integrating resiliency as a strategic priority

Integrating Resiliency as a Strategic Priority: Seven Guiding Principles to Bring

Your Program to the Next Level

Chartered Accountants & Business Advisors mnp.ca

Our Aim

To share Seven Guiding Principles that can help you make your business continuity and emergency management programs a strategic priority.


Outline

The Need - Background and Observations

The Audience - Who the Principles apply to

The Principles - Presenting the 7 Guiding Principles

Wrap Up, Questions, and Discussion


Observations

Many organizations have sound individual plans but lack synergy between them, sometimes resulting in a disjointed and potentially ineffective program

Gaps between BCM/EM programs and strategic goals of the organisation

Often focus is on compliance vs. competitive advantage

BCM and EM practitioners struggle to obtain senior management and/or middle management support

Business Continuity and Emergency Management is not adequately leveraged within organisations

BCM and EM viewed as a cost centre not a value driver

13


What does it all mean…

Continuity is not a strategic priority


Business resilience is about capability to prevent disruption and mitigate risks associated with failure

to meet objectives

Can mitigate significant strategic and operational risk

Encompasses people, processes, and technology

Is required for any organization offering continuous or a high level of customer service

Is about maintaining a competitive advantage before, during, and after a major event

Note: These are strategic business and community issues

What is Resilience from a Strategic Perspective?


Who Do These Principles Apply To?

Those responsible for business continuity and IT disaster recovery

Emergency Management Professionals and Staff

Executives and Senior Management

Risk Management Professionals


The Seven Principles

#1 Integrate your program and link it with risk, performance improvement, and other business programs

#2 Identify, engage and manage key stakeholders

#3 Understand the business operations (and cost of not having resiliency) through comprehensive analysis and risk assessments

#4 Identify and support the needs of senior management

13


The Seven Principles (continued)

#5 Emphasize the strategic aspects and value proposition of your program – how it protects people, reputation, cash flow, customer service

#6 Customize and “size to fit” – Apply best practices but tailor your program to fit the structure, culture, and budget of your organization

#7 Focus on people, process, technology and brand protection throughout response and recovery

13


Integrate your program and link it with enterprise risk and/or other business programs

# 1 Integrate Your Program


Integrate Your Overview

CRISIS

MGMT.BCPDRPERP

Business Continuity Plan and Program

Emergency Response Plan and ProgramCrisis Management

IT Disaster Recovery Plan and

Program


Integrate Business Resilience with other Programs

Integrated Program

Pre -

Business

Continuity

Planning

Crisis

Managem

ent

Disaster

Recovery

Business

Continuity

Crisis

Management

Em

ergency R

esponse

Com

munication

& C

oordination

Interim B

usiness

Process

Business

Continuity

People

Location &

Resources

Procedures

Disaster

Recovery

Applications

Technical Infrastructure

Data R

ecovery

EV

EN

T

Enterprise Risk

Management

RM

Optim

ization

Risk A

ssessment

Risk R

esponse

Risk M

onitoring

Integrated Program

Pre-Event Post-Event

Business

Continuity

Planning

Crisis

Managem

ent

Disaster

Recovery

Business

Continuity

Business

Continuity

Planning

Crisis

Managem

ent

Disaster

Recovery

Business

Continuity

Crisis

Management

Em

ergency R

esponse

Com

munication

& C

oordination

Interim B

usiness

Process

Crisis

Management

Em

ergency R

esponse

Com

munication

& C

oordination

Interim B

usiness

Process

Business

Continuity

People

Location &

Resources

Procedures

Business

Continuity

People

Location &

Resources

Procedures

Disaster

Recovery

Applications


Data R

ecovery

Disaster

Recovery

Applications


Data R

ecovery

EV

EN

T

Enterprise Risk

Management

RM

Optim

ization

Risk A

ssessment

Risk R

esponse

Risk M

onitoring

Enterprise Risk

Management

RM

Optim

ization

Risk A

ssessment

Risk R

esponse

Risk M

onitoring

RM

Optim

ization

Risk A

ssessment

Risk R

esponse

Risk M

onitoring

Do not try to “go it alone”

Integration does not necessarily mean organizational redesign

Risk Management is a logical link but select what works best in your organization


Example from our professional services firm

Integrated Resilience Functions


Identify, engage and manage key stakeholders

# 2 Engage Key Stakeholders


Conduct frequent and comprehensive analysis and risk assessments to fully understand business operations and cost of not building resiliency

# 3 Understand the Business Operations


Understand Your Business

Response& Recovery

Program Maintenance

Benchmarking

Elements of a Resilient Program

Recovery

Plan Testing Strategy

Planning

Training Program Implementation

Plan Development

Threat, Vulnerability, Risk Assessment

Business Impact Analysis



An effective continuity program begins with understanding the business

Recovery

Plan Testing Strategy

Planning

Response

&

Recovery

Program Maintenance

Benchmarking

Elements of

a Resilient Program

TrainingProgram Implementation

Plan Development

Threat,

Vulnerability, Risk

Assessment

Business Impact

Analysis


An effective continuity program achieves resiliency through: Dynamic Planning Response and

Recovery Focus on People Value Creation Communication

Response&

Recovery

Program Maintenance

Benchmarking

Elements of a Resilient Program

Recovery

Strategy

Planning

Training Program Implementation

Plan Development

Threat, Vulnerability, Risk Assessment

Business Impact Analysis

Scenario

Testing



Identify and support the needs of senior management

# 4 Support Needs of Senior Management

http://story.news.yahoo.com/news?g=events/ts/091101nydccrash&a=&tmpl=sl&ns=&l=1&e=891&a=0


Management needs to...

