Assessment of natural hazards, man made hazards, technical and societal related risks and associated impact.

Transcription

1 Aon Business Continuity Planning The Aon Business Continuity Planning practice provides consulting services that allow Aon clients to measure and manage their strategic and tactical risks through Crisis Management and Business Continuity Planning. Specifically, Aon Business Continuity Planning service offerings include the following services: Assessment of natural hazards, man made hazards, technical and societal related risks and associated impact. Measurement of the physical, operational and financial impact potential from those risks. Assisting clients with the development of their approach towards managing crisis situations that may result from a wide range of exposures and situations. Assist clients with developing strategies for responding to incidents so that they can maintain their standing in the eye of the public, reduce the impact on staff, operations (internal and external), and reduce material and non material financial impact. Facilitate development of response plans that enable seamless recovery and showcase Aon s ability to respond to the real time needs of clients. Assist in the documentation process for these business continuity plans. Through these services, our consultants operate in partnership with Aon clients in a business consulting capacity that incorporates a wide array of Technical services to assist clients with their overall risk management efforts. In addition to the services provided from within Aon the practice utilizes the services of several disaster services firms that expand our capabilities in support of our clients varied disaster response related needs. The government administration community faces challenges on several fronts to maintain efficient cost structures while still remaining flexible and resilient enough to respond to interruptions of conducting business as usual in the face of adverse conditions. All of these factors have driven cost out of organizations, while driving financial and operational risks into the business. A prime set of mitigation techniques is available through effective pre incident exposure evaluation and the development of plans to respond to situations that may occur. Development of Emergency Response, Crisis Management, and Business Continuity Plans is an effective way to reduce exposures. Analysis services related to identifying, Quantifying, and Mitigating risks before incidents happen support the entire planning process and will support our clients strategic planning efforts. Aon Business Continuity Planning Services can be accessed through the following Aon Consultants: Craig Holmes- Director- Aon Business Continuity Planning, Southfield, MI Win Chaiyabhat- Sr. Consultant- Aon Business Continuity Planning, Chicago, IL Brian Eklow Sr. Consultant Aon Business Continuity Planning, Chicago, IL Anne Parkin - Consultant - Aon Business Continuity Planning, Southfield, MI Bob Siner Consultant Aon Risk Consultants, Chicago, IL Angela Page Technical Associate, Aon Business Continuity Planning, Chicago, IL Dan Hopwood Sr. Consultant, Aon Business Continuity Planning, San Diego, CA Bill Carolan Sr. Consultant, Aon Business Continuity Planning, Irvine, CA Greg Cybuls ki Sr. Consultant, Aon Business Continuity Planning, Parsippany, NJ

2 Business Continuity Planning, Frequently Asked Questions 1. What would you consider to be the foundation of a Business Continuity Plan? The foundation of any business continuity plan is the protection, prevention and mitigation of risks. The first process in Business Continuity Planning is the identification of risks. Most facilities are subject to risk of fire and theft. Other locations may be threatened by natural hazards such as flood, hurricane, or earthquake, and these hazards also need to be evaluated as part of a BCP. Business risks can also include product contamination, regulatory violations, environmental damage, or employee injury. The identification of which risks your company is exposed to is the natural starting point for any BCP. Once identified, risks can be quantified as to severity so that a prioritized loss prevention and response strategy can be developed. 2. What is the difference between Business Continuity Planning and Disaster Recovery? The term continuity infers that there is no break in service. A comprehensive Business Continuity Plan is designed to get the business back to the state of affairs where it was before a loss. The process, simply put, is to identify potential risks, determine how best to reduce these risks, what risks will impact the business most, and how to develop plans that will limit the extent of operational downtime. These plans can address events both minor and major in magnitude, with the ultimate goal of maintaining customer satisfaction. The term Disaster Recovery would imply that the organization has suffered a loss of a large magnitude. This may even involve events of regional impact such as earthquake or hurricane that will strain available local resources. Your disaster recovery plan will address these worst case scenario occurrences. In the field of Business Continuity Planning, Disaster Recovery also refers to restoration of computer operations, and this is a specialized area of recovery planning. Technology and systems available today will allow shadowing or mirroring of data. 3. What is Crisis Management? The intent of Crisis Management is to limit the extent of negative impacts to important organizational values, functions and services, and which could result in major damage to the organization, it s employees, products, services and reputation. As such, the focus of a CMP is to keep a crisis from increasing in intensity and adversely affecting an organization. An organization can have a crisis with no losses to facilities or technologies. A CMP usually focuses on threat scenarios that may include product tampering or recalls, environmental accidents, terrorism, loss of life, kidnapping, crimes on site, embezzlement, fraud, etc. In these instances, internal and external communication policies can affect public and employee perceptions of the company. The CMP differs from a business recovery plan in that it s purpose is to manage the crisis rather than focus on recovery of the business functions and services. 4. Who will need to be involved in the Business Continuity Planning (BCP) process? The process will need a senior level sponsor such as a Vice President or Director to show that it has the backing of senior management. Ideally the process will involve the following individuals plus their key members of staff: Facilities Manager Controller Human Resources Manager Production Manager Safety/Security Manager Risk Manager Individual business unit managers or directors Technology: IT/IS, logistics or other technology support Quality Assurance Legal

