BUSINESS CONTINUITY PLANNING. Alberta Public Housing Administrators Association Conference October 2017

Transcription

1 BUSINESS CONTINUITY PLANNING Alberta Public Housing Administrators Association Conference October 2017

2 Recent Major Disasters Horse River wildfires Southern Alberta floods Gainford CN Derailment Slave Lake wildfires Hurricane Harvey Hurricane Carol Hurricane Irma Terrorist incidents BC Wildfires Husky Pipeline spill SK Wannacry global cyber Lac Magentic Kalamazoo oil spill Gulf oil spill Sask oil spill Las Vegas active shooter

3 The NEWS. The Institute for Business and Home Safety estimates that of businesses affected by natural disaster, 25% never re-open; The Strategic Research Institute found that of those businesses affected by a natural disaster, 43% never re-open, and of those that do, 29% fail within two years; Calgary Chamber of Commerce

4 Recent But Almost Forgotten.? UNIVERSITY OF CALGARY RANSOMWARE HACKERS SET THEIR SIGHTS ON SMALL, MEDIUM FIRMS Edmonton Journal Sept. 12, 2016 UPDATE: STRUCTURAL ISSUE CLOSES PART OF CITY HALL 5 Floors of Calgary City Hall Evacuated due to structural problem with steel truss 630 CHED Sept 19, 8:42 AM TRANSFORMER FIRE CAUSES MULTI DAY POWER BLACK OUT DOWNTOWN YYC and YVR

5 Risks are Changing.. Scope and scale Frequency Duration Types of risks

6 one in a hundred years

7 Are We Ready How do you know if you are ready? How do you plan and prepare? What about my business/organization during and after a crisis or emergency?

8 Business Continuity Management (BCM) The objective of Business Continuity Management is to make the organization more resilient to potential threats and allow the entity to resume or continue operations under adverse or abnormal conditions. This is accomplished by the introduction of appropriate resilience strategies to reduce the likelihood and impact of a threat and the development of plans to respond and recover from threats that cannot be controlled or mitigated

9 Program Initiation and Management Establish the need for a Business Continuity Management Program within the organization Develop support and funding to build the organizational framework to develop the BCM program Identify the program components from understanding the entity s risks and vulnerabilities Develop resilience strategies and response, restoration and recovery plans.

10 BCM In Your Organization

11 Business Continuity Management Program Hazard/Risk Vulnerability Analysis Emergency Response Plan Business Continuity Plan Crisis Communication Plan Exercise, Maintenance and Audit program

12 Emergency Response Plan

13 Business Continuity Plan

14 Business Continuity Plan The Business Continuity Plan is a set of documented processes and procedures which will enable the entity to continue or recover time sensitive processes to the minimum acceptable level within the timeframe acceptable to the entity. Design, development, and implementation of the continuity strategies including the documentation of recovery plans to be used in response to an incident or event.

15 Risk Assessments identify the risks/threats and vulnerabilities that are both inherent and acquired which can adversely affect the entity and its resources, or impact the entity s image. Once identified, threats and vulnerabilities will be assessed as to the likelihood that they would occur and the potential level of impact that would result. The entity can then focus on high probability and high impact events to identify where controls, mitigations or management processes are non-existent, weak or ineffective

16 Risk Risk = Likelihood X Impact Communication Risk = Likelihood X Outrage Peter Sandman

17 Business Impact Analysis An approach to determining which services and processes are most impactful to an organization in the event of disruption Resources and requirements to bring services and processes back to operating level Critical, vital and necessary and desired Recovery Time Objective (RTO) and Recovery Point Objectives(RTO) for services

18 Strategies for Recovery Identify the likely and potential impacts from events on the entity or its processes and the criteria that will be used to quantify and qualify such impacts. The criteria to measure and assess the financial, customer, regulatory and/or reputational impacts must be defined and accepted and then used consistently throughout the organization The result of this analysis is to identify strategies, regarding time sensitive processes and the requirements to recover them in the timeframe that is acceptable to the organization

19 Business Continuity Plan Organizational ownership Risk assessments Business impact assessments Recovery strategies

20 the time to ensure it works is before you need it to work

21 Test, Evaluate and Improve Plan familiarization Table top exercises Drills Scaled exercises

22 Maintenance and Audits Contact information Service/Supplier updates Minutes and notes Plan changes

23 Crisis Communications

24 Crisis Communications Social media Traditional media Website Brand and Reputation

25 HSE People are your most important resource = What programs do you have in place to support them? PTSD - in New York over 50% of the police who responded to the World Trade Centre left within 5 years.* estimated. What are we seeing in AB after Fort McMurray wildfires?

26 Everyone has a plan, until they get hit in the face! Best Caption Ever?

27

28 THANK YOU Kim Irving Ph: / Cell: