Paul Hopkin. Fundamentals of Risk Management

Подождите немного. Документ загружается.

164 Risk assessment

arrangements for reducing the damage caused during the incident and containing the cost

of recovery from it.

Disaster recovery plans are a particular component of business continuity planning. If a com-

puter system fails to operate correctly or data has become corrupted, the organization will

need emergency procedures to ensure that the data can be recovered and/or ensure that the

organization continues in existence.

For a printing ﬁ rm IT systems are fundamental to the operation of the company, because the

computer systems process orders, schedule printing and manage invoicing. For such a

company, it may be appropriate to arrange for a mobile emergency computer facility to be

available in case of major IT failure. If this decision is taken, a contract should be set up with

an outside company for a duplicate computer to be delivered in a trailer to the premises of the

company. The duplicate computer would then be connected and the operations would be

controlled from the duplicate computer in the trailer. The success of this arrangement will

depend on the availability of information from backup disks that should be produced at least

once per day and possibly several times per day.

Business continuity standards

The British Standards Institute has published a standard on business continuity management

(BCM). This is BS 25999 Part 1 ‘Code of Practice – Business Continuity Management: 2006’

and it provides a widely accepted overview of the key components of business continuity plan-

ning. The standard identiﬁ es a business continuity planning life cycle that has the following

ﬁ ve components:

understanding the organization; •

determining a BCM strategy; •

developing and implementing a BCM response; •

building and embedding a BCM culture; •

exercising, maintaining and reviewing. •

There are many well-established approaches to business continuity planning, in addition to

British Standard BS 25999, although most approaches are compatible with the requirements

of this standard. Figure 18.1 provides a model for business continuity planning that is consist-

ent with BS 25999.

Table 18.1 provides a checklist of the key activities involved in business continuity planning,

which is recognized as a vital buy in most large organizations. Indeed, most governments take

an active role in encouraging businesses (especially small businesses) to develop and imple-

ment adequate business continuity plans.

Business continuity planning 165

Understand the business

context:

business impact and risk

assessment tools identify crucial

deliverables and enablers,

evaluate recovery priorities and

assess the risks that could

lead to business interruption

BCM strategies:

identify alternative strategies to

mitigate loss, assess the relative

merits of these against the

business environment and their

effectiveness in maintaining

critical functions

Develop a response:

develop the risk proles by

improvements to operational

procedures. Implement

alternative business strategies

using risk nancing measures

and business continuity plans

Apply and plan

maintenance:

continue testing the

plan, audit and change

management of the

BCM and its processes

Establish a continuity

culture:

introduce the business continuity

management process through

education and awareness of stakeholders,

customers, employees and suppliers

Business

Continuity

Management

Figure 18.1 Model for business continuity planning

Table 18.1 Key activities in business continuity planning

1. Assess company activities to identify critical staff, materials, procedures and

equipment required to keep the business operating

2. Identify suppliers, shippers, resources and other businesses that are contacted on a

daily basis

3. Plan what to do if any important buildings, plant or store were to become

inaccessible

4. Identify necessary actions to ensure continuity of critical business functions,

especially payroll

5. Decide who should participate in compiling and subsequently testing the emergency

plans

6. Deﬁ ne crisis management procedures and individual responsibilities for disaster

recovery activities

7. Co-ordinate with others, including neighbours, utility suppliers, suppliers, shippers

and key customers

8. Review the emergency plans annually and when the business changes and/or new

members of staff are recruited

166 Risk assessment

The overriding principles appropriate to successful business continuity planning are that the

business continuity plan (BCP) should be:

comprehensive; •

cost-effective; •

practical; •

effective; •

maintained; •

practised. •

It is important that the BCP should cover all the operations and premises of the organization

to ensure that the plan can facilitate a complete resumption of normal business operations. It

is also important that the plan is cost-effective and proportionate to the risk exposures.

The BCP must be practical and easily understood by staff and others who are involved in the

execution of the plan. Overall, the BCP must be effective in that it will recognize the urgency

of certain business components or functions and identify responsibilities for ensuring timely

resumption of normal work.

In order to guarantee that the BCP will be effective, it needs to be tested, maintained and prac-

tised. All members of staff need to be familiar with the intended operation of the plan and

training will need to be provided. The lessons learnt during testing and practice of the business

recovery plan should be incorporated into the plan so that it becomes more effective.

Testing of business continuity plans is an essential component of ensuring that they will be

appropriate and effective. However, testing of plans can be time-consuming and, in some cir-

cumstances, disruptive and costly. Even the simple example of a ﬁ

re evacuation drill from a

building illustrates that the testing of procedures is inevitably going to disrupt normal routine

operations.

Successful BCP and DRP

The ﬁ rst stage in successful business continuity planning and disaster recovery planning is to

gain a thorough understanding of the organization and its interactions, both internal and

external. Part of gaining this understanding will be to identify the objectives of the organiza-

tion and its key dependencies. It is important to understand the critical functions within the

organization and identify key resources.

