Bcp Dr Grant Thornton Llp(Danny Miller) Vfinal

© Grant Thornton LLP. All rights reserved.- 1 -

Grant Thornton, LLPBusiness Continuity Planning (BCP) methodology

August 2011Danny Miller, CISA, CRISC, ITIL, QSA


Table of contents

• Introductions and initial discussion

• Our Understanding of your interest

• Basic concepts for BCP

• Scope and Approach for a BCP exercise

• Value to the organization

Table of contents

Our understandingof Organization

interest

Basic concepts for BCP Scope and Approach Value to Organization Contact


Grant Thornton’s Business Continuity Planning Scope and Approach (Our Understanding of Interest)

Risk AssessmentDevelop Business

Continuity Plan (BCP) Post-ImplementationValidate BCP

Table of contents


interest


Grant ThorntonPerform or Evaluate

Risk Assessment(BIA), develop

short-list of possible vendors

Grant ThorntonDevelop requirements with

Organization leadership, develop RFPand issue to short-list

of providers

VendorReceive RFP, attend bidders

meetings, go through development process, issue

RFP response, meet to proveresponse to GT/Organization team,

winner develops BCP

Grant ThorntonObserve testing of BCP,

provide oversight, evaluatetest results

VendorDevelop test scripts,

conduct test (multi-level),develop and implement BCP

across all locations withwalkthroughs with stakeholders

and update BCP on results

Grant ThorntonReview and give feedbackon training and awareness

program

Vendor & OrganizationDevelop and roll-out employee

awareness program andconduct training of emergency

and key personnel

OrganizationWork with GT on

either updating existing BIAor identifying

risks and assets for BIAbuild-out


Our understanding of Organization interest

• BCP Objectives

− Concepts

− Vulnerability and Risk Analysis

− Business Impact Analysis (BIA)

− Build-up of Business Continuity

• How a BCP project works (with options)

Table of contents


interest



Business Continuity Management (BCM)Defined

…the development of strategies, plans, and actions which provide protection or alternative modes of operation for those activities or business processes which, if they were to be interrupted, might otherwise bring about a seriously damaging or potentially fatal loss to the enterprise.

BusinessContinuityManagement

BCM = Crisis Management + Business Resumption Planning + IT Disaster Recovery Planning

Table of contents


interest



Components of Business Continuity Management• Crisis Management

– Governance/ownership– Organizational structure– Human Factor

• Business Resumption Planning – Business Impact Analysis– Tested, documented procedures– Communications Processes

• IT Disaster Recovery Planning – Emergency Operations Center– Alternate Processing Facility

Table of contents


interest



Business Continuity ManagementGovernance structure

Business Continuity Management requirements need to include business and IT.

RTO

RPO

App redundancy

Infra redundancy

Business Requirements

BCM Steering Committee

IT Requirements

Table of contents


interest



Business Resumption PlanningBusiness Impact Analysis

BIA Defined

• The careful, holistic study of individual business processes and support functions, as well as the system of business processes in its entirety, to better understand objectives regarding continuity of operations.

The “BCP Blue Print”

• If performed correctly, the BIA is the business continuity plan (BCP) blueprint. It establishes the business case for spending scarce funding on a process traditionally viewed as a glorified insurance policy.

Table of contents


interest



Business Resumption PlanningBusiness Impact Analysis (con't.)

The relationship between the BIA and the Enterprise (organization)-wide risk assessment…

• Now more than ever, the BIA and the enterprise-wide risk assessment are tied together.

• One can’t be done without the other.

• Also, the BIA is no longer limited to the internal workings of an organization, but rather to the extended enterprise, meaning customers and suppliers are now included.

Table of contents


interest



Business Impact AnalysisPotential impacts significance and likelihood

• The Analysis of Risk, as part of the BIA, determines the loss potential and other tangible and intangible impacts to the organization

• Taking into account− Key functions

− Personnel and other resources

− Technology

− Regulations

− Service level agreements (SLAs), internal dependencies and third-party interdependencies

− Emergency hotline lists (Drs, Medical assistance, Medical type transportation etc.)