Minimize negative surprise

Resolve uncertainty and variances from expectations

A process to identify opportunities

Maximize opportunity for success and good performance

Employ the entire organization in the business resilience process

Align organizational objectives

Enhance stakeholder confidence through the execution of their plans

13

Note: These are all value drivers a business continuity and emergency management programs

can influence


Emphasize the strategic aspects and

value proposition of your program

# 5 Understand and Emphasize Your Value Proposition


Minimize financial losses

Protect personnel

Protect assets

Protect and improve reputation

Enhanced customer service

Ensure high quality and efficient processes

Maintain stakeholder obligations

Value Proposition


The Cost of Not Preparing:

Financial losses

Business interruption

Loss of key client/key supplier

Loss of reputation

Legal liabilities

Injury to people

Environmental damage

Regulatory scrutiny

Loss of customer service

Going out of business

Blackout 2003

Labour Disruption

Pandemic

Border Shutdown

Value Proposition

Blackout 2003

Workplace Violence

System Meltdown

Labour Disruption

Natural Disaster

Pandemic

Border Shutdown


Apply best practices but tailor your

program to fit the structure, culture

and budget of your organization

# 6 Customize and “Size to Fit”


• Understanding risks and business needs, you can customize your plans and response

• Not every organization needs the expensive strategy option; advancements in teleworking

and a sound BIA will allow for a more cost-effective and creative (i.e. In house) recovery

• You need to understand the culture and the tolerance

• You can’t do this in your office or straight from paper

• Every organization, or every department has different priorities that you need to understand

and address

Tailor to Culture


Focus on people, process, technology and

brand protection throughout response and

recovery

# 7 Focus on People, Process, Technology & Brand

Throughout


We must consider a business resilience program based on business

response and business recovery

OPERATIONAL

STRATEGIC

TACTICAL

…Throughout Response and Recovery


We must consider business response and business recovery

Immediate internal emergency

response plansBusiness

Response

STRATEGIC

TACTICAL

OPERATIONAL

STRATEGIC

TACTICAL





response plans

External

customer-focused

response/recovery plans

Business

Response

Business Recovery


OPERATIONAL

STRATEGIC

TACTICAL




response plans

External

customer-focused response/recovery

plans

Risk plans linked to Strategy and

Performance Management

Bu

sin

ess

Re

silie

nce

Business Response

Business Recovery

OPERATIONALOPERATIONAL

STRATEGIC

TACTICAL



What can you do…

Plans should be aligned with your strategy

Identify critical people, processes & assets (BIA)

Identify threats, understand vulnerabilities & assess

risks

Incident Response

Act Decisively

Employee assistance programs

Scenario Testing

Tactical Planning Considerations:

Tactical plans (response plans) “keep your house in order”

OPERATIONAL

STRATEGIC

TACTICAL


Protect your liquidity

Identify critical suppliers

Vendor and sourcing alternatives

Streamlining processes for minimum disruption

Reliable communication channels

Operational Planning Considerations:

Operational Plans (recovery plans) help to keep

your business in order and your clients satisfied

OPERATIONAL

STRATEGIC

TACTICAL

What can you do…


Leverage your gains before the crisis worsens

Understand changing customer requirements

Review key business objectives to ensure relevancy

Focus on value-creation & Innovation – customers, products,

services

Project volumes and set priorities

Protect your brand

Strategic Planning Considerations:

Business Resilience transforms a “crisis” into a competitive advantage

OPERATIONAL

STRATEGIC

TACTICAL

What can you do…


Conclusion

The 7 Guiding Principles HelpKeys to Successful Implementation

1. Strong “tone at the top” and sponsorship

2. Assessment is a ongoing process, not a one time

event

3. People in the businesses will need to understand

“what’s in it for me?”

4. Active participation will be required by all levels

5. Ask for assistance from

experts

#1 Integrate and link your program

#2 Identify, engage and manage key

stakeholders.

#3 Understand the business

#4 Identify and support the needs of

management

#5 Emphasize the strategic aspects

and value proposition

#6 Customize and size to fit”

#7 Focus on people, process,

technology and brand protection

throughout


Thank You

“When the tide goes out,

we find out who’s been swimming without a bathing suit”

– Warren Buffett, July ‘07

Shanda Chronowich, CBCP

416-515-3820

[email protected]

Cliff Trollope, CBCP, CAS

416-515-3851

[email protected]

integrating resiliency as a strategic priority

Documents

guiding principles

strategic priority

emergency management

business continuity

need background