Determining BCP strategy will require the identiﬁ cation of risks to the business and decisions

about how likely it is that the risks will materialize. It is also necessary to understand the

impact of risks on the business. These assessments should then be used to prioritize treatment

of the risks and to agree the likelihood and impact of the risks materializing.

Business continuity planning 167

Developing and implementing a BCP and appropriate controls for each of the identiﬁ ed risks

will require decisions on the appropriate risk responses. The range of risk responses available

have already been discussed as the 4Ts of hazard management. In respect of each of the major

risks, the decision will have to be taken whether to tolerate, treat, transfer or terminate the

risk.

Building and embedding a business continuity management (BCM) culture will require good

communication throughout the organization. All stakeholders will need to be engaged and

involved in the process and will need to understand the reasons for the development of the

BCP and DRP. The important role of all employees in the avoidance of incidents that could

result in major disruption should be emphasized.

When developing the BCP, the mission-critical activities should be identiﬁ ed, together with

key roles and responsibilities. These may be produced in the form of clear instructions and

checklists. It is important to exercise, maintain and review the BCP by creating a programme

to test the plans, review and amend them as necessary, and rehearse staff to improve under-

standing of the plans. BCP and DRP should be reviewed at least annually, as well as after a test

of the plans. Also, if an incident occurs, the lessons learnt should be incorporated into the

plans.

The ﬂ u pandemic of 2009 provides an example of the importance of business continuity plan-

ning. Advice and guidance was produced for companies and individuals in many countries

around the world. The box below sets out a summary of the key points provided in that guid-

ance and the practical implications of the ﬂ u pandemic for business continuity. In particular,

it offers thoughts on ‘coming to work sick’ and ‘staying at home well’.

Flu pandemic

Coming to work sick – People commonly are expected to come to work when they are

sick and are often viewed poorly when they stay home with an illness. There are those

who take advantage of sick-day policies, particularly when a ﬁ xed number of paid sick

days is allowed. But when you have a disease where there is a lack of natural immunity,

all it takes is one person to infect a department and that department could infect a

company. If people don’t feel well, they should stay home.

Staying home well – One of the ways to limit the spread of diseases is to avoid forcing a

lot of people into the same small space. If a company has an outbreak, the people who

weren’t at work are likely to survive it and can keep the company running. This would

suggest that work-at-home policies may help a company avoid the worst effects of the

pandemic.

168 Risk assessment

Business impact analysis (BIA)

A critical part of ensuring that adequate business continuity plans and disaster recovery plans

are in place is completion of a business impact analysis (BIA). The BIA will identify the critical

nature of each business function by assessment of the impact of interruption to that activity.

This information will be required in order to identify appropriate continuity strategies for

each function.

The BIA is similar to the risk assessment that is undertaken as part of the overall risk manage-

ment process. However, the critical difference with business continuity planning is that the

emphasis of a BIA is the identiﬁ cation of the relative importance and criticality of each func-

tion, rather than identifying the events that could undermine that particular function.

Therefore, the risk assessment and the BIA are related and could well be undertaken together.

The risk assessment will help in identifying the risks that might threaten the achievement of

the business continuity objectives. Both approaches require a structured and systematic

approach.

The business impact analysis has three clear purposes, as follows:

1. Identify mission-critical activities and the required recovery time in the event of disrup-

tion. This identiﬁ cation process will establish the timeframe within which the critical

functions must be resumed after the disruptive event.

2. Establish the impact potential and the resource requirements for recovery within the

agreed timescale. The business requirements for recovery of the critical function must be

established.

3. Determine whether the likely impact is within the risk appetite of the organization as the

basis for business continuity strategy. The technical requirements for recovery of the crit-

ical function also need to be established.

BCP and ERM

There is an obvious link between BCP and enterprise risk management (ERM). ERM is con-

cerned with the risks facing the whole organization and BCP takes an approach that business

continuity arrangements should be in place. The BCP approach is to look at the continuity of

operations across the whole organization. Ensuring continuity is obviously part of an ERM

approach. It should therefore be considered that BCP is part of ERM, but it is not the whole of

ERM activity. Nevertheless, there is a strong similarity in approach and the business continu-

ity and disaster recovery activities should take place within the context of a broader ERM ini-

tiative, as appropriate.

Business continuity planning 169

Enterprise risk management will be explored in more detail in a later Part of this book. The

basis of ERM is that the stakeholder expectations and the core processes of the organization

that deliver those expectations are the focus of the risk assessment process. The intention of

enterprise risk management is to ensure that the core processes are maintained.

Continuation of core business processes is also the basis of business continuity planning. The

difference in emphasis is that ERM seeks to identify the risks that could impact the core proc-

esses. BCP seeks to identify the critical business functions that need to be maintained in order

to achieve continuation of the business. The approaches are complementary and there is a

good deal of similarity between BCP and this style of ERM.

