Arm 55 Chapter 3 - Business Continuity Management

Front 1

Definition: Business Continuity Management (BCM)

Back 1

Seeks to minimize the loss of resources essential to an organization's recovery from a disruption in operations. This is accomplished by focusing an organization's efforts on effective pre-and post-loss actions. (3.3)

Front 2

Definition: Business Continuity Plan (BCP)

Back 2

A plan of action to mitigate risk and maintain operations regardless of external and internal events that could otherwise prove disastrous.
A BCP allows an organization to analyze all possible eventualities to determine the critical functions that must continue during a disruption. (3.6)

Front 3

7 steps of a BCP

Back 3

1. understanding the business
2. conducting a business impact analysis (BIA)
3. performing a risk assessment
4. developing the continuity plan
5. implementing the continuity plan
6. building a BCM/BCP culture
7. maintaining and updating the plan (3.6)

Front 4

1. Understanding the business

Back 4

An organization must determine its key objectives and how and when they will be met. (3.7)

Front 5

2. Conducting a BIA

Back 5

An organization conducts a BIA to identify and assess the risks that may affect it. The BIA assess what events may occur, when they may occur, and how they could affect achievement of key objectives.
The analysis also distinguishes between critical and non critical processes. (3.7)

Front 6

3. Performing a risk assessment

Back 6

An organization performs a risk assessment to identify and evaluate potential exposures and the probability that certain events will occur. It also indicates how susceptible the organization may be to particular disruptions. (3.7)

Front 7

4. Developing the continuity plan

Back 7

To be completed after the BIA and risk assessment. At this point the organization can begin to develop strategies to maintain critical functions during disruptions. Organizations may use one or more of the following strategies: active backup model; split operations model; alternative site model; contingency model. (3.8)

Front 8

5. Implementing the continuity plan

Back 8

The Business Continuity Coordinator will help each department's BCP to include the following elements:
1. statement of acceptable level of functioning
2. recovery time objectives, resources needed, and potential failure points
3. tasks and activities required
4. procedures or processes
5. supporting documentation and information
6. structure to support the plan
7. description of division teams-purpose, team members, mission
8, explanation of interdependencies among the various division teams (3.9)

Front 9

6. Building a BCM/BCP culture

Back 9

Senior management must provide the vision statement and support for the BCP. It must also set expectations and objectives for middle management concerning the maintenance of departmental plans. Staff must be educated on the importance of BCPs. (3.9)

Front 10

7. Maintaining and updating the plan

Back 10

As business environments, processes and products change rapidly in today's business environment, so too should the BCP. (3.9)

Front 11

Definition: strategic redeployment

Back 11

Occurs during a major disruption which threatens the organization's survival. Involves reorganizing resources and realigning the organization in order to survive, regain its position in the marketplace, and protect its reputation. Usually occurs following a chaotic situation. (3.10)

Front 12

Strategic redeployment planning stages

Back 12

1. emergency stage
2. alternate marketing stage
3. contingency stage
4. communication stage (3.11)

Front 13

1. Emergency stage (disaster recovery)

Back 13

Starts at the moment of disruption and constitutes the organization's immediate response. Designed to accomplish 3 objectives: 1) protect people 2) protect physical assets 3) protect reputation (3.11)

Front 14

2. Alternate marketing stage

Back 14

The organization must evaluation the impact of the disruption to determine whether it needs a new marketing strategy. (3.11)

Front 15

3. Contingency production stage

Back 15

The analysis done during the alternate marketing stage will determine what products and service an organization will provide throughout the 'downtime'. (3.12)

Front 16

4. Communication stage

Back 16

To preserve or enhance the stakeholders' trust and confidence in the organization. To meet the objectives of crisis and post-crisis communication, the organization must address concerns of internal/external stakeholders, including these four basic concerns:
1) safety and security of all stakeholders
2) transparency in all of management's decisions
3) clarity and consistency in communications
4) perceived lack of trust in management and the organization

Front 17

Definition: supply chain risk management

Back 17

Entails assessing and mitigating all the threats that might interrupt the normal flow of goods and services and to an organizations stakeholders. (3.14)

Front 18

Internal threats and opportunities inherent in supply chains

Back 18

1) Production location: facilities may be vulnerable to natural disaster, manmade disaster, or terrorism.
2) Production bottlenecks: production may depend on a key machine or material; a malfunction or breakdown in the machine would slow or halt production
3) Information technology: the data centre may be vulnerable, information backup may be unavailable, or staff may fail to follow restoration protocols.
4) Infrastructure: damage to infrastructure can impede or halt production altogether.
5) Strikes or other employment issues: production may cease, inventory cannot be moved, and orders are not filled
6) Machinery breakdown: production may stall, or critical backup in production may occur, while new parts are ordered and installed. (3.14)

Front 19

External threats and opportunities inherent in supply chains

Back 19

1) third party suppliers: disruption in production from the supplier could undermine an organization's ability to generate its product and to satisfy customer demand
2) sole-source suppliers: disruption in supply when only one supplier of goods is available will or potentially shut down an organization's ability to produce and satisfy customer demand
3) single-source supplier: disruptions in supply can occur when an organization chooses to rely on only one supplier, even when multiple suppliers are available
4) change in demand level:incremental or substantial changes in demand because of changes in customer taste or to competition can cause over-or-underproduction. If demand is not accurately forecasted, market reputation could be damaged.
5) Financial risks: increase in the cost of materials or transportation charges will cause costs to rise. Exchange rate fluctuations may cause increases in material costs and may also reduce the attractiveness of the product ..continue on (3.15)

Front 20

Supply chain best practices

Back 20

The organization must periodically assess its supply chain and establish best practices for various disruption scenarios. (3.16)

Front 21

Supply chain best practices and mitigation techniques

Back 21

(3.17)

Front 22

Crisis communication

Back 22

An organization must be able to communicate plans and activities to stakeholders during a crisis. This is critical to overcome the situation and contribute to the success of any redeployment strategy. (3.17)

Front 23

Mitigating risk through crisis communication

Back 23

(3.18

Front 24

Stakeholder communications
Internal communications
External communications
Benefits of crisis communication

Back 24

(3.19)
(3.19)
(3.19)
(3.20)

Front 25

Mitigating supply chain risk

Back 25

When an organization analyzes its supply chain to determine and recommend risk mitigation tools, it is important to understand these concepts:
1) cascading disruption: seemingly unrelated events that can cause major disruptions
2) supply chain management: the development of sound relationships and diversity among suppliers
3) business resiliency planning: the development of plans that prepare the organization to respond to disruptions. (3.20)

Front 26

Steps in developing supply chain risk mitigation tools

Back 26

1) exposure identification (3.20)
2) determine co-dependencies (3.21)
3) analysis of exposures