Initiatives for Organisation’s Business Continuity Plan (BCP)

**************************************************************************************** ACKNOWLEDGEMENT

This article was published in the New Straits Times on September 27, 2003

Reproduced here with permission from the author (Dr.) Josef Eby Ruin
****************************************************************************************

1.0 Business Continuity Plan (BCP) deliverables

Typically, a BCP is prepared to document the following deliverables:

• Identifying tasks to be undertaken, and the responsibilities of various personnel in the disaster management team or committee (DMT)
• Stating the job of a BCP coordinator
• Identifying the contact numbers and addresses for DMT members and support resources required; and
• The communication matrix or template required to notify stakeholders, the public, and the media

The plan in the BCP defines the business resumption procedures that encompass the critical business processes of an organisation. It details the key resources to be used and the various action plans to be initiated so as to recover these resources for the business continuity. Key areas to be documented in the BCP would be:

• Formalising the recovery team's set-up, and availing them the mandates and power
• The recovery team's roles
• Minimum and necessary support staff needed
• Location of the organisation's control command centre (CCC) and mission-ciitical facilities required
• Protection and location of critical information
• Identification and testing of the business recovery site for the critical functions to continue
• Telecommunication requirements of the business operations of the organisation
• Personnel requirements (the "red-label" staff) to deliver the agreed level of minimum services; and
• The location and stand-by roles of "green" and "yellow-labelled" staff

2.0 What determines a BCP's success?

As BCP is the heart/brain of any organisation's continuity management strategy, its success depends on the following:

• Effective implementation and testing of the documented BCP procedures, and getting them understood across the entire organisation
• The hands-on application exercise for staff who are directly involved in the execution of the plan
• Awareness programme to ensure enterprise-wide adoption of the plan

3.0 The continuity culture and awareness

All proposals identified in the BCP should be implemented as a matter of commitment, otherwise the effort, time and investment made in its preparation will be wasted, redundant or at best become superfluous. The same goes for awareness that have to be embarked upon so as to provide the assurance that the entire organisation is competent and confident with the plan’s success and effectiveness.

All parties must appreciate the importance of BCP to the organisation's survival and their roles in the process. This awareness should extend to external stakeholders and third parties whom the organisation depends on in both normal and crisis operations.

By implementing the BCP in this manner, all those involved in the invocation of the BCP can have full confidence in the organisation's ability to manage a crisis. With such commitment, the BCP-involved staff will have that “continuity culture” in their work habits. This kind of value shall put an organisation head-and-shoulder above the rest as far as organisational resilience is concerned.

4.0 Appointing an organisation’s BCP coordinator

A BCP coordinator is to be appointed. He is to report directly to the board member responsible for the BCP programme. A coordinator has to understand the organisation's business structures, corporate objectives and the various people who make the organisation ticks. Ideally, he is seen as a good programme manager with superior communication and interpersonal skills. He is a good leader and has a good understanding of the cost and budget dynamics as the setting up of business recovery sites (hot, warm, cold sites) are not cheap to initiate and maintain.

5.0 The relevance of awareness, dryruns and training

A BCP has to be practical and implementable. BCP is a live strategy, hence it needs periodical updates with revisions for applicability, suitability, and efficacy for maximum value-impact. If the BCP document is merely printed, then distributed and turned into a “showcase or decorative file”, then that organisation’s BCP initiatives have failed and the whole exercise is futile.

If an emergency is declared and the organisation is obliged to invoke its BCP, it would fail since no one (or not all the critical staff) have any idea as to its contents and without knowing the moves to initiate. Thus, there is the dire need to underscore the importance of getting the BCP awareness and testing for the staff, especially the red-labelled staff who will become the main initiators when a crisis attacks.

An organisation's BCP cannot be considered “fool-proof” until it is tested and proven workable. Testing or BCP-exercising can take various forms – from communications plan test to partial systems test to partial system and business simulated test to full-system and business live test. The frequency of exercise may be at a minimum of once a year.

