Good Practices For A Successful and Effective BCMS Implementation - Webinar

Good Practices for a
Successful and Effective BCMS

Implementation
Daman Dev Sood

COO & Head Sustainability Practice
Continuity and Resilience
Process Excellence and Resilience...
Creating Corporate Sustainability
Intro to Daman
COO & Head Sustainability Practice at Continuity
and Resilience (CORE)
Xansa Steria
Global BC Manager
India Head - Green
TCS
Various roles (development, delivery, program
management, quality, business excellence)
Overall 30+ years in industry

Intro to Daman
Fellow of BCS The Chartered Institute for IT

Associate Fellow of BCI
Senior Member of IEEE
IEEE Ambassador in India
Member of ASSOCHAM National Councils on Climate
Change and Environment & Safety
Indias
First BCS Accredited tutor for Green IT
Most spoken on Green IT
BCS board member for designing further Green IT courses
Connect with me via linkedin

Intro to CORE
ISO 22301 Certified Management Consulting Firm
Business Continuity Management

Crisis Management
IT Disaster Recovery
Information Security
Green IT/ Sustainability
We Consult / Train / Assess and Certify in these

domains

Todays Webinar
BCM is the need of the hour.
Everyone knows BCM, But non-one knows BCM.
The CEO and the CFO want to see the RoI on the
investment made in implementing BCMS.
The sustenance of investments will depend upon the
success of the program.
This session will focus on the factors that are critical
to the success of BCM Program.

Todays Webinar
Understanding of basic concepts

Understanding the minds of the CEO and the CFO
Critical Success Factors for the BCM Program
Ability to monitor and improve upon these on
continual basis

What Is Business Continuity?

capability of the organization to continue delivery
of products or services at acceptable predefined
levels following disruptive incident
ISO 22301, Clause 3.3

What Is Business Continuity Management?
..Holistic management process that identifies

potential threats to an organisation and the
impacts to the business operations those threats,
if realised, might cause, and which provides a
framework for building organisational resilience
with the capability of an effective response that
safeguards the interests of its key stakeholders,
reputation, brand and value-creating activities

What Is BCMS?
..Part of the overall management system that

establishes, implements, operates, monitors,
reviews, maintains and improves business
continuity

KEY SUCCESS FACTORS

10
KISS
Whatever you do
Keep it short and simple
Your documentation is for everyone not only for the
top management
Your arrangements are to be used
Everyone is pressed for resources

11
Commitment From Top

12
How To Gain Top Managements Buy-In/

Commitment?
Share information with them

Show the mirror
Larger the organisation: larger the loss due to failure

Tell what others have done
Establish benchmarks
Show cases and case studies
Gain, share and utilise knowledge

13
ISO 22301 PDCA Cycle

Continual improvement of Business Continuity Management System (BCMS)
Interested
Parties
Requirements
for Business
Continuity
Establish
Implement
and
Operate
Plan
Do
Act
Check
Maintain
and
Improve
Monitor
and Review
Source: ISO 22301:2012

14
Interested
Parties
Managed
Business
Continuity
What Is In It For Me?

Organisational Objective
BU1
BUnn
RM
QM
Security
(physical)
ISMS
Finance
HR
Legal
Marketing
CM
EM
Any more?
DM
EM
EnM
Sustainability
Any more?
Business Continuity Management

15
Increase Competencies
ability to apply knowledge and skills to achieve intended results
ISO 22301 Clause 3.9
There is no end to learning:

Books
Research papers
Online communities
Webinars
Knowledge sharing sessions
Conferences

16
Mutual Aid Agreements

Nothing comes free in this world
All organisations ate pressed for resources
Mutual Aid Agreements are difficult, but not impossible

17
Establish, Understand, and Rehearse
Cost
Complexity
Risk
Assurance
Cost
Complexity
Risk (of distrurabnce due Test)
Assurance
Frequency
Frequency
0
Review/
Walkthrough
Table Top
Call Tree
Simulation
Graph not to scale

IT/ Work Area

Recovery
18
Integrated
BCM & Other Management Systems
ISO
22301
ISO
27001
ISO 9001
ISO
14001
BS 11200
ISO
31000
ISO
22318

19
Professional Practices
Project Initiation
and Management
Risk Evaluation
and Control
Business Impact
Analysis
Developing
Business
Continuity
Strategies
Emergency
Response and
Operations
Developing and
Implementing BC
Plans
Awareness and
Training Programs
Maintaining and
Exercising BC Plans
Crisis
Communication
Coordination with
External Agencies

20
Keeping Uptodate Social Media

Do you have a Media Policy?
Do people know about it?
Have they understood it?
Do you believe that they will live to it, if/ when required?
How about Social Media Policy?

21
Raising Awareness

22
Raising Awareness

23
Raising Awareness

24
Raising Awareness

25
Raising Awareness

26
Raising Awareness

27
Roles, Responsibilities & Authorities

Avoid the following:
No one told me
I did not know
Who did this
You could have asked
You must have discussed
What about Authorities?

28
Whatever You Do
Be Reasonable and Practicable
Do not let BCM become a Black hole

29
Tips on Audit Evidences

Existence of the following processes (more or less):
Interested Parties
Regulatory Requirements
Risk Appetite
Business Impact Analysis
Risk Assessment
Strategies Development
Plan Development

Testing
Training
Audit
Management Review
Performance Evaluation
Communication
Continual Improvement
30
Tips: Documented Process

Process exists: (written, reviewed, approved, published)
Process is used
A product has been produced
The product has been published/ shared
The product has been used
(nothing comes free in this world, hence we must not do
anything for nothing!)
The product has been reviewed and refined over a period
The process has been reviewed and refined over a period

31
Tips: Mandatory Documents

ISO 22301 is not so clear on this (compared to BS 25999)
Wherever you see .. The organisation shall maintain
documented information.. take that to be the mandatory
document

32

So roughly, the following must exist:
Policy
Program Management Plan
Interested Parties
Risk Appetite
Regulatory Requirements
BIA(s)
RA(s)
Strategies
Plan(s) incident/ emergency/ disaster/ crisis/ continuity/
recovery

33

Test Schedule, Plans, Reports
Maintenance Schedule, Reports
MR Schedule, Reports
Training Needs Analysis, Schedule, Competence Records
Audit Plan, Reports
Corrections, Corrective Actions and Preventive Actions Report
Performance Evaluation Report
Continual Improvement Report
Incident Reports
Communication Records (general, specifically from the top
management)
34

Record of interaction with Customers
Record of interaction with Vendors
Record of interaction with Suppliers
Record of interaction with authorities (fire brigade, ambulance,
hospital, police, government, regulator)
Record of interaction with other relevant interested parties

35
Tips: on Embedding
There is no end to Training and Awareness
Does your management walk the (BCM) talk?
Are various policies/ processes aligned to each other?
BCM and Vendor Management
BCM and Change Management
BCM and Performance Evaluation
BCM and Employee Suggestion

36
My Mind Map

37
Case Study 1
Industry
Situation
Manufacturing
Full fledged BCM implementation

New industry, limited information
Limited knowledge of the supply chain
Internal conflict and confusion, people changes
Outcome
Learnings
1. Project stalled several times

2. Way beyond the projected
timeline
3. Impacted other customer projects
4. Frequent re-allocation
5. Operational issues
6. Project size has tripled, customer
happy
A. Dont allow the company to cut

corners
B. Insist on getting a full
understanding of the process
complexities
C. Understand the internal dynamics
D. Not just they want us to do it
E. Suppliers need BCM buy-in also
F. Terminology mismatch

38
Case Study 2
Industry
Banking
Situation
Resource augmentation but called it outsourcing

Inability to get a common understanding
Implementer took decisions without informing his seniors
Poor quality delivered
Outcome
1. Organisation stopped at a logical
phase. Company chose to defer
the project
2. Implementation team was
blamed
3. Senior management missed their
timelines
4. Team reprimanded

Learnings
A. Listen to the customer even
those internal
B. Internal customer treated too
lightly, not respected
C. Keep validating sometimes
difficult internally
D. Create a common frame of
reference to ensure no confusion
over the final deliverable
39
Case Study 3
Industry
Govt. Sector
Situation
Blind leading the blind

Comprehensive assignment
Unscheduled delay in internal customer responses
Senior Management involvement brought things back on
track
Outcome
Learnings
1. Project delayed
2. Additional cost of resources
deployed
3. Impact on other projects
4. Senior management time wasted
in managing deliverables
5. Microscopic supervision for
balance deliverables leading to
increased work pressure on
senior management
A. Free up the resources

B. Train the project team, make it
special for them
C. Train their managers, make them
responsible also
D. Explain the big picture