− Backup facilities (hospitals, clinics etc)

− Community notification procedures

− Internal/external communications strategies and implementation mechanisms.

Table of contents


interest



Business Impact AnalysisThe analysis of risk

Analysis of Risk defined:

• Continuous process of estimating the likelihood of potential events and their impact on the organization

− Terms used:

− Likelihood probability

− Impact $$

Table of contents


interest



Business Impact AnalysisCategories of risk

• Strategic• Operational• Market• Regulatory• Contractual Relationship• HR• Reputation

• Environmental • Man-made Risks

(Accidental & Intentional)• Business Process-related

Risk• Single Points of Failure• Supply Chain• Information Technology

Availability Risks

Table of contents


interest



Business Impact AnalysisPotential impacts

• Loss of Human Life• Opportunity Costs• Idle Workforce and

Resources• Regulatory Noncompliance• Financial Loss• Reputation Impairment• EHS Impairment (OSHA) • Loss of Market Share

• Work Stoppage• Cash Flow Interruption• Financial

Control/Reporting• Customer Service• Vendor Relations• Employee

Morale/Retention• Market Reaction• Contractual Default

Table of contents


interest



Typical approach to conducting the BIA

• Work through a Steering Committee• Identify what the deliverables should look like and the

desired content• Develop an initial scope• Identify process-level subject matter experts (including care

experts)• Develop fact gathering plan• Summarize findings• Conduct analysis and develop conclusions• Validate findings with subject matter experts• Present validated findings to executive management for buy-

in• Transition to strategy development

Table of contents


interest



Framework for successful Business Impact AssessmentA Business Impact Analysis structure leverages the same process model as project management. The BIA structure includes an integration component to manage interdependencies, key milestones and key deliverables related to the requirements.

Project InitiationProject Initiation

1

Project PlanManagementProject PlanManagement

2

Risk & IssueManagementRisk & IssueManagement

3

ChangeManagement

ChangeManagement

4

Reporting &Communication

Reporting &Communication

5

ProjectAdministration

ProjectAdministration

6

QualityManagement

7

Integration

Management

Integration

Management

8

FinancialManagement

FinancialManagement

8

9

Table of contents


interest



Framework for successful Business Impact Assessment(con't.)BCM Managers need to look at and address the points below, to

ensure quality of service to customers:

• Prolonged disruption of service from multiple failure scenarios is a tangible risk in today’s business and health care environments crawling with unforeseen threats.

• Safety and security of employees and clients (patients) are at higher risk

• Service contracts these days essentially address business continuity SLAs and it benefits both parties in that it lays down expectations clearly if a disaster strikes.

• With increased outsourcing, customers take no compromise on security and continuity.

• Laws and regulations have now come into force clearly holding business leaders / vendors responsible for ensuring demonstrable continuity planning.

• Legal and standards requirements of clients (patients) domains

Table of contents


interest



Framework for successful Business Impact Assessment(con't.)Developing a BIA facilitates balancing business requirements, resource utilization (cost) and targeted results to keep the business running.

•aligned business and technology objectives

•repeatable standards, processes and tools

•achieved customer and management expectations

•maintain budget

•maximized technology investment

COSTREQ’MT

RESULTS

Table of contents


interest



Strategies for achieving BIA value

Align IT with the business (BT)

Innovate

Ensure information system availability and business continuity, security and integrity

Assess, address and communicate risks

Support compliance

Understand how IT systems and activities support BCM processes and priorities (includes equipment and tech that is used for patients)

Identify and implement solutions to support and enable BCM

Policies, Procedures, Standards, Redundancy, Monitoring, Training

Assess and address IT risks to achieving BCM

Integrate IT into compliance process and leverage to optimize

Table of contents


interest



Compliance Requirements – Cost Drivers

• National Fire Protection Association (NFPA)

