Top ten tips on surviving the floods

10th March 2008 - It’s this time of year when the winds and rain hurl their best at us. So here’s a top ten practical guide on how to avoid becoming a victim of the floods. It’s not only timely for this week’s atrocious weather, but we’re also coming up to Business Continuity Awareness Week (first week of April) and during that week experts and professionals share what’s new and emerging at Business Continuity Expo, 2-3rd April at ExCeL London. One of the key topics that will be discussed at Business Continuity Expo and Conference is the issue of flooding. Last November the Business Continuity Institute (www.thebci.org) held a workshop to review UK flooding and here are the top 10 tips that came out of the conference – heeding the advice offered in these practical steps could help minimize the impact of the floods experienced this week and any subsequent ones!

Top ten practical tips

1./ Make sure you have all relevant contact details for members of staff. The main lesson that came out of the flooding conference, that most staff lists were out of date and defunct in many cases.

2./ Make sure you are aware of any medical requirements which people may have.

3./ Ascertain the impact of both a potential loss of water and a loss of electricity on your business activities and respond accordingly. Should I stockpile water? Should I purchase an electricity back-up generator?

4./ Accept the fact that your company will not be high up the priority list of the emergency services and consider any measures which should be taken in light of this.

5./ Stockpile key items on site (in a safe location not on the ground floor). These might include water, food, bedding, torches, medical equipment, soap etc.

6./ If I have set up an emergency hotline facility in advance make sure that all staff are aware of this and carry the number on them (either put into their mobile telephone or carried on a separate card).

7./ Provide all staff with a brief summary of the main points of the BCM plan that will affect them e.g., who is in control, what are the key contact numbers, details of rallying points etc.

8./ Consider setting up a series of mobile telephones on different networks which are stored permanently in the office. If one network goes down you may be able to communicate on another network.

9./ Make sure that you are aware of and, where necessary, signed up to all relevant information channels.

10./ If key documents or IT servers are stored in the basement consider moving them to a higher floor to avoid damage from flooding.

In conclusion it is worth noting that the most over-riding message that came out of the workshop was that virtually all the companies impacted by the floods all agreed that communicating with staff off-site during the crisis was the biggest problem they faced. The floods exposed the inadequacies of communication channels used during an emergency. Most companies affected by the floods relied on mobile phone networks to contact off-site staff and this over-reliance often led to network failure.

Difficulties were also experienced when staff members sought to contact family members and were unable to do so. In such circumstances, some were unsure whether to let staff return home to confirm that their families were safe given the risks the floods posed.

On a cross-company level, communications with head office were also disrupted, making it difficult to either update senior figures on the current status of a particular location and also to receive direction/guidance on what to do. It was also acknowledged that this lack of communication sometimes resulted in different divisions within the company communicating different messages to staff leading to much confusion.

If you would like to find out more about how to avoid becoming a victim of the floods and other incidents that impact the everyday operations of your organisation, register for free entry to Business Continuity Expo 2008 at www.businesscontinuityexpo.co.uk.

Hottest Business Continuity Topics Presented by World Experts at Business Continuity Conference

This year’s Business Continuity Conference 2008 promises to deliver an unrivalled line up of expert speakers fresh to the BC circuit, offering original and insightful comment to help professionals assure sound business continuity practice and gain the knowledge and expertise to cope and succeed through any potential disaster. The conference takes place on 2^nd and 3^rd April at EXCEL London and runs alongside Business Continuity Expo 2008.

The 2008 conference agenda explores the issues affecting Business Continuity today, illustrated with end-user case studies and analysis from leading experts such as Gerald Corbett, Chairman of SSL International, PJ di Giammarino, CEO JWG-IT, Colin Clark, Head of Corporate Business Control – Somerfield Supermarkets and Kathryn Holloway, Presenter and Broadcaster – Press Alert and Visor Consultants. The conference provides an informative peer-to-peer forum which explores the threats, solutions and best practices as well as an insight into how to mitigate risk and manage crisis.

With much of the content for the conference, compiled by experts from a high powered steering committee, delegates are assured of a comprehensive and cutting edge programme exploring the whole business continuity lifecycle from corporate governance, risk, compliance, resilience and brand management as well as the practical solutions for contingency planning, incident management and recovery.

