disaster recovery and contingency plan RISK MANAGEMENT MADE TO MEASURE

Transcription

1 disaster recovery and contingency plan RISK MANAGEMENT MADE TO MEASURE

2 INTRODUCTION Contingency planning for business continuity (business continuity management) is defined by the Institute of Business Continuity Management as an holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholder, reputation, brand and value creating activities. Commitment To be effective a properly formulated Plan must have full support at the highest level. It requires a considerable commitment on behalf of the business. Adequate time and resources must be allocated. There may be financial demands particularly if professional help has to be in sought in formulating the plan or back-up services have to be purchased. Objectives The prime objective is to protect the business or organisation from the effects of damage or some other unforeseen event. Not all losses are covered by insurance. It may not prevent the event but will mitigate its effects. You need to anticipate critical decisions. This is achieved by considering how the business will respond to certain events and how it will be restored. It should be understood that it is not possible to plan for every conceivable disaster. Who will be involved? You may decide that you need professional help to guide you through the various stages. Such help is available from specialist companies but is likely to involve a considerable amount of their time and consequently your money. However if you feel you need such help then this is part of the financial commitment to be made. The process will certainly involve your own Management and certain key personnel, as you know your business best. Also major strategic decisions will possibly have to be made which may affect the future activities of the business. The whole process needs to be controlled and steered by a Business Recovery Manager, Team or equivalent operating at Board level or reporting directly to the Board, depending upon the size of the organisation.

3 Procedures So how do you go about preparing your plan? There are no set procedures for this as every organisation is different and has its own problems. Whatever method you choose it needs to be structured, and the following sequence is suggested: Risk Assessment: You need to examine the threats to the business. These can be the result of natural occurrences, accidents or crime. The following list offers suggestions but is not exhaustive: Fire Flood Storm Burglary Malicious damage Computer failure Telecommunications failure Explosion Earthquake Bomb Arson Pollution Building services failure Subsidence The assessment needs to consider the likely effects of such events on the business and staff, short term and long term. For certain processes, especially chemical, a Hazard and Operability (HAZOP) study may be necessary to establish likely failure points and damage scenarios. What the effect is likely to be of an interruption of supplies or services to customers. It is vital to identify the critical areas and assets of the business. Events outside the organisation also need to be considered such as suppliers or nearby premises. The capability of existing protection measures, or lack of, should be measured against the likely effects. Such measures would include sprinklers, fire and intruder detection systems and flood protection schemes. (This is one area were professional help may be needed. You may not have the necessary knowledge and experience in this area and may underestimate the likely causes and effects). It may be decided as a result of the risk assessment that an improvement in the fire protection measures or some other strategy such as better computer back-up procedures is necessary.

4 Decide strategy: Having identified the risks to the business, and in particular the critical areas, the Management need to decide a number of key parameters: What are the maximum time scales for the recovery of key areas; this could be for partial and complete recovery. Criticality of customer base; degree to which it needs to be defended and prioritised. Degree of back-up resources necessary, especially in relation to computers and telecommunications. Policy on suppliers of critical raw materials, components and services, e.g. dual sourcing or strategic stock holding. Take opportunity to rebuild or relocate premises. Establish Planning Teams: Having identified the main priorities and set the principal parameters and targets, teams need to be formed to investigate further and establish how these objectives are to be achieved. Different teams may be necessary to deal with different threats or divisions within the organisation, typically the IT department. Team leaders should be appointed who should report back to the main Business Recovery Team, and who will be supported by representatives of all involved departments. These would include, for example, works engineering, production, sales, administration and warehouse staff. Plan development: The key to a successful plan is that it is clear, concise and gives simple instructions. It should be broken down into three main areas of immediate response, short term recovery and long term recovery: 1. Immediate Response: The following are typical of the main points to be addressed: Establish an incident control team. Membership may vary depending on the type of event, and reserve members will be needed in the event of illness or holidays. Where will they meet? for an organisation with a single premises this may have to be a local hotel, friendly neighbouring business etc. but one not vulnerable to the same incident. Define the duties of the incident control team members. Safety of personnel; evacuation procedures and roll calls. For bomb threats, safe shelter areas within the premises may be necessary.

