Creating Calm After the Storm Business Continuity Planning for Human Resources

Transcription

1 May 19-22, 2014, Toronto ON Canada Creating Calm After the Storm Business Continuity Planning for Human Resources Presented by Ralph Petti, MBCI, CBCP HR23 5/20/2014 1:00 PM - 2:30 PM The handouts and presentations attached are copyright and trademark protected and provided for individual use only.

2 HR23: Creating Calm After the Storm... Business Continuity Planning for Human Resources Ralph Petti, MBCI, CBCP President Continuity Dynamics, Inc. Toronto, CN May 20, 2014 Session Objectives Discover what factors can upset your recovery process Understand the intricacies of HR s role during disaster events Be informed as to what departments are most critical for you Learn about which internal partners can help you the most Consider your Supply Chain and their role in your recovery Takeaway documents that can assist in your planning 1

3 Agenda What happened during Hurricane Sandy? What are the elements affecting your Preparation for Disasters? Just how critical is your Human Resources Group for disaster prep The Critical Importance of your Supply Chain process! Governance, Risk and Compliance are keys to consider Your commitment to making this happen it is critical Workshop materials reviewed Hurricane Sandy s destruction Centered in Atlantic City, NJ Winds sustained at 90 MPH Peak coverage 820 sq. miles Affected 24 states Hardest hit Monmouth + Ocean Counties, NJ Extended reach from Maine to Florida 2

4 Hurricane Sandy s impact Casualties Electricity Communications Transportation Supply Chain Medical response Business disruptions Hurricane Sandy - today Communication is still impacted today Thousands are still displaced Buildings are still being razed Cannot build on washed-away land Insurance claimants still waiting Estimated damages: $63B 3

5 Hurricane Sandy lessons learned Public/Private Sector Coordination Union/Non-Union Few Grievances Claimant/Agent/Broker Collaboration National Utility Response Effort Allowing FEMA to do their job Patience, and more Patience. People learned how to cope For the next Hurricane Sandy Disasters are more frequent now All-Hazards Planning a must Mitigation of factors is key Education and Testing critical Senior mgmt buy-in essential Resources must be aligned 4

6 Key Industry Terms Supply Chain Disaster Management coordinates your key processes with key suppliers and partners so all parties are prepared Emergency Management is the discipline of dealing with and avoiding risks - involves preparing for disaster before it occurs Crisis Management is the process by which an organization deals with a sudden emergency situation Disaster Recovery is the recovery of Systems, Telecom and Records Business Continuity is the activity performed by an organization to ensure that critical business functions will be available to customers, suppliers, regulators, and other entities for access to those functions Disaster Recovery vs. Business Continuity Disaster Recovery is only a part of the overall solution Business Continuity is CRITICAL to continue the business The key is deciding IF you will be able to continue the business Your Data and Records Management program may be available Your Systems may be available Your Facility may be available A Fukushima Story BUT, YOU STILL MAY NOT BE ABLE TO RUN YOUR BUSINESS!! 5

7 DR vs. BCP cooperation is key Business Continuity is a science in making all parties work together All departments need to be involved so the business (in total) can run Primary reliance should be on áreas that may typically be overlooked Human Resources Supply Chain Partners Governance, Risk, Compliance Executive management needs to help get these groups involved Leave nothing to chance and make no assumptions Always assume a worst case scenario! Global Consequences of BC Planning Key U.S. Department of Homeland Security statistics*:» 93% of Americans are not prepared for a disaster» 75% of plans do not factor in Human Behavior» 61% of all small businesses do not have a plan» Businesses must prepare themselves The Ecology & Society Study in London stated: Recovery cannot be effective if Human Behavior is not considered and accounted for Employees working at a diminished capacity costs companies over $250 billion per year This sets the stage for the comprehensive involvement of Human Resources 6