Laurence Myerson, CEO, SMS Worldwide will be one of the panellists who will address the issues around good solid business continuity Management. He says “Optimising Resilient Communications is a highly potent session discussing how to ensure the use of communication in the event of a crisis, even when all communication systems have failed including the Mobile Phone Networks. With the Metropolitan Police, The Cabinet Office and SMS Worldwide we shall uncover the tricks of the trade in our session and well worth attending."

To bring the issues of business continuity and resilience to life there will be a host of recent case studies, workshops and analysis covering the whole spectrum of business continuity management from risk analysis to protecting your brand and reputation in the areas of finance, public sector and telecoms.

Martin Caddick, Leader, Business Continuity Management team, Marsh says about the event "Marsh is once again looking forward to participating in this year's Business Continuity Expo following last year's success. Business Continuity Expo provides a unique platform to engage in stimulating debate with industry peers and new business contacts on a wide range of business continuity topics.

"Wider industry understanding of business continuity as a key risk issue is growing, as more and more firms realise that with risk comes reward, if managed effectively."

Opening Plenary

The conference will kick start with an opening presentation which will discuss “National Resilience, Corporate Resilience and Operational Continuity – Three Sides of the Same Coin?”. It will be chaired by Bruce Mann CB, Director of Civil Contingencies Secretariat (tbc) with Gerald Corbett, Chairman, SSL International and Brett Lovegrove, Head of Counter Terrorism, City of London Police in the panel.

The Business Continuity Conference has been divided into three diverse streams spaced over two days to ensure that no matter whatever your business agenda, your needs will be met. Each stream will consist of presentations from individual speakers, ending with a panel discussion led by the Chair. The three streams will cover:

· STREAM 1: Drivers, Issues, Risk and Best Practice

· STREAM 2: Business Strategies

· STREAM 3: Business Continuity Management

Highlights from Stream 1 Drivers, Issues, Risk and Best Practice include:

- Risk as Part of Business Continuity which looks at strategies for co-optimisation of Operational Risk and Business Continuity Management on a global and site level, chaired by Rubina Faber, Director, Regal

- Understanding and Mitigating Reputational Risk chaired by Jon Collins, Service Director, from Freeform Dynamics who will explore some of the ways in which you can protect, recover and insure you reputation.

- Managing Risk in Supply Chains- In this session experts will look at how organisations can reduce their exposure to supply chain risk in the global trading environment. Chaired by Matthew Elkington, VP Risk Consulting at Marsh

- BS 25999: Is it Worth Doing it Well? - Julian Thrussell, Management Systems UK BS25999 Product Manager, BSI with the help of other experts will look at the certification process, business advantages and asks whether your organisation really needs the standard.

Highlights from STREAM 2: Business Strategies include:

A panel discussion on “Measuring Value to Shareholders: What’s the Real Cost of an Incident?” Pat Roberts, Senior consultant at Needhams 1834 will chair the panel which shall examine the effect on stakeholder trust, reputation, shareprice and brand equity – and how you can minimise them.

Other sessions include:

- Maintaining Corporate Health Through Exercise –with panellists including Michael Charlton-Weedy, CEO, Emergency Planning College; Charles Le Gallais, Director of Homeland Security and Resilience, Finmeccanica; Chris Needham-Bennett, CEO, Needhams 1834; Nick Beale, CEO, Citysafe

- Corporate Resilience: Is it Time for a New BC Model? This session, chaired by Peter Power, Managing Director, Visor Consultants outlines how the notion of corporate resilience can take business continuity, risk and crisis management into a more active environment.

- Appetite, Liability, Responsibility and Legal Considerations: Real considerations for Directors- Bill Byrne, Managing Director from Heffernan Global Services Inc. discusses why the board of directors are really interested in Business Continuity, using the results of a CEO survey to back up the debate.

Highlights from STREAM 3 - Business Continuity Management include:

- Optimising Resilient Communications- Chaired by Dr Nigel Brown, Lead for Resilient Telecommunications Strategy from The Cabinet Office, this session focuses on resilient communications and how essentially important they are within a continuity plan.

