Aon Global Risk Consulting – Alex van den Doel / Rubert NieuwenhuisVimpelCom – Ramon Tolk

DACT

8 November 2013

Business Continuity Management

Do you know the impact of business interruptions on your companies' financial performance?

How to enhance your risk management function by implementing BCM

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 2

Why Business Continuity Management matters

Ship route Suez Canal essential for international trade

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

Stress Testing your continuity risks – approach

3

What (extreme) scenarios can jeopardize your financial objectives?

Approach• Define risk bearing capacity• Develop scenarios

– Industry specific– Organization specific– Out-of-the-box

• Quantify impact of scenarios• Evaluate against risk bearing capacity

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

Stress Test – Risk Bearing Capacity• Information from financial statements

– Balance sheet total: 880M– Equity: 330M– Solvency ratio = 38%

Claim of 50M will lower ratio to 32%

An impact of 28M will lower the ratio to 34% → RBC = 28M

Covenant in financing arrangement specifies a threshold of 34%

39 %

38 %

37 %

36 %

35 %

34 %

33 %

32 %

31 % Breach of Covenant!

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 5

Source: Aon Global Risk Management Survey 2013 - 1.415 respondents representing a broad range of industry sectors in 70 countries (64% > 1B turnover)

Perception of business continuity risks

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 6

Impact on financial performance

• An average impact of 25% on shareholder value and an impact whichcommonly lasts for two years!

• Historically, supply chain disruptions canlead to an average of 9 percent lower sales and 11 percent higher costs!

• Both physical and non-physical events drive supply chain disruptions, and 85%of companies reported disruptions in2011 (study of BCI in 2011)

• Other recent examples: Source: Vinod Singhal, Professor at Georgia Institute of Technology, and Professor Kevin Hendricks, Richard Ivey School of Business, The University of Western Ontario, London, Ontario N6A-3K7, Canada

Company Event Value Reaction

TEPCO Japan EQ -89.6% - $ 37bln

Dexia Greek debt -87.3% - $ 3.9 bln

Research in Motion Service Disruption -49.7% - $ 6 bln

BP Explosion / Oil spill -29% - $ 53 bln

Apple Iphone Antenna -2.4% - $ 6 bln

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 7

Objectives

• Protecting your financial performance from the impact of business interruption risks

• Understanding methods and techniques to map supply chain interruption risks and quantify the financial impact on revenue generating activities

• Enhancing Enterprise Risk Management by implementing Business Continuity Management and focus on high impact exposures

• Evolving the Risk & Insurance function towards a more mature operational risk management function

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 8

Agenda

• Analyzing the impact of business interruption exposures on financial performance

• Business Continuity Management - Execution– Link BCM – ERM– Buiness Continuity Management Process– Quantifying financial impact

• Business Continuity Management – In Practice– Case study VimpelCom – Peter den Dekker

• Questions

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 9

What is BCM

"BCM is the ongoing process of identifying continuity threatening risks

and defines a program for mitigating those risks and recovering as soon as possible within predefined time objectives".

Structured programme and process

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013 10

How does BCM link ERM?

BCM is becoming more and more a strategic topic!!

BCM is the key mitigation for continuity risks

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

BCM Process

11

Analysis

- Conduct business impact analysis

- Conduct threat analysis

- Conduct requirement analysis

Design

- Define continuity strategy

• Strategic• Tactical• Operational

Implementation

- Implement response organization

- Implement response plans

Validation

- Maintain

- Review

- Exercise

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

Quantifying financial impact - Business Impact Analysis (BIA)

• BIA provides a very structured and efficient approach to:– Identify and quantify business interruption risks– Map complex and global supply chains– Measure the value of current mitigation measures

• BIA enables organizations to consolidate the BIexposure from unit level to every consolidated level (country, regional, global, etc.)

• The BIA provides a solid basis for risk management improvement:– Clear picture of the biggest interruption risks, accumulation effects and critical

issues– Focused development of risk management strategies (loss prevention and

response) – Optimization insurance cover and limits– Enhancing business interruption risk awareness and understanding

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

Step 2: Example of results of quantification unit levelSupply chain analysis Dataroom analysisSite analysis

DACT | AGRC & VimpelComProprietary & Confidential | 8 November 2013

Step 2: Quantifying consolidated level

Delivering two key elements:

• Dependencies network

– Based on unit level outcome defining and modeling material dependencies between suppliers, own units and customers

– Making use of a "engine" to simulate impact

• Consolidated risk profile on selected level

– Calculating the impact of unit level events though dependency network

– Creating consolidated loss exposure profile on selected level