3 5. I have been told by Corporate that my division needs to get a Business Continuity Plan in place by the end of this quarter, is this a reasonable goal to achieve? The development of a full and complete BCP varies by company and type of business. For example, a manufacturing plant that has a multitude of processes with supplied from various single source suppliers and a multitude of client both internal to the organization and external to the organization will need to spend a lot longer on developing their plan than on a warehouse. The initial stages of developing the plan can be completed by the end of one quarter. This stage is to carry out a full Needs Assessment, and a Business Impact Analysis, which shows how various areas of your business will be impacted in the event of an incident. 6. How long will it take to get the plan developed? Again the amount of time that it takes to develop the plan depends upon the complexity of operations at your facility, and the number of people involved in the development of the plan along with the amount of time that they have to devote to working on the plan s development. Generally to complete a BCP from the initial stages through to final testing of the process takes approximately a year, or possibly longer depending on the complexity of the particular company. However it should be made clear that any BCP is never finished. It is a living document that needs constantly updating with new phone numbers and contact information, and as such one person should take ownership of it to ensure that it is kept up to date. 7. Will I need to develop the entire plan now, or can this be accomplished in phases? It is often best to develop the plan in phases. This allows you to take some time to judge how things are progressing, and to carry out a process check to ensure that everyone is working from the same page and heading in the same direction. It is useful to review the results of the Business Impact Analysis prior to commencing work on the plan itself and to ensure that all parties agree on the priorities for organizational critical functions. Once the work gets started on the plan itself, then it is a good idea to keep the momentum of this process going, as it can often be a tedious process and it is important that all participants are kept involved. 8. My company may have several critical functions that will need a recovery plan, where should I start? The best place to start is to carry out a Needs Assessment to review all areas of the business and to get acceptance from all areas of the business as to the most critical functions and then to proceed on from there. The Needs Assessment allows management to identify the primary areas of concern, and properly prioritize the planning activities. It defines and analyzes the organization, and then identifies criticality within the company. It specifically focuses attention upon functions, which will cause impairment of multiple portions of an organization if lost, or curtailed. Once the Needs Assessment is complete then a full Business Impact Analysis should be carried out. 9. I already have plans in place for my IT department surely I don t need to do anything else? At many organizations, plans may exis t at an intuitive level, be part of normal operations planning, or may even be formally documented. One area that is typically addressed is recovery of computer operations. While it is beneficial to have plans for recovery of specific and critical business functions, a complete business continuity plan will deal with the strategic recovery of all operations. By carrying out a Needs Assessment, you will determine where plans exist, evaluate how effective these plans might be, identify where new plans need to be developed, or if existing plans should be modified. 10. If it is determined that an exposure exists due to a single or sole source supplier, is there anything I can do about it? There are several strategies that can be employed to reduce the impact of a single source supplier. First, it should be determined if the supplier has a business continuity plan of their own (i.e. backup manufacturing facility), and how effective the plan will be. Past and current efforts should include risk identification and mitigation strategies designed to reduce the likelihood of physical loss to a single site. If the maximum

4 extent of a supplier s outage can be accurately predicted, it may be prudent to plan for a buffer stock to cover this time period. Another strategy will involve cultivating alternate suppliers for these components, such that the secondary source will provide only a portion of the total needs, yet their output could be increased over a short period of time to meet 100% of total demand. 11. Can I do the work myself with some training? There are a variety of courses that are offered to individuals that are interested in learning about BCP. The most popular ones are offered by the Disaster Recovery Institute and are held 2-3 times a year. They will provide the basics of Business Continuity Planning, Business Impact Analysis, how to manage your BCP and other relevant topics. Once an individual has gained a thorough knowledge of BCP they could then develop the plan for their company. 12. What software is used to document the plan, and can I use it? There are various types of software available to document the plan. The most popular one is Strohl systems. The downside of using any type of specific software is that a user needs to have training in it in order to get the best use out of it. The software also requires the cost of an annual license. Any plan will need to be printed out in a hard copy form to ensure that it is available if there is no access to electronic copies. A lot of companies have found that it is just as easy to document their plans using word processing software that the majority of people are comfortable using. There is no specific training needed for this software and maneuvering around the document can be facilitated by the use of hyperlinks. 13. How might my company be affected by future terrorist activity? That will depend largely on the nature of your business, the extent of international operations, name/brand recognition, or other factors that may make your business a target of terrorist activity. An analysis of the potential threat, and existing security measures will help you determine your exposure to a direct terrorist attack. A more likely scenario will involve terrorist attacks to the public sector utilities and service providers such as the recent attacks involving the mail. You should ask yourself What if? there was a disruption to vital services such as electrical power, telephone, natural gas, or mail delivery. The answers to these questions will help you develop a plan for each possible occurrence. 14. My company has an Emergency Plan to get employees out of the building but nothing after that. Where should we start? Employee safety is a priority, and it is critical that evacuation plans be tested on a regular basis. Once you have accounted for all of your employees, the emergency is over, and the building has been secured, damage assessment team should be formed to determine the magnitude of the crisis. The damage assessment team should include individuals from each major business function. This is the start of the recovery process, which will need to be documented. It will involve possible re-location of operations, crisis communication (both external, i.e. media, and internal), initiation of restoration services, and insurance claims processing. Pre-planning for alternate workspace, computer hot or cold sites, restoration service providers, and development of a written crisis communication plan will help expedite your company s recovery. 15. What are some things I can do right now to improve my recovery possibilities? Draw up a process flow diagram for your most important processes so that you can see where you are likely to have interdependencies within your company and where you have issues with regard to sole suppliers. Review where there are single source and sole source suppliers. And look at alternatives to these suppliers or work with these suppliers to ensure that they have back up plans in the event that they have an incident.

5 Ensure that you have a good evacuation plan in place and that you know how to contact all employees in the event of an incident. Ensure that emergency responders are properly trained, and that designated alternates know their role as well. Draw up a list of contractors that are able and willing to assist you in the event of a building problem. Get full contact numbers and back up contractors available if first choice contractors are unavailable at the time of the incident. Have a recovery strategy and priorities agreed to by company executives. 16. My insurance program has become very expensive as a result of 9/11, and purchasing BI has become very expensive, contingent BI is almost impossible to purchase. Can drawing up a Business Continuity Plan help me? At the moment there has been no clear connection between having a Business Continuity Plan in place and not having one in place with regard to purchasing BI insurance. The process of drawing up a BCP will help a company to determine it s precise BI value for each location. It will also help a company to work with their suppliers to limit contingent business interruption by encouraging recovery planning. Another benefit from the BCP process is that is may identify otherwise uninsured, or un-insurable business interruption potential such as downtime caused by regulatory violations, chemical releases, or other perils not normally covered by a standard insurance contract.