The discussion is relevant to Chief Executives, Chief Financial Officers, Managing Directors, Business Continuity Managers, Risk and Compliance Managers, and all senior executives looking to assess and mitigate risks during 2010/11.

Rod Crowder, Managing Director of OpsCentre, will facilitate an open and unbiased discussion between participants; providing an opportunity to comment and discuss individual perspectives and share related issues and experiences with each other.   He will outline a number of action areas where senior executives can gain rapid traction on this important challenge.

Operational Risk is one of many categories of risk managed by all organisations, others include; strategic, compliance, reporting, market, credit, legal, political and insurance risks.  Whilst some types relate to generation of strategic advantage or profitability, operational risk is inherent to the imperfections or errors of its people, processes and technology assets.  Organisations must assess the likelihood and impact to generate an overall rating, against which mitigation strategies can be implemented or accept a level of ‘residual risk’.

Our round table discussion topics include:

What are the major categories of operational risk?

How are organisations assessing qualitative and quantitative operational risks?

How does ‘risk appetite and tolerance’ vary across different organisations?

What strategies, methods and tools are organisations using for risk mitigation?

What operational risk management standards or ‘good practice guides’ are relevant?

What experiences do people have in responding to incidents?

We look forward to sharing your views and perspectives at our Roundtable.

When?

Thursday July 08, 2010, 4:00PM to 6:00PM

Where?

OpsCentre - Level 18, 323 Castlereagh Street, Sydney 2000 Australia

Or

Online: https://www1.gotomeeting.com/join/672734064

Audio: +612 6108 4655, Access Code: 672-734-064

Audio PIN: Shown after joining the meeting

Meeting ID: 672-734-064

Contact Rod Crowder ASAP to register your attendance.

About your Facilitator

Rod Crowder is Managing Director of OpsCentre, a boutique provider of risk, business continuity and disaster recovery consulting, software and training solutions.  He has worked in the Management Consulting sector for 17 years in a variety of management, training, facilitation, project management and consulting roles.

Rod has project managed and consulted on projects for organisations including Telstra, Lend Lease, Nestle, Hewlett Packard, Fujitsu Australia, DCA Group, Thomson Legal and Regulatory, Omnilab Media Group, Ambience Entertainment, Amity Group, Amnesty International, Integral Energy, Coates Hire, Westlink M7, Hills M2 Motorway, Franklins Foods and several Federal and NSW Government Agencies, and local councils.

He has undertaken extensive overseas consulting assignments in Hong Kong, Singapore, Japan, New Zealand, USA and Europe. He holds a Higher National Diploma in Computer Studies from Brighton University in the UK.

Organisations need not continue focusing on disasters of such severe nature but rather on small incidents which through adequate planning can be prevented. It is no longer adequate to place the spotlight on what one can do after an incident but rather to put attention on what happens prior, during and after. Much awareness has been placed on recovery. If adequate controls are put in place, then revival need not be an option.

Business Continuity helps your company save money every day of the year. Small mundane operations, if overlooked, can cause operational bottlenecks, becoming single points of failure. Decisions should be made through comprehensive planning as opposed to being managed ‘on the fly.’

People often believe that continuity planning requires a large capital outlay. No two companies are the same, each one having different processes and procedures. A flexible methodology should be malleable to organisations of all types. A business continuity plan drives down the extent of the impacts and operational losses. The aforementioned cannot operate without adequate communication and decisive project management skills.

For maintenance of organisational resilience, senior management need to press home the interests to staff, customers and those who are dependent on the organisation. Whilst companies are often quick to look at financial losses which accumulate as the result of an interruption, they rarely consider brand and reputation. Most people have the attitude that a disaster will never happen, however minor interruptions occur on a daily basis and often they are outside of an organisations control.

Higher degrees of competence are called for. Business Continuity needs to be looked at as an investment not a cost.

Here is the link to our first video..

While the facts of the matter are yet to fully emerge and the reasons behind this failure to successfully execute the traffic emergency plan are not yet published, we can consider how this type of scenario can happen to any organization, even if they have business continuity plans in place if they are not thoroughly tested.

Often an organization will have a plan outlined on paper about how a given scenario will be handled. The reality, with all of the real life complications and human factors, is often quite different. This is why we exercise and test the plans.

Real life complexities are difficult to capture in your paper plans because you cannot always envisage the multiple factors that may impact on your recovery processes.

Consider factors that may affect how your recovery plan is executed and how your organization would handle it:

1.      An evolving status report

Initially you are told that the incident is not too severe and will be rectified within the hour but then as time progresses it worsens in severity and time frame estimates keep gradually creeping out.

Do you know what your ‘drop dead point’ is, how long can elapse before invoking your plan?

What is your ‘maximum tolerable outage’? How long can the ‘estimated incident recovery time’ be before it is worthwhile to invoke.

Are you getting your updates from a well informed primary source? Do they understand the need for an accurate estimate?

2.       Delegation of authority

 What if the CEO or appointed Business Continuity Command Team is un-contactable during this incident?

 Is there a backup person nominated who is definitely going to be available in their place?

 Does the backup person have the complete authority to make decisions which may involve the major ramifications and expenditure?

