Continuity Risk Management: What Every Risk Manager Needs to Know

Transcription

1

2 Continuity Risk Management: What Every Risk Manager Needs to Know SESSION CODE 704 Speaker: David Nolan, CEO, Fusion Risk Management, Inc.

3 Learning Objectives At the end of this session, you will: Understand how business continuity risk can contribute to catastrophic losses. Know what drives the need for a strong business continuity program beyond just loss avoidance. Understand how Continuity Risk Management fits in your overall risk management strategy. Have a working knowledge of the tactical and strategic implications of continuity risk management. Know how to determine if the program in your company can and will deliver the results you are counting on.

4 Learning Objectives

5 Con/nuity Risk Management: What Every Risk Manager Needs to Know Presenter: David Nolan, CEO & Founder, Fusion Risk Management, Inc. Abstract: This presentaaon will place Business ConAnuity Management in the context of broader Enterprise Risk Management in pracacal, sensible terms. As disparate disciplines of risk management converge and compete for resources and funding, it is more important than ever that Corporate Risk Managers fully understand the principles and best pracaces needed to protect an organizaaon from catastrophic loss. ConAnuity Risk Management has moved into the mainstream for assessing vendor risk, insurance risk, and lending risk assessments. Learn how to logically and effecavely put the pieces together for your firm.

6 Agenda Business Continuity Risk Management ( BCRM ) What every Risk Manager Should Know! What Defining BCRM Why Jus/fying BCRM Who Organizing BCRM - Roles How Establishing a BCRM Process When Sustaining BCRM

7 BCRM - defined Business Con/nuity Risk Management ( BCRM ) the business process that prepares an organiza3on to keep its products and services, and therefore our revenue flowing under extreme adverse circumstances. A typical business conanuity program should consider, at a minimum, four primary disrupaon scenarios including: Disrup/on of IT Services any disrupaon affecang access to IT Services. Too open referred to as IT Disaster Recovery. Workplace Disrup/on any disrupaon of a business enaty (offices, call centers, trading rooms, manufacturing plants, labs, warehouses etc.). Workforce Disrup/on any disrupaon involving personnel such that sufficient, trained and skilled personnel are not available. Possible causes may include labor acaons, pandemic, and regional disasters where the community or public infrastructure is severely impacted causing severe absenteeism. Supply Disrup/on any external supplier, service provider, uality or logisacs disrupaon that stops or slows the movement of criacal products and/or services.

8 BCRM is a Science Science (from LaAn scien&a, meaning "knowledge" [1] ) is a systemaac enterprise that builds and organizes knowledge in the form of testable explanaaons and predicaons Ø Data Ø OrganizaAon Ø Process Ø Logic Ø Measurement Ø Procedures and Recipes

9 BCRM is an Art The arts are a vast subdivision of culture, composed of many endeavors ArAsAc elements come into play when dealing with variables that make it impossible to predict precisely what may happen. Ø ObservaAon Ø Assessment Ø InterpretaAon Ø CommunicaAon Ø OrchestraAon Ø ImprovisaAon

10 BCRM Program Scope Cause Ø Workplace DisrupAon Ø Workforce DisrupAon Ø Supply DisrupAon Ø IT DisrupAon Effect Ø OperaAonal Impact Ø ReputaAonal Impact Ø Compliance Impact Ø Financial Impact BCRM Programs must focus on Risk Intersec/ons where processes and en//es interact and be flexible enough to adapt to the nature of the incident. Impacts must paint the picture showing first and foremost how a company works, how it breaks and how it can be put back together.

11 Fiscal & Fiduciary Drivers Fiscal Ø TacAcal ExecuAon Ø Quarterly Results Ø ProducAvity Ø Cost Control Ø Efficiency Ø Revenue & Profit Fiduciary Ø Strategic Ø Value CreaAon Ø Value ProtecAon Ø Trust Ø Prudence Ø Brand & Equity Value The immediacy of fiscal pressures oxen trumps the best fiduciary inten/ons. Un/l a balance is established, BCRM will lack direc/on and underperform.

12 Evolving Business Drivers Tradi/onal Drivers Ø Loss avoidance Ø Regulatory Compliance Emerging Drivers Ø Contract Compliance Ø Customer AcquisiAon Ø Customer RetenAon Ø Insurability Ø Access to Capital Markets Ø Equity & Brand ProtecAon Emerging drivers move BCRM into the cri/cal path of fiscal objec/ves providing savvy firms a window of opportunity to finally do this right!

13 Shifting Priorities From: Compliance Financial Loss Avoidance Brand/Reputa/on Impact to Opera/ons To: Impact to Opera/ons Brand/Reputa/on Financial Loss Avoidance Compliance All real business impact flows from disrup/on to opera/ons. Failure to priori/ze opera/onal impact leads to waste and risk.

14 Attributes of Underperformers

15 Who Cares About What? Risk Manager Opera/ons Manager Ø Insurance Ø Property Loss Ø Injuries Ø Liability Ø Claims Ø Financial impact BC Manager Ø Process Disrup/on Ø Surviving Opera/ons Ø Opera/onal Alterna/ves Ø Mobiliza/on Ø Logis/cs Ø Opera/onal Impact Ø Evacua/on Ø First Responders Ø Triage Ø Loss Control Ø Salvage & Restore Un/l your teams are aligned, you will spend more and get less for your investment.