8 Human Resources leadership role According to HR MAGAZINE January, 2012 issue Human Resources (HR) executives leadership in developing and supporting distinctive and effective company cultures puts them at the very center of new risk management strategies With a global circulation of 250,000, HR Magazine stands alone as the most widely read and respected HR industry publication in the world. Visit Society for Human Resource Management Human Resources (12) focus areas Understand what is HR s role in the disaster planning process Respond immediately and take action Immediately account for all employees & report back Focus initially on employees well being Be the employees family single focal point Provide counseling and trained advisor resources Provide assistance of financial resources, if agreed Provide ideas for returning employees back to work Provide for injured employees still not able to work Provide for deceased employees families Small and medium-sized business HR considerations and ARE YOU SURE THAT YOUR DEPARTMENT IS TALKING TO HR WHEN IT COMES TO DEVELOPING + EXERCISING A DISASTER RECOVERY PLAN? 7

9 1. HR needs to define their specific role in disaster planning events Business Continuity professionals should partner with Human Resource professionals to ensure they are all in synch Human Resource professionals should have a specifically defined role in business continuity/disaster recovery process Testing of BC/DR plans should include the specific resources that HR professionals can provide and take this to a point of rehearsing these plans by invoking HR deliverables Understand the component of Vital Records management and the risks inherent if the policies and procedures are not followed, as defined by management 2. HR needs to take action by always responding immediately to disasters Human Resources has an immediate need to respond according to the plans as set forth and agreed upon by all parties in the role that has been defined for them Human Resources should have the authority to do what they need to do to get things done as a part of the overall process Human Resources should make sure to apprise Executive Mgmt often about the status in areas of their involvement Human Resources should provide feedback to enhance recovery planning and take notes so that everyone can learn 8

10 3. Account for all employees Participation in a Notification/Messaging system broadcast Make sure that this broadcast has a verifiable response mode and that you account for all responses Report findings to management after pursuing all avenues Advise families of disposition of employees, per agreed upon plans of management, in how to handle such situations Maintain control and a calm disposition about this matter 4. Focus singularly on the employees well-being Let the employees know that HR is a-b-s-o-l-u-t-e-l-y there for them Provide a conduit for employees reach the company through HR Keep a record of HR activities involving employee outreach Provide a report to management regarding ongoing events Maintain employee contact, as necessary, following the event 9

11 5. Be the Employee s family s singular focal point Communicate with families of the necessity to contact HR Encourage employee families to tell one another to call HR Make sure you have all of the correct contact information Make sure that you continue to reach out to contact all families and employees, as necessary during an event Be calm and assuring, yet honest, of the status of the situation you may be their key contact during an event 6. HR may be the key Supply Chain and Partners contact point Be prepared to be a key contact point for this communication Assure them that the company has their best interests in mind Make sure you have all of the correct contact information Assist in reaching out to contact key partners, as needed Be calm and assuring, yet honest, of the status of the situation 10

12 7. HR should provide for counseling services, if needed Make it clear to all that resources of this nature are available Make sure these resources know what to say Encourage all parties to record feedback Keep management apprised of all such activities 8. HR can help manage resources If the company has agreed to make certain sums available, then this should be followed out as planned Ask employees/employee families to understand the confidentiality of policies in light of other employees needs Keep accurate records of all such transactions If cash is involved, then keep Security personnel closely involved 11

13 9. HR can assist in returning employees to work Ascertain when the employees would be able to come back to work Communicate to the employees specifically this information Tell employees that things are done on a best-efforts basis If out-placement is necessary for some employees, note the sensitivities of some employees regaining their jobs and others, perhaps, having to move on to other jobs either internally or externally from the company Exercise extreme sensitivity due to the changes ongoing 10. HR can assist with injured employees Understand provisions for having employees work at home Discuss options for succession planning if they cannot resume duties and someone else need to take their place Maintain a clear record of their status and if an incident that may have affected the company was a party to the injuries sustained by the employee Maintain close contact with the employee(s) 12

14 11. HR can assist with casualties Review succession planning with management Advise employees as to why they may be asked to assume new roles Be very sensitive of any anniversary dates or memorials Be consistent in your memorials (scholarships, charitable funds) for all employees so that no one is slighted Engage clerical personnel if necessary, and agreed by all parties. These resources should have been identified prior to an incident, and, if possible, become part of any testing 12. What about small businesses? Regarding the use of HR resources: Small businesses must plan for the eventuality of such events Small businesses may be outsourcing their HR program, so consider that there are third-party recovery implications Small businesses could be supply-chain partners of larger companies and have to stay in business Engage the Small Business Administration (SBA) to see what resources are available to support your efforts Collaborate with local associations (Chambers of Commerce, etc.) to ensure that you meet any potential recovery partners 13

15 HR summary points For HR professionals, engaging with BCP colleagues at your company to broaden your perspective and visa versa! For HR professionals, participation in recovery planning is critical to the creation of a holistic plan that will enhance enterprise-wide planning Think outside the box consider that all areas of your enterprise should be involved in a comprehensive recovery plan with one common set of goals. Understand, more fully, the options available to you for recovery What about Succession Planning? Who are typically viewed as key employees for Succession Planning? Are your key employees always available? Not really Are their designates prepared to step in for them? They BETTER be able to do so! Collaboration ahead of time gains agreement of all. You may want to be on the same page with: Executive management Departmental management HR, Legal, Finance, Operations, etc. Any combination of these resources 14

16 A true Succession Planning story If you have a BC Plan that includes Succession Planning, you will have the confidence to know that everyone is on the same page and knows what to do at disaster time! A NYC Blackout Story True Story August 11, 1989 NYC power substation fire - Black Friday power outage on Wall Street - Who was there to declare a disaster into a recovery site? - The fifth person on the At Time of Disaster list acted as planned - She knew what to do, acted decisively & saved million$ ** Any employee is a potential critical resource for you! Are your key people always available? If not, can others make decisions in the time of a crisis? What about Records Management? Do you just assume that your Records Management Program is fine? Have you explored new options and technologies now available? Are you paying what you expect to pay or are there Hidden Fees once it leaves your organization and goes to Legal, Purchasing, Accounts Payable If changing vendors, do you have Perm-Out or Opt-Out penalties? Is the IT or Records Manager monitoring this program (or anyone?) 15

17 Stay on top of your Records Management program, or else! How to update and enhance your Records Management program Review your current Records Management Strategy every year Align with your Financial Management to review these programs Understand/Enhance Storage, Rotation and Destruction Schedules Do not assume that a current vendor will be an automatic renewal If you have the facilities, look for safe locations to back-up data in your own company just don t put records in basements, near rivers, near airports, nuclear plants, etc. THE USE OF A DOME FACILITY IS AN INTERESTING CONCEPT What about your Supply Chain? Will they be there for you when you need them? 16

18 So, who is really responsible? you are! With 85% of the North American infrastructure in the private sector, businesses need a solid recovery plan to care for themselves Critical infrastructure businesses include those with direct impact to energy (oil, fuel, electricity) water and food, transportation, and communication which are the vital resources for saving lives. Private companies need to remain viable at disaster time What resources would your business supply to others? What resources will your business need to survive? Take care of your business so you can be counted on to help others! Supply Chain 8 questions to ask your key supply chain partners 1. Does your company have a Business Recovery Plan? Last time updated? Including all facilities and processes? Are all business departments covered? More? 2. Is your planning compliant with industry standards? Last time audited? What policies do you have for your partners/suppliers? What third-party requirements do you have for others? More? 17

19 Supply Chain 8 questions to ask your key supply chain partners 3. Have you done a Business Impact Analysis (BIA)? Last time updated? Assuming all key activities at time of disaster? Does it include your maximum downtime allowable? More? 4. Have you done a Risk Assessment? Last time updated? What types of disruptions have you considered? What Operations and Business issues are covered? More? Supply Chain 8 questions to ask your key supply chain partners 5. Are your conducting disaster recovery plan exercises? Last time tested? Are these ever done at remote locations? Does it include your own Supply Chain partners More? 6. What are your plans for a loss of facility or infrastructure? Can you relocate your processes? Can you relocate your staff? What about other resources like Fuel, Generators, etc.? More? 18