• NFPA 1600 – Standard on Disaster, Emergency Management and Business Continuity Programs

• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• Gramm-Leach-Bliley Act (GLBA)

• Federal Financial Institutions Examination Council (FFIEC)

• Occupational Safety & Health Administration (OSHA)

• Foreign Corrupt Practices Act (FCPA)

• Federal Energy Regulatory Commission (FERC)

• US Securities and Exchange Commission (SEC)

• International Organization for Standardization (ISO)

• QS 9000 – Quality Systems Handbook

• State Insurance Departments

Table of contents


interest



Why BCP initiatives fail?

Mainly, because the approach and conclusions fail to meet management expectations. Here are some of the more common criticisms.

• “The results are too high level”

• “Those numbers can’t be right”

• “You assumed the worst-case scenario”

• “Weak approach”

• “Yeah, but it depends…”

• “That part of the business isn’t that critical - they’re just trying to justify their jobs!”

• “You collected the wrong information from the wrong person”

Table of contents


interest



Framework for successful Business Continuity Management

Enhance BCM value through robust business requirements aligned with technology capabilities requires a holistic integrated approach with the following balanced framework:

• Governance requires:- Active engagement to promote ownership- Business partnering to align strategy and mobilize energy- Formal process to drive consistency, credibility, and accountability

• Methodology must support:- Business Impact Assessment approach across the enterprise- Investment management focused on the results- Multi-dimensional change management

• Measurement supports decision-making:- Assessing business and financial value- Monitoring the plan

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachGrant Thornton uses a four-phase approach to develop a Business Continuity Plan

Risk AssessmentDevelop Business

Continuity Plan (BCP) Post-ImplementationValidate BCP

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase I: Risk assessmentPhase I consists of the following three

categories: a. Perform Project Initiation and Managementb. Perform Threat Analysisc. Perform Business Impact Analysis

Phase I (a) – Perform Project Initiation & Management

During this stage, a project manager and representatives to the Business Continuity project are named; an outline of personnel and resource requirements for the project are also identified.

Appropriate project initiation and management are critical to business continuity planning success.

Risk Assessment

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase I: Risk assessmentPhase I (b) – Perform Threat Analysis

During the Threat Analysis, a business criticality assessment is performed to identify the key business processes and IT infrastructure of the company.

A threat probability assessment is performed to identify the events and environmental surroundings that can adversely affect the organization and its facilities with or without disruption and/or disaster. The likelihood of occurrence for each event is identified, along with the damage such events can cause.

The controls needed to prevent or minimize the effects of potential loss are also identified. A gap analysis is performed to determine if measures currently in place are adequate to mitigate the identified risks.

Risk Assessment

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase I: Risk assessment

Perform Threat Probability Assessment

Identify Key Business Processes

Identify Key IT Infrastructure Perform Gap Analysis

Threat Analysis

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase I: Risk assessment

Document Processes

in Flow Charts

Determine Criticality of

Business Units

Determine Business Unit

Recovery Priorities

Identify Critical Partners

and Vendors

Determine Criticality of IT Infrastructure

Components

Business Impact Analysis

Determine Application

Recovery Priorities

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase I: Risk assessment• Develop project timeline

• Facilitate monthly checkpoint meetings with team members

• Provide meeting notes, including action items, issues and recommendations

• Create Risk Assessment and Impact Analysis Report, including:

– confirmed and prioritized list, in matrix form, of the in-scope processes, risk priority and acceptable outage criteria communicated by the team

– identification of responsible parties and supporting systems

– documentation of the potential impact to the business of uncontrolled, non-specific disruption events on the business processes and customers, based on information provided by management.

Risk Assessment

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase II: Develop business continuity planPhase II – Develop Business Continuity Plan

Phase II includes developing the business continuity plan based on management's approval of potential recovery.