16 Collaboration to Manage Risk A successful BCRM program depends on: Ø Clearly defined roles, Ø Policy and process for communica/on, Ø Accountability Business Stakeholders Ø Outage Tolerance Ø Loss Tolerance Ø Strategies Ø Alterna/ves Ø Direc/on & Approach Ø Decision Making Risk Manager BC Manager Opera/ng Manager

17 6 Steps to Success Define Charter & Policy Risk & Impact Assessment Risk DisposiAon & Strategy Development ImplementaAon & Planning Exercise & EvaluaAon Governance, Management & ConAnuous Improvement.

18 Charter & Policy Ø Purpose Ø Scope Ø ObjecAves Ø Risk Tolerance Ø Accountability Ø Sustainability Charter and Policy set the tone for everything that follows.

19 Risk & Impact Management Ø Top down approach Ø Focus on Risk IntersecAons Ø Fact- based, negoaated and resolved Ø Factor Risk and investment appeate Ø Measured: ü Minimal: an impact contained at departmental levels ü Material: an impact visible at corporate levels, but manageable locally ü Significant: an impact that would require corporate intervenaon & resources ü Catastrophic: an impact that would be visible in the public domain and would require corporate intervenaon and resources, and may threaten the stability of the firm. Con/nuity Risks are characterized by extraordinary poten/al impacts with rela/vely low probabili/es leaving too many organiza/ons unwi_ngly accep/ng outsize risk.

20 Risk Disposition & Strategy Ø Low cost, high impact measures first, Catastrophic next Ø Work from top to bodom, not in order of discovery! Ø Consider miagaang some of several, rather than all of one risk Ø Build strategies to evolve over Ame Ø Manage residual risk, not just capabiliaes Ø Align strategies with business plans Vulnerabili/es and threats are endless. The funds to address them are not!

21 Implementation & Planning Ø Focus on informaaon versus documents Ø Approach logically & methodically: Ø What do you need to know Ø What you do know Ø What you don t know Ø Build a plan to discover, learn and/or create what you don t know Ø Resist big capital items unal you have a plan to leverage them Ø Engage stakeholders for what they know Ø Don t try to make business leaders into BC Planners Planning is all about having the informa/on we need to make good decisions fast, communicate effec/vely and leverage the benefit of forethought.

22 Exercise & Evaluation Ø Plans and people need exercise! Ø Be realisac Ø Engage execuaves as a team building event Ø Focus on training paracipants over tesang the plan Ø Apply scenarios and variables to challenge paracipants Ø Be prepared to inject variables to key people engaged Ø Catalog key learning and apply to improve plans A good exercise presents a compelling opportunity to see how people work under pressure along with poin/ng out areas needing improvement.

23 Governance Ø Focus on data management Ø InformaAon currency & accuracy is criacal Ø Understand data half life Ø Align improvement with exercise program Ø ProacAve data management replaces annual BIAs Ø Governance is central to compliance Ø Contractual Ø Regulatory Ø Standards An organiza/on is either commiaed to quality, customer service and shareholder value or it is not. BCRM is a process, not a project.

24 Successful Programs Emphasize: ü Data over documents ü Process over projects ü Flexibility over rigidity ü DistribuAon versus central control ü Simple over complex ü CommunicaAon & CollaboraAon ü Residual Risk and capability

25 Closing thoughts Ø Make BCRM a part of your risk management agenda. Ø Understand the implicaaons of uninsurable risks. Ø Ensure comprehensive scope including supply. Ø Focus on operaaonal issues first and foremost. Ø Invest to ensure the flow of products and services. Ø Focus on knowing, not just plans and procedures. Ø Exercise your program, your people and your plans. Ø Build a repeatable process for sustainability Ø Make sure you understand residual risks there will always be some even if the plans work exactly as craped.

26 Executive Guide To Business Continuity Management This white paper provides the guidance that every C- Level execu/ve should have to ensure that their BC Programs are aligned with their business needs and objec/ves.

27 Questions? David Nolan, CEO Fusion Risk Management, More Information? WHILE YOU ARE AT OUR LINKEDIN COMPANY PAGE, JOIN OUR INVITATION- ONLY GROUP BCM INNOVATORS

28 Action Required! Your presentation and handouts are due by April 10 Once uploaded, changes are not permitted until onsite in New Orleans Update your profile TODAY

29 Header & Reminders (Ariel 44pt bold) Main Bullet points (Ariel 20pt, bold) Sub bullet point (Ariel 16pt, not bold) Do not clutter your slide (Ariel 20pt, bold) Less is more (Ariel 16pt, not bold) Graphs and video clips are encouraged (Ariel 20pt, bold) The meeting room will have Wi-Fi (Ariel 16pt, not bold) No sales pitches (Ariel 20pt, bold) If your session is reported to management as selling your service or company, you will prohibited from speaking at a future RIMS event (Ariel 16pt, not bold) Speaker Registration and Ready Room (Ariel 20pt, bold) Ernest N. Morial Convention Center, Room 211 All speakers MUST report to this room to pick up name badges and review presentations with the audio-visual technician at least 4 hours before the session begins.