20 Supply Chain 8 questions to ask your key supply chain partners 7. Does your company have an Incident Management Plan? Last time updated? Are you prepared to speak to the media? Do you have a way to notify your key contacts? More? 8. What about mass absenteeism? Do you have other workforce options? Can your employees work from home or remotely? What about succession planning? More? Notification and Messaging WHERE will be when a crisis affects your firm? WHO will you need to communicate with during and after the event? WHAT will you communicate? WHEN (and how often) will you communicate with them? HOW will you communicate with them? IS YOUR ORGANIZATION USING NEW SOLUTIONS OR ARE YOU RELYING ON PHONE-CHAINS? 19

21 Governance, Risk & Compliance What can you do to update and enhance your GRC programming? Understand your Records Management Program objectives Integrate with your company s GRC strategic plan Align risk and compliance in context of the organization Understand, define, and enhance organizational culture as it to GRC Implement effective, efficient and agile GRC processes using the GRC Capability Model Understand technology s role in GRC Develop ongoing monitoring and continuous improvement of GRC activities through metrics/measurement Executive Management Commitment With Executive Management commitment, your BCP will succeed Executives MUST take a leadership position Executives MUST understand their roles during a disaster Executives MUST allow others to do their job and not interfere Executives MUST communicate openly, honestly and with the facts Executives MUST use disaster events as learning opportunities 20

22 Attendee Workshop Exercise (hand-out) Business Continuity and Disaster Recovery This section will allow the attendee to complete a document that will have them consider their OWN preparation for disasters This will be an interactive session being monitored by proctors Attendees will be able to take this home at the end of the session HR23: Creating Calm After the Storm... Business Continuity Planning for Human Resources Ralph Petti, MBCI, CBCP President Continuity Dynamics, Inc. Toronto, CN May 20,

23 Continuity Dynamics, Inc. Continuity Dynamics, Inc. is a risk management firm delivering solutions globally. They partner with the likes of the International Medical Corps, the Center for Disease Control, the British Telecom-Agora Pandemic Planning Society and countless other public/private sector organizations. A key focus is on Supply Chain dependencies for SMB companies as Continuity Dynamics, Inc. owns the trademark for Second Responders and focusing on the Compliance and Audit area of the industry. Ralph Petti, MBCI, CBCP has been involved in the planning and recovery of over 600 disaster events as a key member of client recovery teams. He was most recently a member of a team helping to develop Pandemic Plans for The Republic of The Philippines and The Republic of Indonesia. In 2013, he visited Fukushima, Japan and then in 2014, he visited Anchorage, Alaska to learn more about the impact of earthquakes in contributing to disasters. Contact him at Ralph.Petti@ContinuityDynamics.com or Sample reference list: 22

24 Business Recovery Guidance Document Essential Disaster Preparedness Steps for ALL Companies! As someone involved in Disaster Planning for your company, you may certainly be a participant in the process of protecting and creating solutions for your business at such times. Whether it is backing up data or even managing key resources during a disaster event, your own company s management, your clients and your key Supply Chain partners may turn to YOU as one of the resources to help to provide a response to their needs. As such, are you ready to do so? As we all know, there are a number of factors that everyone must consider during all disasters. This document will enable you to reflect on key areas that may affect your role in the company. Your objective should be to identify areas where you can enhance your own disaster response. Please feel free to complete this document and take it to your office to share with your team. 1. Have you ever been affected by a Hurricane Sandy type event? a. If so, were you able to conduct your business normally? b. If so, were you able to contact your key personnel and partners? c. If so, were you able to respond to your business/client needs? 2. Do you have a comprehensive Disaster Recovery Plan? a. Are you backing up your data at an off site location every day? b. Do you have a generator to keep the power going, as needed? c. Do you require your Supply Chain partners to have disaster planning? Continuity Dynamics, Inc. General Business Recovery Focus Winter, 2014 Basking Ridge NJ/Wilmington DE Toll Free:

