BIA – moving from Assessment to Analysis via Automation

Jason Scott-TaggartGlobal Head of BCM Technology, Barclays Capital

March 2006

About Barclays

Barclays has been involved in banking for over 300 years.

Operates in over 60 countries with more than 120,000 permanent employees.

For the year ended 31st December 2005, the group achieved a pre-tax profit of £5,280 million, up fifteen per cent on 2004.

In November 2005, Financial News magazine awarded Barclays Capital ‘European Investment Bank of the Year’ in its annual Awards for Excellence.

Business Impact Assessment …

Is the way to gather the firm’s resumption/recovery requirements.

Gives one of the most comprehensive overviews of an organisation.

Empowers you with an in-depth understanding of what is important to the business.

BIA is your friend, your sword and your shield!

Time to Recover

Cost

Low

Hig

h

Slow (days – week) Fast (intra-day)

Minimal• No investment• Dependent on ‘best endeavours’ on the day

Basic• Limited, if any, investment in recovery facilities• Reliance on documented plans, procedures

Adequate (take a hit and recover)• Investment in a combination of recovery facilities and documented plans and procedures• Some degradation of service, greater recovery capability

Best in Class (disaster, what disaster?)• Greater Investment in a combination of recovery facilities and resilience technologies• Rapid recovery capability, with no to minimal downtime

Target Profile

Initial strategy justified by BIA

BIA at Barclays

Relationship Managers create partnership.

Has to be a business as usual activity to be ingrained and relevant.

BCM are not experts in the business areas and the actual impact of interruption.

Level of detail appropriate to them, not defined by BCM.

BIA at Barclays cont.

Relationship Managers selected for business skills.

Ask business people business questions and ask IT people IT questions.

The key to engaging people is to make it easy whilst also making benefit obvious.

Need senior management buy in to make this happen. Need senior BCM “co-ordinators”.

How did we automate

Out with Word and free form templates. In with “whizzy”, easy to use frontend and database backend.

Don’t reinvent the wheel. No retype and live updating.

Can drive data quality improvements.

Living documents not annual review.

Automated online sign off so not chasing bits of paper.

Business Resumption Planning

BRP is a checklist, a high level prompt.

Produce resumption plan by commenting next to each critical task and add resumption only ones.

Critical tasks flow through to lines in the BRP.

Business Resumption Plan

Slide Content RemovedSlide Content Removed

Tool’s Evolution - Spreadsheet

Tool’s Evolution - Database

Tool’s Evolution - Web

Obvious benefits Compact and multi format resumption plans.

Relevant plans and contact details – only a day old.

BRP just output from BIA – combining the process not a separate exercise.

Easy to report live on compliance of sign off.

Reporting for governance and/or senior management.

Instant Feedback Database contains statement of achievable 3 x R’s, as declared by System

Owners: Recovery Time Objective Recovery Point Objective Revised Operating Level

Compared with task level required 3 x R’s gives instant RAG reporting.

System outage -> business unit affected -> tasks at risk -> potential impact to firm REAL TIME.

Testing therefore vital to ensure accurate declaration: Crisis Management Invocation WAR Individual Applications

Other benefits Data changes, simple turn handle for new reports.

Automated call notification – no more pretty PowerPoint org charts.

Transparent reporting helps with senior management engagement.

Seat Planner for WAR sites.

Seat Planner

From Assessment to Analysis …

Assessment What do you do that is critical? What is the impact if you cannot do it? What tools/applications do you need to do it? Who do you depend on?

Analysis Compare and contrast data in unique ways. High level reporting to senior management of gaps and risks. Prioritise by risk and impact. Further analysis by geography and function for example.

Relational Data Model

LocationsBusiness

Units

PeopleSystems

BusinessTasks

Support/Ownership

Relationships/dependencies

Analysis Reporting …

Variables, Properties or Criteria

Variables, Properties or Criteria

Risk Modelling by …

Risk Modelling by …

Business Function

Number of Tasks

Impact Scores

Environmentals

Size / Scale

Technological Complexity

Headcount

Dependencies

Business Function

Number of Tasks

Impact Scores

Environmentals

Size / Scale

Technological Complexity

Headcount

Dependencies

Location

Business Units

Systems

Location

Business Units

Systems

Draw backs Complexity of data makes back up less straight forward.

Need business skills to collate data.

Need technical skills to store and link data.

Front loaded effort.

Can reveal unexpected gaps in capability.

Resumption descriptions can be light.

Anyone can do this Have to be a multinational bank with team of

developers?

Started as Excel -> Access -> SQL.

Table entry of tasks – relational.

Need not be dashboards on web pages, can be simple query to Excel and mail merges in Word.

In summary Keep it simple and keep it relational.

Use authoritative sources of data.

Trust your subject matter experts.

Emphasise DR should not be a separate consideration.

Remember - the BIA is your friend, your sword and your shield!