5 Damage limitation procedures such as isolation of gas or oil supplies, flood defence measures etc. Prepare lists of usual contact numbers (day and night) of key staff, emergency services, suppliers of emergency equipment such as generators or dehumidifiers, coach hire companies, tradesmen and tool hire companies. You will also need to advise your insurance broker/company. It can often be arranged for specific Loss Adjuster to be contacted. News media control: all communication should be through a dedicate person and other staff should be instructed to direct enquiries to that person. Incorrect or inadequate information can easily become distorted resulting in wrong messages being received by customers and the public. If handled correctly good PR can help the organisation s own image by showing that you are in control. Communication with staff: many staff may be better at home until needed. A cascade telephoning system should be considered. Arrangements for communicating with relatives or next of kin need to be agreed in the event of fatalities or serious injuries. Communication with customers: it is better for them to hear of the event from you rather than your competitors or news media. If you show you are in control you have a much better chance of keeping them. Salvage experts are invaluable in relation to damage limitation and recovery and may need to be called in at a very early stage if they are to be effective. The agreement of the Loss Adjuster would normally be required first. Designated team to carry out initial damage assessment: protective clothing and safety wear may be necessary. Bear in mind that Police and emergency services may not allow access immediately. Report to main Business Recovery team to make decision on invocation of full contingency plan. 2. Short and Long Term Planning: These sections will inevitably overlap, and depending on the criticality, may also overlap with the Immediate response actions. The requirements for industrial and computer-based organisations are very different and are therefore considered separately. Criteria to be considered would include: Industrial Define conditions for decision on whether to move (temporary or permanent). Planning permission for redeveloping existing sited should be kept in force and up to date.

6 Possibility of relocating production or processing to other locations; it should be explored beforehand whether production facilities are compatible and the likely spare capacity situation. Likely impact on Quality Standard procedures. Possibility of sub-contracting: likely candidates should be examined particularly if QA standards or other accreditation is involved. Replacement of machinery and stocks. Availability of critical drawings for dies, moulds, tooling and specialist machinery. Are copies held off site? If facilities can be provided inhouse is a duplicate mirrored computer room necessary or a cold sire where replacement equipment can be plugged in straight in. Will back-up copies of software and data be available access may not be possible to fire-resisting data cabinets for several days. Is there adequate provision for office staff with telephones, PCs etc. as necessary. Can telecommunications be restored or diverted. Explore contingency arrangements with alternative carriers or exchanges. Can damaged tools and dies be replaced quickly in the quantity needed? Are critical items and spares kept in a safe area not in use. Computers Critically of installations. Can recovery be made in the required time frame? If not, then what standby facilities are necessary and can these be provided in-house. If not, then arrangements mat need to be made with a specialist recovery company with a hot, warm or mobile site.

7 The finished plan The finished plan needs to be proved and should therefore be tested through a series of exercises. These can be desktop sessions but in some cases a simulated exercise, possibly involving the emergency services, could be staged. It is important for a thorough review of the exercise to be carries out and the plan revised if necessary. Because the organisation is a live entity it will continue to change and evolve and the plan therefore needs to change with it. Regular practices and reviews are therefore necessary o keep up to date and to act as a refresher for staff. The finished plan is a vital document and needs to be treated as such. Copies should be kept of site and lodged with all key members of the Recovery Team.

8 VERSION: april 2006 Wigham House Wakering Road Barking, Essex IG11 8PJ IBEX HOUSE Minories London EC3N 1DY Century House North Station Road Colchester, Essex CO1 1RE Colman House King Street Maidstone, Kent ME15 1DN CROYDOn 28 Dingwall Road Croydon, Surrey CR0 2NH Westmead House Farnborough Hampshire GU14 7LP