25 3. Are your Supply Chain partners a part of your Business Continuity Plan? a. Can they help you to run your business if there were a disaster event? b. Can you communicate with your Supply Chain at disaster time? c. Do they know what to do if something happens and you can t call them? 4. Are you optimizing a review of your Records Management program? a. Have your Records Management/Data Backup goals changed? b. Has your company undergone a merger or acquisition recently? c. Are all of your key stakeholders on board with what you can deliver? 5. What about the big picture? a. When was the last time that your DR and BC Plans were updated? b. Is your office in a high risk area (propane tanks, highways, airports)? c. Do you have your management s 100% support to focus on all this? We hope that you find this information document useful. If you would like to share the results of this document with our team, we would appreciate it as we are always looking for new ideas. Please FAX to us at: or contact us at info@continuitydynamics.com Or, if you would like to clarify any points or to learn of new ideas, please call us for guidance. Name/Company: Continuity Dynamics, Inc. General Business Recovery Focus Winter, 2014 Basking Ridge NJ/Wilmington DE Toll Free:

26 Human Resource Departments Need Business Continuity and Continuity Dynamics, Inc. What would happen to your company if a disaster occurred? Human Resource professionals are increasingly being tasked with more responsibilities, including risk management and business continuity. Are you prepared? Continuity Dynamics can help all organizations work more closely together. Human Resources (HR) executives leadership in developing and supporting distinctive and effective company cultures puts them right at the very center of new risk management strategies in today s world. HR Magazine, January 2011 Continuity Dynamics understands the challenges you face, and has the experience, tools and personnel to help you define your risk, identify vulnerabilities and implement a plan, with a keen emphasis on HR. Ralph Petti, MBCI, CBCP, President of Continuity Dynamics has been published in several HR industry articles. He presented at the April, 2013 Continuity Insights national conference in San Diego, with this message: What HR departments must ask BCP: What do you want me to do? and Where do I fit into the disaster plan? If you haven t involved HR directly into your disaster planning, and agreed on their role, how can you expect HR to respond decisively, effectively and appropriately? All client engagements must now involve the HR organization Ralph Petti, April 2013 With a certified staff and over 25 years of industry experience, Continuity Dynamics, Inc. is a proven international solutions company that provides a risk management expertise for all private-sector and public-sector organizations and, specifically, for their Supply Chain partners. Business Continuity Disaster Preparedness Crisis Management Emergency Management Security Collaboration Terrorism/Intruder Training GRC - Governance, Risk Management, Compliance Human Resources/SHRM Supply Chain/Small Business Pandemic Planning Healthcare/Medical Practice Extended Care/Senior Living IT/Cloud Assessment/More Toll-free: Sales@ContinuityDynamics.com Continuity Dynamics, Inc N. Market Street, Suite 101 Wilmington, DE 19801

27 Put the (GRC) Risk Management Experts on Your Team Does your BCP include your Governance, Risk Management and Compliance (GRC)? As your organization s Governance, Risk Management and Compliance (GRC) activities become more critical, you need to be sure disaster recovery and business continuity professionals are included in your organization s risk management planning. Organizations that understand and apply the concept of Principled Performance, by integrating governance, risk and compliance (GRC), in both processes and technology, have a real competitive advantage. We see that Continuity Dynamics understands this message and promotes it to their clients - Jason Mefford CIA, CPA, GRCP, CICA, MBA President, Mefford Asso., Orange County, CA Continuity Dynamics will help to get you either started or enhance any current plans with our COMPLIMENTARY CONSULTATION. You ve probably done a good job of backing up your data and then dodged a bullet or two by missing a few days of work due to recent storms & other local disaster events. But, are you prepared for extended business interruptions? How would your company survive a fire, catastrophic storm or an event tied to an active shooter, or even terrorism? Call Continuity Dynamics for a free review! A Typical Continuity Dynamics Client Testimonial: The Business Continuity Planning Services rendered by Continuity Dynamics resulted in a quality product that more than met our expectations. Their assignment involved the installation of a business continuity planning system shared by many organizations... under a public Homeland Security Grant The business planning solutions that they provided strongly enhanced our readiness The staff was professional and focused on customer service, and brought knowledge and expertise relevant and value as we developed these critical programs. Continuity of Operations (COOP) Program Manager November, 2012 Toll-free: Sales@ContinuityDynamics.com Continuity Dynamics, Inc N. Market Street, Suite 101 Wilmington, DE 19801