• Communications plans are established for employees, clients, suppliers, owners/stockholders and any local/state/federal government organizations.

• The project team develops specific recovery procedures and names members to each recovery team.

• Public relations mechanisms and crisis communications structures are implemented.

Develop Business Continuity Plan (BCP)

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase II: Develop business continuity planPhase II – Develop Business Continuity Plan

(OPTION A continued)

Phase II includes creating an avoidance and mitigation strategy to resume business operations and to recover vital physical records that are not part of IT.

At this point, business resumption requirements should be documented and the resumption organization, such as the location of the command center, recovery responsibilities and the communication process involved if a disaster occurs.

We would seek to provide different scenarios, such as working with Organization management to arrive at alternate site locations for events and other strategic decision-making on a site-by-site basis.

The business resumption organization is combined with the threat analysis, business impact analysis, disaster recovery plan, avoidance/mitigation strategy and vital record recovery strategy, constructing the business continuity plan.


Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase II: Develop BCP deliverables• Conduct checkpoint meetings with team

members• Create Business Continuity Plan, including:

– trigger events and conditions for activating the BCP

– list of key personnel necessary to recover and sustain a function

– description of advance activities required for business recovery readiness

– plan for internal and external communications, as needed

– description of outsourcing alternatives, as needed

– instructions to activate the BCP and resume normal operations upon disruption resolution, including activities, responsibilities, timeframe and required resources.


Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase III: Validate business continuity planPhase III – Validate the Business Continuity

Plan Phase III should include separate walkthroughs of the BCP with key stakeholders (tabletop exercise) to identify potential issues in plan design/workability, missing documentation, training requirements, etc.

Validate BCP

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase III: Validate business continuity plan• Conduct ongoing checkpoint meetings

with team members• Create Business Continuity Plan Test

Scripts for each business process• Perform walkthroughs with stakeholders • Update BCP document with changes

Validate BCP

Table of contents


interest



Grant Thornton’s Business Continuity Planning Scope and ApproachPhase IV: Post-implementationPhase IV – Post-Implementation

Phase IV establishes provisions to build employee awareness and train emergency response & recovery personnel.

Business continuity plans are living documents that are tested annually – or whenever significant business process changes occur – to determine the adequacy of strategies, and are updated as needed.

Post-Implementation

Table of contents


interest



Value to OrganizationValue drivers

• Ensuring the safety and care of clients• Quicker recovery from operational failure• Rapid reaction to environmental threats• Reduced risk of missed commitments to product

donors and other stakeholders • Greater resiliency and recoverability of the

existing business and technology environment

Table of contents


interest



Value to OrganizationGrant Thornton Value Proposition

• Strong business, IT and operational knowledge leveraged to identify critical processes and develop corresponding continuity strategies.

• A business continuity process designed to manage the safety and care of clients in the event of incident, financial loss, and reputation impairment risk through the use of a proven planning approach – the end result is staying in the market and protecting the brand.

• A planning process that efficiently leverages internal resources, freeing employees to focus on their primary jobs.

• A planning philosophy grounded in a mature knowledge transfer process, designed to enable our clients to effectively manage business continuity internally without significant additional overhead.

Table of contents


interest



Experience in Performing BCP/DR workGrant Thornton Value Proposition

• Manufacturing companies of various sizes, including regional

• Healthcare organizations in the NE region• Asset management firms with multiple operating locations/branches in NY and Boston

• Government consulting firm focused on defense contracts in the DC area

• Apparel manufacturer, designer, importer and distributor with a global footprint

• Real estate property owner/manager who is based in NYC, NJ and Long Island

Table of contents


interest



Contact information

Danny MillerT: 215.376.6010E: [email protected]

Table of contents


interest


Bcp Dr Grant Thornton Llp(Danny Miller) Vfinal

Documents

Transcript of Bcp Dr Grant Thornton Llp(Danny Miller) Vfinal