- The Impact of an Incident –presented by Mel Gosling, Managing Director, Merricom; Wayne Harrop, Senior Lecturer in BCM, University of Coventry; Kathy Settle, Head of Regional Resilience, Government Office for the North West; Prof Richard Walton, Visiting Professor, Royal Holloway University

- Invoke: Best Practice in Incident Management –It will be chaired by Karen Dye, Crisis Management, Emergency Response and Business Continuity Programs Manager, from Sun Microsystems.

- Human and Personnel Aspects of BC: Reacting to an Incident- Chaired by Rosie Murray, Director of Raising Awareness For Trauma, expect to see dissection of vegetables and discussions on neurobiology and psycho-modification as the panel of experts explore human behaviour before, during and after an incident.

For tickets or further information on The Business Continuity Conference please call 0870 429 4480 or visit www.businesscontinuityconference.co.uk

Useful business continuity websites to keep your company on the ground

When 2007 blew in with heavy storms, car bomb attacks and tornados the pressure mounted on businesses to have a secure business continuity plan in place. This year is already set to be eventful with snow storms in the North and businesses having to use remote working to stay afloat.

Similarly 2007 proved to be a bad year for the Government with mass data record losses which failed to assure the general public that they could securely manage and safely retain information. Their data loss record was pretty abysmal with one disaster after another being exposed, with cases of senior civil servants laptops going missing, the HMRC fiasco, the numerous data loss scandals at the DVLA and DVA as well as the thousands of NHS patients who now have their records at large!

However, in the real world of competitive business in order to stay standing after an incident it has to be a very different case! You have to have contingency plans and resilience systems in place to survive and stay ahead of the game. In essence Business continuity is all about good business practice, creating a strong framework with the right IT infrastructures and procedures in place so that when a disaster of any kind does hit the business can continue to operate successfully.

As businesses are fast expanding it is proving imperative for businesses to implement an effective business continuity strategy in order to minimise business interruption and maintain operation continuity in the face of any adverse situation. Richard Fitzhugh – Content Director for Business Continuity Expo 2008 cherry picks the top business continuity websites for 2008, click online to discover how to maintain your business throughout a disaster.

www.Continuitycentral.com
Continuity Central provides a constantly updated one-stop resource of business continuity news, jobs and information.

www.bs25999.com
BS25999.COM has been created by a team of industry specialists with the intention of providing both experienced practitioners and industry newcomers relevant information, useful content and a number of interactive capabilities concerning BS25999.

www.ncc.co.uk
The National Computing Centre (NCC) is the single largest and most diverse corporate membership body in the UK IT sector.
NCC champions the effective deployment of IT to maximise the competitiveness of its members' business, and serves the corporate, vendor and government communities.

www.thebci.org
The Business Continuity Institute – (BCI) - The Business Continuity Institute’s mission is to promote the art and science of Business Continuity Management worldwide. The BCI promotes the highest standards of professional competence and commercial ethics in the provision, maintenance and services for Business Continuity Management (BCM).

www.theirm.org
Institute of Risk Management is risk management's professional education body. Established as a not-for-profit organisation, the Institute is governed by practising risk professionals and has strong links to leading universities and business schools across the world.

www.contingencytoday.com
Contingency Today is a web-based magazine and the only publication, online or print, dedicated to the challenges and opportunities of Critical National Infrastructure protection. Critical National Infrastructure can be defined as those assets, services or systems which, if destroyed or damaged, threaten the social or economic well-being of the nation, including by the infliction of mass casualties. Contingency Today covers all significant threats to the Critical National Infrastructure, including electronic attack and the sophisticated misuse of computer systems; physical attacks by terrorist organisations and other criminals; the effects of climate change; and other natural disasters, including pandemics, fire and flood.

www.cirmagazine.com
Continuity Insurance & Risk is the UK's leading bi-monthly risk management and insurance journal. The magazine has rapidly established itself as a key weapon in the risk and insurance professional's armoury. Continuity Insurance & Risk offers a unique combination of editorial elements to provide an essential, practical tool in today's business environment.

www.strategicrisk.co.uk
Magazine aimed at people who have to deal with risk at a strategic level and with the necessary responsibility for corporate governance.
“StrategicRISK is affiliated to AIRMIC, the UK-based Association of Insurance and Risk Managers, and is the only publication that receives their official endorsement."[2] StrategicRISK covers all the aspects of risk management that confront large organisations of all types throughout Europe.