Civil emergencies

In many countries, there is an obligation placed on local government to ensure the continuity

of local businesses in the event of a major civil emergency. The emergency may be triggered by

a natural disaster, such as ﬂ ooding or earthquake. Alternatively, it could be caused by terror-

ism, civil unrest or by an epidemic/pandemic.

Several organizations may ﬁ nd that they are required to assist the civil authorities in the event

of a civil emergency. This will be the case for organizations that supply products that may be

required in such an emergency or have large buildings that could be used as temporary accom-

modation. The products that may be useful in a civil emergency will include food, bottled

water, clothing and blankets.

Many civil authorities publish guidance for businesses to assist them with their business con-

tinuity planning. For example, the US government provides valuable information on its

website. Also, several trade associations and small business associations offer practical guid-

ance on the business continuity planning, including appropriate actions in the case of civil

emergency.

Most local authorities have statutory responsibility for responding to civil emergencies. Facto-

ries and warehouses may have equipment and facilities that could be useful in the event of a

civil emergency. Likewise, retail shops will have food and other goods that may be required for

distribution as emergency supplies. Also, schools and other civic buildings may be required as

accommodation in the event of a civil emergency.

Encouraging organizations to make arrangements to ensure business continuity will beneﬁ t

local authorities in charge of civil emergencies, because there will be fewer problems and issues

for them to take into account at the time of the emergency. The box below provides a summary

of typical advice provided by a municipal authority to small businesses in the local area.

170 Risk assessment

Secure your business

Thoroughly assessing the disasters that could threaten your ﬁ rm will give you a clear

idea of the business areas that are most important to secure. Usually, these will be the

areas on which your business relies the most, and which are exposed to the greatest

degree of risk. This is the most important part of your plan. The following check points

are essential when writing this stage of your plan. You need to systematically go

through each of the following areas and take a practical approach to tackle each of the

threats that your business may face, following the process:

assign ownership; •

identify threats and resources; •

develop contingency plans and policies; •

premises and key equipment. •

Clearly, your premises are fundamental to your business – so much so that you

probably take them for granted. But you should consider the long-term impact that

damage to or destruction of your premises would have on your business. The same

applies to business-critical machinery. If a vital piece of equipment is destroyed,

damaged or stolen, ask the following questions:

Would you be able to inform your employees and customers of disruption? •

What would happen to customer orders when your premises were closed? •

Would you be able to make alternative arrangements for regular orders? •

Case study

Invensys – risks and uncertainties

Invensys operates globally in varied markets and is affected by a number of risks inherent in

its activities, not all of which are within its control. The Risk Committee has accountability for

overseeing the risk management processes and procedures, and reports to the Board through

the Audit Committee on the key risks facing the business. It also monitors the mitigating

actions put in place by the relevant operational managers to address identiﬁ ed risks. Two

examples of the principle risk faced by Invensys are set out below.

1. The Group faces intense competition and failure to maintain a competitive and techno-

logically advanced product range could reduce its margins and revenue growth.

2. Invensys operates in highly competitive markets and the Group’s products and services

are characterized by continually evolving industry standards and rapidly changing tech-

nology, driven by the demands of the Group’s customers. Failure to keep pace with tech-

nological changes and system or application requirements in the industrial sectors may

result in loss of market share and lower margins.

3. The Group invests in research and development to develop new technologies and prod-

ucts to sustain or improve its competitive position. However, all new technologies and

products involve business risk in terms of possible abortive expenditure, reputation risk

and the potential for onerous contracts and customer claims. The Group reviews its port-

folio of technologies as part of the strategic planning process. In addition, the businesses

control individual development projects through a stage gate review process.

4. The Group may be exposed to liability through the actions of joint-venture partners, co-

source partners or its supply chain.

The business activities of the Group are often conducted in conjunction with joint-venture,

consortium, co-development or co-source partners whose day-to-day management actions

are outside of the control of the Group.

171

172 Risk assessment

A signiﬁ cant element of the Group’s risk proﬁ le is the delivery performance of its supply chain.

Given the nature of the Group’s businesses, a quality or other failure in the supply chain could

present a risk to safety and delivery which could have a material adverse effect on the Group’s

business, ﬁ nancial performance and reputation. Assessment, mitigation and management of

these risks are addressed by the businesses in conjunction with the Group’s legal, supply chain

and risk functions.

Annual Report and Accounts 2009

Part 4

Risk and organizations

Learning outcomes for Part 4

describe the key features of a corporate governance model and describe the links to risk •

management in different types of organizations;

list the different types of stakeholders of a typical organization and explain the inﬂ u- •

ence of these stakeholders on risk management;

provide a description of a simpliﬁ

ed business model and the different types of core •

processes that need to take place in an organization;

provide a brief description of the project life cycle and the importance of risk manage- •

ment at each stage, using the 4As approach;

describe the key features of a project risk management system, such as the project risk •

analysis and management (PRAM) approach;

outline the key features of operational risk as practised in ﬁ

nancial institutions, such as •

banks and insurance companies;

describe the key sources of operational risk in ﬁ

nancial institutions and provide exam- •

ples of how these risks are managed;

173