6.0 Knowing the organisation’s stakeholders’ expectations

When a crisis occurs, there is the need to recognise the various stakeholders. The list may vary, depending on the nature of the crisis. Typically, an organisation's stakeholders whose expectations need to be served would include one or many of the following:

• Adversarial groups, brokers, distributors, dealers
• Vendors, suppliers, business groups
• Community leaders, competitors, customers/clients
• Employees, investors, law enforcement officials
• Regulatory authorities/officials
• News media organisations, plaintiff attorneys, politicians
• Security analysts, ratings agencies, insurance companies
• Stockholders, union officials, shareholders; and
• Any entities, individuals, groups that have interest in the beleaguered organisation that is facing the crisis

7.0 Inherent features of a credible BCP

A credible BCP needs to have a mechanism set up to establish easy maintenance and update an organisation's BCP. A roadmap for the unexpected can be one such mechanism. Such roadmap must define responsibfiities to:

• Differentiate between business recovery and disaster relief-rescue teams
• Identify tasks to be undertaken by various teams
• Identify and list key contacts, suppliers and resources
• Provide the framework for crisis communication and how to inform stakeholders and handle the media

A credible BCP should define the business continuity procedures clearly. The procedures are to cover mission critical processes and must highlight what are the key resources to be used, and what processes are to be followed, to recover these resources that are affected by the crisis. A credible BCP should also integrate itself with other key strategies in the organisations like perhaps the policy for:

• Crisis communication and public relations
• Safety and emergency guide
• IT and communications recovery procedures
• Security framework
• Departmental operating outlines
• Supply chain logistics policy; and
• Operational risk management manual

8.0 Contents of a BCP document

There is no hard and fast rule as to what constitutes a complete BCP document. However, six fundamentals should be present.

I. General introduction
a. Objectives
b. Responsibihties
c. Exercising
d. Maintenance

II. Plan invocation
a. Disaster declaration
b. Damage assessment
c. Continuity actions
d. Team organisation and responsibilities
d. Red-label, yellow-label, and green-label staff
e. Emergency operations centre

III. Communications
a. Parties that need to be informed
b. Contacts
c. Key messages and common templates to use

IV. Suppliers
a. List of recovery suppliers
b. Details of contract provisions

V. Awareness and training
a. Approach and concept to cascade or disperse the BCP among staff
b. Mock runs and testing for credibility and practicality

VI. Custodian, evolvement and Changes
a. List of all BCP holders
b. Distribution and change process

9.0 FAQs regarding BCP initiatives

Whatever, and despite all sorts of BCP materials that can be read to gain insights into what it is all about, there will still be lots of unanswered questions for management practitioners. Knowing some simple answers that an organisation should answer for some of the frequently asked questions (FAQS) on BCP issues (like those stated below) would make an organisation’s management understand BCP better as well as facilitate the organisation’s team to develop credible and elective BCP.

FAQ 1: System for management notification
i) What kind of management notification system does your organisation have in place if a crisis occurs during non-business hours?
ii) How long will it take to reach everyone (from board to senior management decision- making body)?
iii) What needs to be done if a disaster happens at 4.45pm?

FAQ 2: Organisational emergency response
i) When was your organisation's BCP documents last reviewed?
ii) Has it ever been tested to see if it worked?
iii) How well does this BCP gel with the response plans of other subsidiaries within your organisation?

FAQ 3: Vulnerabilities and internal problems
i) What are other identified internal problems that your organisation has which could damage its business if the “bad” or negative news leaked out to the public?
ii) What will the public’s reaction be, if say, one of such "bad" news is disclosed by a disgruntled staff
iii) How will your management explain and justify the situation so that such news will have insignificant financial impact on your organisation?
iv) What is being done by your management to reduce the chances of such whammy from occuring now or in the future?

FAQ 4: Official spokesperson
i) Who is your organisations spokesperson in a crisis environment?
ii) Who is the alternate spokesperson if the principal spokesperson is not available, or not appropriate/relevant for that kind of crisis event?
iii) How good are they in handling tough questions from reporters?
iv) How much confidence does your organisation has that the spokesperson is convincing and credible?
v) How are disclosures handled in your organisation when a crisis occurred in a branch, region or isolated location outside your head office? Who is the designated spokesperson in such a situation?

FAQ 5: Accuracy of information
i) How much information your organisation would divulge if there is a crisis in your organisation?
ii) Who is to ascertain what to say?
iii) What are your organisation's approval process?
iv) How long will such approval process take?

FAQ 6: Disseminating news to stakeholders and employees
i) How does your organisation contact the board, management, and employees so they would hear first before learning about the crisis from the news media?
ii) How about your customers, suppliers, other key audiences and stakeholders? How long would that take?

FAQ 7: Similar crisis in other organisations
i) What similar crisis situations have other organisations experienced in the past year that went “public”?
ii) How well would your own organisation have handled those similar crises?
iii) How much of their management time have those other organisations taken?
iv) How much have those crises cost them in expenses, ill-publicity?
v) Would there be lawsuits, and regulatory or government investigations?
vi) How long might they be, before those organisations get the problem behind them?
vii) What would your organisation have initiated if it happened to your organisation?
viii) What are the “lessons learnt” from their experiences?
ix) Have you made any changes in the way your organisation do business as a result of what happened to those organisations?

Written by (Dr.) Joseph Eby Ruin, FCCA (UK), CA (Malaysia), Hon. DBA - Management Philosophy (Kursk State Technical University). (Dr.) Joseph completed his ACCA (UK) in 1976. He became Fellow in 1984. He has also been a member of the Malaysian Institute of Accountants since 1983. For his many management books, articles, and conference, seminar and workshop papers, he was conferred the honorary degree of Doctor of Business Administration (Management Philosophy) by the Kursk State Technical University, Russia in 2006. He was elected Regional Director of The Professional Risk Managers' International Association (PRMIA) Malaysia Chapter in November 2007. He can be reached at RiskFirst Consultancy & Training Services, Tel: +603 - 22735506.

Chen Ming-fa’s note:

Also see Managing Business After Disaster http://biz.thestar.com.my/news/story.asp?file=/2009/1/12/business/2955533&sec=business

The field of Business Continuity Management (BCM) is gaining prominence. In Malaysia, the Malaysian central bank i.e. Bank Negara, has issued business continuity guidelines as part of the corporate governance for all financial and insurance institutions. To become a professionally certified BCM guru, visit the Business Continuity Institute http://www.thebci.org/ to find out more.

Sustainability as Core Business Strategy

****************************************************************************************
ACKNOWLEDGEMENT

This article was published in the New Straits Times on August 23, 2008
as a CIMA Business Talk article.

Reproduced here with permission from
The Chartered Institute of Management Accountants (CIMA Malaysia).
****************************************************************************************

Business leaders now recognise that sustainability has moved beyond the corporate social responsibility agenda to become an integral part of core business strategy and success. Companies are moving from asking what our sustainability strategy should be, to asking what our business strategy should be in light of sustainability.

Companies have used three key approaches to integrate sustainability into their strategy – planning their strategy to include sustainability trends, managing how opportunities are defined and selected, and experimenting with approaches to learn which yield the best results.

High Demand, low supply

Business depends on a host of often unnoticed ecosystem services, from a stable climate to assimilation of waste, from providing food to controlling diseases and pests. It's not just rainforests and tigers under threat, climatic systems, water resources, agriculture and fisheries are all degraded or unsustainable ecosystem services, which we still rely on for business success.

We are depleting our natural capital at the very time when our needs are growing. The planet will be home to 9 billion people by 2050, with the addition of just under 1 billion people in the next 10 years alone.

Profit from sustainability

The surge in population and consumption over the next 20 years looks impossible for damaged ecosystems to sustain. But smart businesses will profit from these challenges by finding ways to give us what we need and want while maintaining the ecosystem services which we rely on.

People increasingly expect business to play a key role in finding solutions to these global problems. Taking the opportunities also brings reputation and brand benefits as well as give employees a larger cause to be motivated by. However, if companies fall short of expectations, then they will experience consumer distrust (or even boycotts), greater regulation from governments, and investors questioning the quality of management.