www.businesscontinuityexpo.co.uk
Business Continuity Expo is the only event dedicated to managing operational risk, resilience and recovery. With a unique format combining a comprehensive exhibition, a highly popular free-to-attend seminar series and a stimulating and thought-provoking conference, the show brings together professionals spanning the growing Business Continuity and risk management industry. Business Continuity Expo is a unique opportunity to explore best practice, identify industry trends and cement vital relationships to help ensure operational continuity before, during and after an incident. The event will be held on 2-3rd April 2008 at the ExCel, London.

Thomas Cook collaborates for crisis control

Bob Boyce, Director of UK Operations for Thomas Cook Group shares how he is using the latest BC technology to overcome communication obstacles during emergency procedures.

Thomas Cook Group plc is a leading international leisure travel group, created by the merger of MyTravel Group plc and Thomas Cook AG in June 2007. Each year more than 19 million people choose to travel with the Group, buying their holidays from a network of more than 3,000 owned or franchised travel stores, online or through call centres. It employs 33,000 people globally, operates a fleet of 97 aircraft and either through direct control or via franchise arrangements, also operates 46 hotels and other resort properties.

It is unquestionably a very sophisticated operation, with a portfolio of market leading travel brands across Europe and North America. Protecting the reputation of these brands is paramount and the Group insists on good practice and responsible decision making within all its operations. This is no more so than in the field of business continuity and incident management.

Four years ago, Bob Boyce, Director of UK Operations began a project to change the way information was distributed during an emergency. Boyce was looking for a solution that broke down the barriers of communication when he and his incident management team faced disruption during normal operations. The global nature of the company means that team members are located in different offices, creating obstacles of location and geography when accessing, updating and sharing information. This problem needed to be eradicated.

Boyce required a solution that facilitated real-time information management during an incident: software that could provide a platform for the rapid capture of information, its validation and quick distribution of the facts to those that need to know, enabling a more effective decision making process. Boyce wanted software that enabled members of the crisis team to confidently fulfil their business continuity obligations, safe in the knowledge that they were acting on all the relevant information available. Delivering the right information to the right people in this way could save lives, protect resources and maintain corporate reputation.

Following an evaluation of what was available on the market, Boyce decided to work with Solcara, an organisation his was familiar with through work that Solcara had successfully conducted with the Thomas Cook Media Relations Team. Together they implemented the Solcara Crisis Control Centre.

Acting as a virtual command and control facility, members of the Thomas Cook emergency procedures team, wherever they are (at the scene, at home, in the office, on holidays!) and with the appropriate privileges can record and distribute records pertaining to an incident. Information filtering enables the senior executives to quickly review and react appropriately to the facts, assess the impact and identify and prioritise the actions required to establish normality.

“To be effective it is important that it is easy to invoke an incident and that the team find the system easy to use,” says Boyce. Solcara Crisis Control Centre has enhanced the existing emergency procedures at Thomas Cook, “by making everything easily accessible, ensuring everyone is up-to-date and thereby avoiding confusion about what’s going on.”

Information is posted in electronic status boards that are easily configurable to a particular incident type or division of the organisation. Each record posted can be categorised to reflect its type, or importance level – for example, ‘requires action’, ‘information only’, “draft”, ‘confirmed for distribution’. Security determines who can add, edit or view information on which whiteboards and in what states. “Invoking an incident takes seconds and entering data is simple” says Boyce; it has to be, for time wasted on setting up complicated systems in the golden hour could be critical.

“It is a very powerful tool and such is the functionality of the Crisis Control Centre that I am looking for other deployments of this technology within Thomas Cook,” said Boyce. “I’m looking forward as well, to the enhancements other users will bring to the Control Centre, as part of Solcara’s commitment to user-led development.

The Solcara Crisis Control Centre meets Thomas Cook’s incident communication needs. Boyce advises that “when considering the implementation of an emergency procedure communication system, it is important not to over-complicate the process. Go for a best of breed approach selecting a group of tools for your purposes rather than stretching one tool too far.”

