Business Continuity Plan. The 12 Steps Model. Business Continuity Plan. Emergency Contingency Crisis Castastrophe Disaster.

Transcription

1 1 Origin (Manufactur er / Supplier) Dispatching Port Business Continuity Plan. Unloading Port The 12 Steps Model Destination Fundamentals 2 Emergency Contingency Crisis Castastrophe Disaster 1

2 Emergencies 3 Medical Minor Fire Bomb Threats Work Accidents Contingencies 4 Floods Hurricanes Moderate Fire Tornados Earthquakes Civil Disturbance Strikes 2

3 Crisis Mayor Fire Explosions Sabotage Extortion Kidnapping Terrorism Product Related Incidents Financial 5 Catastrophe / Disaster 6 Catastrophe is a tragic event where destruction or total loss is present. Disaster is the highest impact adverse event where several persons resulted seriously damaged. 3

4 Historic Events with Business Interruption 7 Katrina Hurracane Kobe Earthquake Turkey Earthquake Jackson Tornado AsiaTsunami Political Disturbance in Caracas Political Disturbance in Manila Cyber Attacks NY. 9 / 11 General Scope 8 An effective (BCP) provides procedures and solutions that prevent or permit rapid recovery from, business interruptions to critical business operations. The BCP is tested to verify its effectiveness, and its updated annually or whenever the site s exposure to business risk changes. 4

5 Main Parts of BCP PHASE 1 Understand Business Interruption and establish Business Recovery Priorities 1. Risk Analysis 2. Overall Strategy 3. Critical Programs Risk Mitigation 4. Verification of IT DR Requirements 9 PHASE 2 PHASE 3 PHASE 4 Establish detailed Contingency Plans Document and test Contingency Plans Incorporate Business Continuity Planning into Daily Management 5. Contingency Plans for IT Loss 6. People Relocation Contingency Plan 7. Move Work to Alternate Site Contingency Plan. 8. Crisis Management Plan 9. Document BCP 10. Review BCP with COE and Management 11. Perform Annual test of BCP 12. Incorporate BCP into Daily Management System 10 Step 1: BCP Strategy The foundation for an effective BCP is: A deep understanding of the risks to the site What risk mitigation effort has been put against them The business importance of the site Work Processes Work Process Priority and the Business Interruption Limit (BIL) document and describe the business importance. This allows development of Business Recovery Strategies that will guide efforts to recover Work Processes in a way that minimizes the effects of the business interruption. 5

6 11 The Business Interruption Limit (BIL) is defined as the maximum amount of time that a Work Process can be interrupted before presenting an acceptable loss to the Company, expressed as days / months. The site s BCP will be based on the collective BIL s for their Work Processes. BIL Rational Template Business Recovery Priority Matrix 12 GUIDE LINE TO DETERMINE ACCEPTABLE LOSS: BIL RATIONAL TEMPLATE send BCP Leader + BCP Owner Questions 1-4 Questions: 1. Is cash flow ( no receibles for several days) seriously impacted? 2. Would we be in danger of losing stock equity ( closing the books late)? 3. Would payables be disrupted? ( penalties, row material disruption) 4. When would there be a significant interruption of orders and / or shipments? review Document Approved 6

7 13 Business Interruption Limit Rationale Data used to determine the Business Interruption Limits Decision makers Date of Efectiveness Limit (s) How long is the data good for? Any assumptions made? 14 Critical Recover 1st Key Important Recover 2nd Not critical - Recover next C most critical days Q quarter end Special Notations P Payroll Monthly Business Cycle (by critical work days) Function/Work Process BIL (day s) EXAMPLE Packing IT Services 1 Manufacturing Accounts Payable C C Q Q Dispatch 3 Invoicing 18 Q P P Row Material Reception. 7 Treasury 5 7

8 15 Choices are typically in 3 categories: DO NOTHING Estimated, close on forecast, use the previous payroll, and adjust later. DO IT LATER Inform customers we will be late DO IT ANOTHER WAY Relocate the people or the work 16 Step 2: Risk Analysis Site exposure to threats that could create business interruptions must be analyzed so their likelihood of occurrence and the business impact of an occurrence are understood. Tools in this Step are used to categorize site threats by level of Risk (Low, Medium or High), so appropriate mitigation actions may be taken. 8