40
Case Study 4
Industry
Financial
Sector
Situation
Create BCM Policy & Procedure and relevant templates

Internal change in Company setup
Gap in agreed proposal and expected delivery
Unwarranted confrontations but timely delivery
Outcome
Learnings
1. Project delivered on time but

went through some readjustments
2. Delay in payment till resolution
3. Detailed brief to the customer to
resolve misunderstanding
4. Repeat business has now started
A. Proposals should clearly

articulate the deliverables and
also spell them out
B. Manage internal change in a
diplomatic manner
C. Give your customer the benefit of
doubt technical terms may
have been misinterpreted, try to
meet the customer expectation, if
possible, go out of the way

41
Case Study 5
Industry
Insurance
Situation
BCM consulting & implementation

Internal team threatened due to external experts
involvement
Non acceptance by MR and push backs
Involved in internal conflicts and lost project
Outcome
1. Project delayed
2. Trapped in BCM Vs IT
dominance conflict
3. MR maintained none of my
business attitude
4. 100% adherence to delivery
salvaged the situation

Learnings
A. Appreciate the internal teams
role and effort & watch out for
distrust signals
B. Challenge non acceptance with
knowledge and complete details
C. Never mess up on delivery or to
give an opportunity to customer
to question your ability
D. Obtain signoff at every milestone
achieved or projected next step
42
Case Study 6
Industry
Situation
Facilities
Management
Training workshops
Large group involving senior leader
CEO decides to change the agenda once the session starts
Outcome
1. Training result delivered but had
to incorporate new requirements
2. Recap helped satisfy the CEO
3. Negative turned into a positive

Learnings
A. Understand the organisation
structure
B. Try to ensure that all are on
board, including the CEO
C. Know your audience
43
Key Learnings
The customer is always right even if he is wrong

Respect your customer
Listen to your customer
Understand the internal dynamics
Be crystal clear about deliverables, including
terminology
Obtain signoff
Ensure the full picture at all levels, including critical
suppliers
44
Summary
Leadership - Driven by the top I want it done

Customer driven BIA is key
Context refer to all relevant
Broad mindset.
Implement vs. Audit
Management involvement. Walk the talk
Management to Allocate time
Free up the operational team
Been there, done that - Get external help
Training - Learn before you do

45
Thanks!
Let us stay in touch
d.sood@continuityandresilience.com
46
CONTINUITY & RESILIENCE

Email: info@continuityandresilience.com
Website: www.continuityandresilience.com
http://www.coreconsulting.ae/

47
47

Good Practices For A Successful and Effective BCMS Implementation - Webinar

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Good Practices For A Successful and Effective BCMS Implementation - Webinar

Transféré par

Droits d'auteur :

Formats disponibles

Good Practices for a

Successful and Effective BCMS

Daman Dev Sood

Overall 30+ years in industry

Process Excellence and Resilience...

Fellow of BCS The Chartered Institute for IT

Connect with me via linkedin

Business Continuity Management

We Consult / Train / Assess and Certify in these

Process Excellence and Resilience...

Process Excellence and Resilience...

Understanding of basic concepts

Process Excellence and Resilience...

What Is Business Continuity?

ISO 22301, Clause 3.3

Process Excellence and Resilience...

What Is Business Continuity Management?

..Holistic management process that identifies

ISO 22301, Clause 3.4

Process Excellence and Resilience...

..Part of the overall management system that

ISO 22301, Clause 3.5

Process Excellence and Resilience...

KEY SUCCESS FACTORS

Process Excellence and Resilience...

Process Excellence and Resilience...

Commitment From Top

Process Excellence and Resilience...

How To Gain Top Managements Buy-In/

Share information with them

Larger the organisation: larger the loss due to failure

Process Excellence and Resilience...

ISO 22301 PDCA Cycle

Source: ISO 22301:2012

What Is In It For Me?

Business Continuity Management

Process Excellence and Resilience...

There is no end to learning:

Process Excellence and Resilience...

Mutual Aid Agreements

Process Excellence and Resilience...

Establish, Understand, and Rehearse

Graph not to scale

IT/ Work Area

BCM & Other Management Systems

Process Excellence and Resilience...

Process Excellence and Resilience...

Keeping Uptodate Social Media

Process Excellence and Resilience...

Process Excellence and Resilience...

Process Excellence and Resilience...

Process Excellence and Resilience...

Process Excellence and Resilience...

Process Excellence and Resilience...

Process Excellence and Resilience...

Roles, Responsibilities & Authorities

What about Authorities?

Process Excellence and Resilience...

Process Excellence and Resilience...

Tips on Audit Evidences

Process Excellence and Resilience...

Tips: Documented Process

Process Excellence and Resilience...