Copyright © 2019 BSI. All rights reserved

Business Continuity and Building for Recovery

Paul Raw

Supply Chain Security Consultant

BSI Professional Services

2

Introduction

• Senior Consultant Supply Chain Security and Risk Management

• 11 months with BSI based in the EMEA region, operating globally

• Prior experience

• Former Army Officer

• Security consultant in the Middle East

• VP consultancy Services for the Middle East Region (G4S)

• My masters is in Disaster and Emergency Management (BCM, Crisis management, resiliency planning)

• Consultancy focus

• Security, Risk Management, Business Continuity, Crisis Management and Resiliency

3

Aim

1. Give an insight into what Business Continuity Management (BCM) is, how it came about and to give it some perspective

2. Key elements of BCM

3. Applying BCM to our own business

4. Response and recovery planning

5. Questions at the end of the presentations

4

What is BCM – How it came about?

Vietnam – the sudden availability of resources who were familiar with and skilled in managing rapidly evolving situations requiring quick and effective decision making

Crisis Management – the process of managing crisis as they impact businesses

Business Continuity Planning – a more proactive approach to developing crisis management plans

Business Continuity Management – the management of multiple BCP’s

Resilience – is a wider concept that incorporates wider elements of the organisation, the wider network, environment etc. etc. It is a strategic objective, not a measurable end state.

5

There are many different standards – (Guides)

• ISO 22316 & BS 65000 - 2014 - Organizational Resilience

• BS 11200 - 2014 - Crisis management - Guidanceandgoodpractice

• ISO 22301 - 2014/2019 - Business Continuity Management Systems (BCMS)

• ISO 22313 - 2020 - Guidance on the use of ISO 22313

• PD 25666 - 2010 - Guidance on exercising and testing for continuity and contingency programmes

6

Key elements of BCMISO 22301 – BCM

Context of the Organisation

ꟷ Where are you going

ꟷ What are your key functions

ꟷ What dependencies do you have

ꟷ Where do you want to be

Leadership

ꟷ Management commitment

ꟷ Operational strategy

ꟷ Needs and expectations of stakeholders

ꟷ Roles and responsibilities

Planning

ꟷ Risk Identification

ꟷ Business Impact Analysis & prioritisation

ꟷ Risk management & actions to address risks

Support

ꟷ Resources

ꟷ Competence

ꟷ Communication

Operations

ꟷ Planning and control

ꟷ Internal departments & locations

ꟷ Operations functions

ꟷ Communication

ꟷ Skills and training

ꟷ Quality assurance

ꟷ Facilities and site management

Performance

ꟷ Evaluation

ꟷ Improvement

ꟷ Regulation

Communication

ꟷ Internal

ꟷ External

7

Key elements of BCM

Key Questions we should be asking ourselves?

• Where are we now and where do we want to end up

• What are the key functions that we need to perform

• What are the dependencies we have to maintain those functions

• What are the risks to those functions

• How do we protect them

• Who is the end user

• How do we get our goods/services to them

• What is their situation, has it changed

• How has the situation impacted our flow of goods/services throughout the supply chain

• How do we communicate with our consumers

• Are our staff safe, what is the human impact

8

How do we visualise those questions within our business

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

9

The Flow of Goods/Services

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

10

The Flow of Goods/Services

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

11

The Flow of Goods/Services

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

12

The Flow of Goods/Services

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

13

Planning to mitigate risks within the Flow of Goods/Services

One of the most effective and thought stimulating processes is to simply map out your flow of goods

Now think of those key questions in the BCM process and the interdependencies, as well as the risks and constraints

14

Response and recovery decisions we should be making

The Response Phase

• Map out your entire process, end to end, including all internal and external parties

• What is your desired end state

• Has your supply chain changed and how (so what?)

• Has your market changed (So what?)

• Has your distribution changed (So what?)

• Has your own capability changed (So what?)

• Where are your interdependencies and pinch points (So what?)

• How confident are you in the ability of those who you rely on –contractors, service providers, suppliers, resources

• Answer the specific questions this thrown up

• What are the options available to you

15

Response and recovery decisions we should be making

The Recovery Phase

• What is your desired end state

• Map out the process to that new end state

• What is your current capability

• Where are the gaps in your current operational capability (end to end,,,,, map out your entire process)

• What are the solutions to those gaps?

• Do you have the capability to implement these changes, do you need training or partnerships / subcontracted services?

• Has your market changed (deliveries are a good example)

• Have you communicated with your market, with your suppliers and service providers

16

Managing the Change

Understand your supply chain, both inbound and outbound, as well as your route to market

• Research, research, research – make fully informed decisions in a timely manner

• Be prepared to change – A perfect example: internet based business/ manufacturing products - be flexible and change

Understand your market

Understand the key drivers and interdependencies within your business

Results based approach – understand where you want to end up and develop a strategy to achieve that (don’t just say you want tobe where you were at the start of this because the environment is changing,,,,, you must be flexible to change)

Appreciate the opportunity – do SWOT analysis. This is an effective and time efficient aid to making sound decisions

Two critical elements to have in your business:

1. Effective training – Make sure that all staff can fulfil their roles and responsibilities and understand the desired end state

2. Effective Communication – Both internal and external as well as up and down the organisation

Copyright © 2019 BSI. All rights reserved…making excellence a habit

Thank You

Paul Raw

Supply Chain Security Consultant

BSI Professional Services