9 17 Likelihood of Occurrence Table DESCRIPTOR High likely Likely Unlikely NA MEANING A threat whose occurrence is probable in the next 1 year A threat whose occurrence is probable in the next 10 years A threat whose occurrence is probable in the next 100 years Not applicable No history or possibility or threat 18 DESCRIPTOR Business Impact Table MEANING Catastrophic Major Complete disaster with potential to interrupt all critical Work Processes like order management, payments, payroll, customer service, close the books etc. For weeks longer than the BIL Event that could cause an interruption to all/some critical Work Processes for days beyond the BIL Minor Event that will not threaten the BIL. Do not assume a contingency plan in place to select minor. 9

10 19 Likelihood of Business Impact Table Business Impact High likely Likely Unlikely NA Catastrophic High High Medium NA Major High Medium Low NA Minor Low Low Low NA 20 Step 3: Critical Programs Risk Mitigation Critical Programs such as Fire Protection, Critical Spares and Health Safety & Environmental can mitigate many threaths so the likelihood of business interruption is greatly reduced. Step 3 verifies that the Critical Programs have been audited on schedule and also identifies any incomplete improvement plans that could influence business interruption risk. 10

11 21 Step 4: Verification of IT Contingency Plans In this Step, each Work Process Owner works with their IT resources to understand and verify that IT Contingency Plans exist and they are sufficient. 22 Step 5: Loss of IT Contingency Plans Are manual or alternate Work Processes to collect and process information during an interruption of an IT application. They have a dual purpose: Allow the business process to continue functioning at a minimal acceptable level ( measured in hours / days ). Collect data that will be re-entered entered in an application once restored (in the worst case) at a Disaster Recovery site. 11

12 23 Step 6: Loss of Site People Relocation Contingency Plan. If the site is damaged or access is restricted, but personnel is available to work, The People Relocation Contingency Plan details how people will be relocated to either Local or Remote alternate work sites. 24 Step 7: Loss of People Move to an Alternate Site Contingency Plan. If people are not available to work either at the site or to relocate to an alternate site due to natural disaster or other event, the Work Process must be moved to another location that can execute the work. The Move Work to an Alternate Location Contingency Plan identifies the relocation destination and develops detalied instructions to relocate the Work Process to it. 12

13 25 Step 8: Crisis Management Plan The set of procedures to be used if the Site BCP Owner, or his/her designate, declares a Site Crisis. The Crisis Management Plan is comprised of procedures that are invoked at the time of a crisis. Crisis Team Members Crisis Command Center and appropriate communication channels Management of the initial phases of the incident Establish business recovery priorities and invoke the correct Contingency Plans 26 Step 9: Document BCP The BCP document is comprised of 6 key sections: Crisis Management Plan Business Recovery Plan (Summary of Contingency Plans) Business Resumption Plan Risk Analysis Business Interruption Limit Rationale References 13

14 27 Step 10: Review BCP This step requires that the site BCP is reviewed and approved by: the Site BCP Owner, GBS BCP document is comprised of 6 key sections: 28 Step 11: Perform Annual Test of BCP Even the best BCP is not completed until it is tested to see if it will actually work. The Site BCP Owner and Work Process Leader will determine the level of testing necessary. At minimum, a table top test will be performed. 14

15 29 Step 12: BCP Maintenance The last step in the BCP CBA is to make the Business Continuity Planning process part of the Daily Management work for the site. Certain site people should receive training in BCP concepts and the specifics of the site s. Implementation Team P&G Site Senior Person BCP Owner & Sponsor 30 Delegates the execution responsibility CWP = Critical Work Process BCP BCP Leader Leader Lead Implementation Work Process Owner CWP CWP CWP CWP CWP CWP CWP Work Process Owner 15

16 The existence of a Contingency Plan DOES NOT ELIMINATE the risk. A high o medium risk can remain regardless of wheater a Contingency Plan exists or not. 31 Q U E S T I O N S? 32 IF YOU WANT TO LIVE IN PEACE, BE PREPARED FOR THE WAR Víctor Hugo Thank you! Eduardo Jiménez Granados Corporate Security Manager Procter & Gamble LA North 16