It is impossible to mitigate all risks in the operations of business and the delivery of public services. When things go wrong, however, it is important that organisations have the best tools to help their crisis teams to speed up the recovery of the business, and to learn lessons so that bad practices are not repeated. Solcara Crisis Control Centre is helping Thomas Cook achieve this and is now an integral part of their crisis management plans. Its adoption has lead to the protection of corporate and executive reputation and will highlight any operational deficiencies that can be eradicated, thereby preventing the recurrence of past mistakes.

Solcara will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk

Are You Getting Value from Your BIA?

James R. Mitchell, CBCP
Director, eBRP Solutions, Inc.

Cost vs. Benefit
The standard practice of conducting a Business Impact Analysis (BIA) to determine the basic recovery requirements (Mission Critical Processes, RTO’s, RPO’s, Critical Applications, Suppliers, and other Resources) is a vital phase of every Business Continuity Management program.

The BIA process can be long and difficult – no matter what data collection method is used. Is the return on your BIA investment (time, manpower and resources) offset by the value of the results?

If a BIA is a fundamental part of BCM, the underlying cost may simply be a necessary evil. But, when a BIA is a one-time ‘project’ – as in many organizations – is the cost realistically proportional to the value?

Some organizations conduct a BIA expecting to repeat the process at regular intervals. However, once the initial BIA is completed and the true cost known, such expectations are often abandoned.

Focus on change
Failure to update a BIA is a leading cause of Recovery Plan failure. Change is the only constant in business. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.

Intending to update a BIA is easy; yet the update process often fails.

Consider the effort required to complete the original BIA: questionnaire preparation, distribution and collection; interviews to “normalize” the results, plus the cost of analysis and report generation.

Often, the original BIA process “project”, may take three to eight months. Significant business changes make the prospect of repeating that lengthy process daunting. Postponing the update may be rationalized. Like most things in life, postponing difficult tasks allows them to grow more unwieldy

To streamline the process, the updated BIA must focus on the changes – rather than repeat the entire process. It is likely that much of the information from the earlier BIA is still valid. The update process simply entails drilling down to which business processes have changed, and how those changes affect the original BIA results. Of course, the method used to conduct the earlier BIA will determine just how easy – or how difficult – the update process becomes.

In Information Technology, an updating process is generally ongoing (Change Management) because IT changes have a direct impact on daily operations. In business operations, changes occur regularly, but are seldom, if ever, documented. (To be fair, no matter how robust the IT program, not every organization consistently correlates its Change Management information with its DR Plan.)

The Whole is Greater than the sum of its Parts
Is it sufficient for individual business process “Owners” or function leaders to update their own critical resource requirements? Yes, if the update method allows for the capture of changes in enterprise-wide dependencies (on other processes, applications, etc.). But no effective update can be conducted in a vacuum; any change to critical dependencies or resources is likely to have a corresponding affect upon those dependent processes.

While it may be efficient for a process team to update its own BIA, only by collecting and integrating changes across the enterprise can the true impact of business changes emerge.

The Path of Least Resistance
Frequently, the cost of updating a BIA (in manpower and time) is perceived as unjustifiably high. Not updating a BIA may become an accepted risk. BCM management may opt to focus on BC/DR Plan updating (assuming most process owners understand the impacts of change and will modify their Plans appropriately) without revising the BIA. The more burdensome the BIA process, the higher the propensity not to repeat it.

Once made, such a decision often becomes institutionalized. Later, the failure to reflect fundamental changes in the organization’s structure may result in flawed Plans and a failed recovery. With luck, flaws show up in a test or exercise – not a real life incident.

What’s in your Toolbox?
Does your existing BIA format lend itself to manipulation? Or do you have to start from scratch? Do you use software that integrates BIA and Plan development?

Does the BIA format lend itself to the use of collaborative tools? Can business process owners gain access to the original BIA survey? Network- or Web-based collaborative tools reduce the pain of updating a BIA, while enabling monitoring and auditing of the process by the BCM leaders or planners.

Assess your options, and pick a BIA updating method that works best for your situation. It may not be free, it may be time-consuming, and it may not be painless. But it will pay dividends if you have a disruptive event.

An out-of-date BIA exponentially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA information, the validity of Plans should be questioned, and their successful execution must be suspect.

eBRP Solutions, Inc will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk