 24hrs 7-10 days 1 6 months Timeline Pre-incident Incident declared Post-incident Pre-incident Source: Joined-up Working IOSH 2

3 Risk control Emergency planning Safeguarding people by protecting them in the workplace Putting controls in place to reduce likelihood of incident Reducing risks pre-incident Health & safety and business continuity improve operational resilience Leads to more effective emergency response and business recovery post-incident Improved risk control = improved safety = improved productivity = improved performance Conclusion: Effective operational risk management directly relates to improved strategic risk Mitigation Preparedness Response What is emergency planning? Emergency planning should aim where possible: To prevent emergencies occurring, and when they do occur, good planning should reduce, control or mitigate the effects of the emergency It is a systematic and ongoing process which should evolve as lessons are learnt and circumstances change Emergency planning should be viewed as part of a cycle of activities beginning with establishing a risk profile to help determine what should be the priorities for developing plans and ending with review and revision, which then re-starts the whole cycle. Emergency response common objectives Saving and protecting human life Relieving suffering Containing the emergency limiting its escalation or spread and mitigating its impacts Providing the public and businesses with warnings, advice and information Protecting the health and safety of responding personnel Safeguarding the environment As far as reasonably practicable, protecting property; Maintaining or restoring critical activities Maintaining normal services at an appropriate level Promoting and facilitating self-help in affected communities Facilitating investigations and inquiries (e.g. by preserving the scene and effective records management) Facilitating the recovery of the community (including the humanitarian, economic, infrastructure and environmental impacts) Evaluating the response and recovery effort; and Identifying and taking action to implement lessons identified Source: HM Gov - Emergency Responseand Non statutory guidance accompanyingthe Civil ContingenciesAct 2004 What is business continuity? Resource dependencies continuity is the capability of the organisation to continue delivery of operations at acceptable predefined levels following a disruptive incident Assumes that the worst can still happen, however low the likelihood Focuses on high impact, low likelihood events Concentrates on threats and incidents involving the loss of resource Premises People Technology Suppliers Information 3

4 Industry example - Oil & Gas dependencies How does business continuity planning work? Port Determines business priorities and minimum resources preincident Develops strategies and contingencies to mitigate loss of resource Plans and solutions agreed upfront continuity plans and related documents detail recovery strategies and actions Enables effective recovery of business critical activities postincident continuity management process Continuity Plan What makes an effective BC plan? Scope & objectives What is the business continuity plan there to achieve? Align with business objectives Determine acceptable levels Define BC aim & objectives In the event of an incident that leads to the loss of production or distribution capability, the organisation will be able to continue to meet key customers expectations, strategic objectives and keep all other impacts within acceptable levels. Where and what does the business continuity plan cover? HQ, warehouse, data centre, hub 4

5 Worst case focus Plan for the worst case scenario i.e. where a single incident would have the largest impact on the organisation, regardless of the probability e.g. complete, destructive loss of premises and contents Lesser scenarios should therefore be covered by the planning continuity assumes the incident can still happen Understanding priorities & resources Impact Analysis (BIA) priorities Critical activities (that must continue to meet objectives) Time Objective (RTO) Maximum Tolerable Period of Disruption (MTPD) Resources What is the minimum needed to support the critical activities when / how many? IT systems Data Comms Workspace Resources supporting critical activities continuity strategies Resource Strategy / Solution Premises People Information Technology Suppliers Other site Reciprocal arrangement Remote working recovery site Ensure insurance is appropriate Cross training Knowledge sharing Documenting processes Use of contractors Take back ups regularly store or replicate off site Scanning of documents Fire proof safe IT - replicate to another location Phones transfer arrangement Equipment maintain old equipment & spares, other sites Back up power supplies Buffer stock, use separate locations Supplier preparedness review Reduce lead times Rehearse, exercise, test Maintenance & review 5

6 Incident management structure Incident Management Team BC Incident Management Corporate Disaster Team Onsite Response Team Teams <<Dept Team>> Incident escalation INCIDENT Duty Manager notified Incident management IMT Leader notified as Usual BRT / Reps notified Level 1, 2, 3 or 4 Incident Situation Assessed/ Monitored Manage Control Place IMT on standby Level 1 or 2 Level 3 or 4 Invoke IMT Invoke BCP RECOVER BOARD 1 CURRENT SITUATION (where are we now?) Situation Summary Incident Classification BOARD 2 OBJECTIVES (where do we want to be?) Facts: (who, what, why, where, when, how?) Implications: (what can t we now do? refer to BC Plan for critical activities) STRATEGIC RESPONSE OBJECTIVE (refer to BC Plan ): Resources/Capabilities Lost (and for how long): (people, Resources/Capabilities Still Available (and location): premises, equipment, IT, comms, supplies, specific capability, asset etc.) TACTICAL RESPONSE OBJECTIVES (to meet strategic objective above): Objective By When?

7 BOARD 3 COPING STRATEGIES & ACTIONS (how do we get there?) Refer to BC Plan for agreedstrategies Chosen Actions Required: (refer to BC Plan for guidance) Potential solution for each lost Yes/No resource / capability: tasks - teams 1. What? By Whom? By When? Comment / Status Incident Management Emergency / Onsite Response IT Disaster 4. Allocate task owner, timescale for recovery, date/time completed benefits of business continuity planning Integrated response & recovery 1. Safeguard people 2. Be in control 3. Protect reputation 4. Maintain services 5. Keep impacts within acceptable levels 6. Understand and accept risk exposure 7. Stand out from competitors 8. Improve insurance terms 9. Protect jobs 10. Sleep at night. Incident Within minutes to hours: Staff & visitors accounted for Casualties dealt with Damage containment / limitation Damage assessment Invocation of BCP 24hrs 7-10 days 1 6 months Timeline Emergency Response Within hours to days: Contact staff, customers, suppliers, etc. of critical business processes Rebuild lost work in progress Continuity Withinweeks to months: Damage repair / replacement Relocationto permanent place of work of costs from insurers Resumption as usual Overall Objective = Back to normal as quickly as possible continuity + health & safety Common factors Continuity Health & Safety Continuity and Health & Safety Duty of care Safeguard life Staff welfare Compliance Perception In control 7

8 What can you do? 1. Ensure everyone is aware of their roles pre- and post-incident 2. Involve key staff and response team members in exercises and BCM awareness training 3. Keep key contact details updated and held securely offsite 4. Make sure staff know emergency procedures, muster points, etc. 5. Maintain grab bag & battle box with essential items 6. Ensure immediate staff needs are dealt with post-incident Action plan 1. Become a champion for your organisation 2. If there hasn t been a BC exercise recently, organise one to assess current preparedness 3. Review your current risk exposures 4. Define critical activities, their RTOs and resource requirements 5. Look for some quick wins and low cost solutions to improve business resilience 6. Ensure management understand and accept risks Objectives revisited 1. Provide an appreciation of the relationship between business continuity, emergency response and risk management 2. Outline examples of how business continuity management can be approached 3. Present thoughts on how you can improve your organisation s preparedness for dealing with unexpected incidents and disruptions Thank you David Teed Teed Continuity Ltd david@teed.co.uk 8