 Has this backup person been trained in how to co-ordinate the communication and oversight of recovery from an incident?

 3.      Communication Protocols

 Imagine the chaos created if various staff members were contacted by different media outlets. Because they have not been given clear guidelines that only the ‘Communications Manager’ may issue any statements to any external parties these well meaning staff members offer their understanding of where the current situation is at. Conflicting or incorrect information is then released to the public.

 How will staff react in an incident if they have not had their expectations set about who will communicate what to them?

 In a state of confusion people will try and contact their supervisor, their co-workers, whomever they can get a hold of to find out what they should be doing. Just like Chinese Whispers, various accounts of what is going on and what should be done are spreading throughout the organization.

Consider the alternative. All staff have been trained in your business continuity protocols and understand how communication will occur in an incident. There are clear roles for who will co-ordinate recovery efforts and known backup persons should the nominated person be unavailable.

All staff know that there is a communication tree whereby the status updates and requirements will be communicated to them by their business continuity team leader. They know there is a hotline number and an intranet site they can log onto where the ‘Communication Manager’ will post regular updates of information that staff need to know.

Testing your plans thrashes out the finer details, highlights shortcomings and also gets all of the parties involved familiar with the plan and their role.

It is during this process that chain of communication and authority issues can be uncovered and resolved before the plan needs to be enacted in real life.

There is a broad range of testing options across the spectrum depending upon the maturity of the organisation’s planning.  If this is the first time that a test has been undertaken – (“green fields”) planning can start with a plan walk through (Table Top or White Board) test.  These are paper based scenario workshops with business and/or technical personnel attending.  The test is generally a few hours long and should question the information and logical sequence of priorities contained in the planning documentation.

At OpsCentre, we often are engaged by a client to assist with an upcoming test and use our experience to add complexity and interest to the activity.  The client organisation has successfully completed tested (often the same test) on a number of occasions and would like us to provide more in-depth rigor around the process in general.

Other than experiencing a full blown disaster (which by the way is the best form of test – although not recommended on an annual basis) we have orchestrated testing workshops to assist our clients as detailed below:

1. Applications Functional Testing

• Technical failover of applications or services from the primary production facility to the alternate recovery site
• Insure that the test is isolated from production and that no “cheating” occurs whereby test attendees liaise with production resources or documentation that would not be available in a disaster

2. BC and DR End to end process flow testing

• Complete testing of the recovery facilities by business and technical units including up and downstream application restoration in the disaster recovery environment
• This can be an expensive and resource intensive exercise. The results are extensive and recommended to establish detailed baselines for all aspects of BC/DR planning

3. Denial of Access Testing

• Business site-wide tests for recovery personnel to perform a normal day’s work from their alternate recovery sites with applications/systems pointed to normal production services
• Try this test at 3:00AM – convening disaster personnel and timing their response.  Disasters can occur at any time and if not possible to physically attempt this type of test, logically the process flow should include “out of hours” scenarios.

4. Facility Power Downs

• During essential mechanical and electrical maintenance activities at key facilities.  Contingency plans are executed/tested concurrently
• If the production infrastructure is going to be off-line due to maintenance that is predetermined, use this opportunity to test your planning and response mechanisms to their fullest.

Completing any of the scenarios illustrated will take a fair amount of project planning and management buy-in.  Considerations should be thought out well in advance of the test/audit/governance/compliance schedule so that the test exercises run as smooth as possible and the best results are achieved.

Are you reliant on a single supplier for any key products or services?

If you have alternate suppliers, are they geographically separate or in other ways diverse from your primary supplier? If your primary supplier was affected by a problem, how likely is it this backup supplier would be too?

Can you build the requirement for these suppliers to have robust and verified business continuity in place for themselves into your supply agreements?

What are your workarounds and strategies if supply of these products or services were cut-off?

All of these questions should be examined as part of a robust business impact analysis of your critical business functions. Having a BCP is more than just a tick in the box for your audit report. It is about having confidence in your organization’s resilience.  What a great selling feature for your clients, if you can confidently state you’ve got a mature and resilient organization that will stay in operation when others may fail!

- How much revenue would you lose being out of action for a day, a week or a month?
- Have you got an alternate location to operate your business from?
- Is your data regularly sent off site and ready to be restored into backup systems?
- What are your critical paper records and how do you continue to operate if they were destroyed?

Every business, regardless of its size, should be confident in the answers to these questions and should be making an informed choice about the cost of implementing business continuity strategies and IT disaster recovery solutions versus the risk\cost of not doing anything.

Small to Medium Enterprise (SME) often don’t have the budget or resources to spend months implementing a business continuity project. But SME’s still have a need for BCP, just as much as bigger organisations. Quite often all of the physical resources, especially IT equipment are concentrated in the one location which can increase the risk. Sometimes without dedicated IT staff, the backup and restoration practices may not be sufficient to help them recover from a loss of premises type incident.

At OpsCentre we’ve refined the art of the ‘Quick Start’ BCP and can deliver a business continuity plan for suitable small to medium enterprises within 1-2 weeks. If your organization needs assistance with getting a business continuity plan in place we can help. Contact us and let us know what you need.