There is an opportunity now for businesses to explore how to combine profit with creating a sustainable future. Business strategies that address this challenge at a profit will define the successful business of the next 10 years.

Integrate Sustainability into Strategy

We have found that businesses bring sustainability into their strategy process using a combination of three approaches. Firstly, they must plan to include future trends. Most companies have a strategic planning cycle, perhaps five-yearly with annual revisions. Companies can incorporate sustainability into that cycle by introducing material sustainability trends to the external assessment of the structure and dynamics of the business context.

Secondly, companies should manage how opportunities are defined and selected. In most organisations, there is the plan and then there is what happens. Putting any strategic plan into action means changing how opportunities are defined at the “coalface” and selected by managers and then reallocating resources appropriately.

Leading businesses are enabling people to define sustainability as an opportunity through giving clear signals of intent, including announcements and high profile actions. They are also setting a structural context where opportunifies that are on-strategy are favoured. These can be formal, regular reporting to board-level committees, performance targets or internal carbon currency. Or they can be informal such as promoting people who have pushed commercial sustainability-related activities.

Thirdly, organisations need to experiment to learn and create options. The world changes fast, so do the commercial opportunities of sustainability. Speed of change limits how well a company can plan or manage for success. Instead, leading businesses keep their options open and identify the best approach through a range of deliberate and contained experiments.

The experiments could be a new product message, a new product, or a whole new business. Such experiments give them the chance to test different approaches without committing the entire business. Learning is the success factor – even if they lose money, they know how to do it differently next time.

Some companies focus on one strategy, but most companies have a combination of strategies that use core competencies.

Business strategies for sustainability must be built on the specifics of how that company creates and maintains its competitive edge. Any business case is going to be weak for generic initiatives, philanthropic add-ons or being responsible for the sake of it. Instead, business strategies must anticipate emerging issues, build on the company’s strengths, and focus on resolving the challenge of reducing supply and increasing demand.


Written by David Bent. For more information, please contact The Chartered Institute of Management Accountants (CIMA) Malaysia at Tel: +603 – 7723 0230 or e-mail: kualalumpur@cimaglobal.com. Website: http://www.cimaglobal.com

Corporate Social Responsibility (CSR) Gaining Ground

****************************************************************************************
ACKNOWLEDGEMENT

This article was published in the New Straits Times on December 18, 2004
as a CIMA Business Talk article.

Reproduced here with permission from
The Chartered Institute of Management Accountants (CIMA Malaysia).
****************************************************************************************

As the driving force behind UK's Associate Parliamentary Sustainable Waste Group, Mark Dempsey's background as an environmental management specialist has made him acutely aware of the series of directives, laws and regulations that are threatening to overwhelm businesses with green tape. With careful waste management alone, he argues, companies can make savings equivalent to one per cent of their annual turnover.

One of the most persuasive ways of encouraging companies to become greener is to show them that it makes financial sense. On a wider scale, this formula of being green, being seen to be green and increasing profits at the same time is now being used to urge firms of all sizes to bite the ethical bullet and accept the more daunting challenges of corporate social responsibility (CSR) reporting.

The business case for CSR is looking increasingly persuasive. According to CSR Europe, one of the leading authorities on the subject, successive studies have shown that a committed CSR strategy improves a company's overall performance in the long term, as well as its attractiveness in the marketplace. For instance, research last year by the Institute of Business Ethics found that firms with a public commitment to ethics made 18 per cent more profits on average than those without one.

Along with the notable growth in socially responsible investment funds in recent years – there are now almost 300 in Europe – investors and consumers are really starting to flex their ethical muscles. Research by McKinsey & Co has found that institutional investors.are prepared to pay a premium of more than 20 per cent for shares of companies that demonstrate good corporate governance.

And CSR Europe's research has shown that 20 per cent of European consumers are willing to pay more for products that they believe to be socially and environmentally responsible.

According to Geoff Lane, head of the CSR advisory team at PricewaterhouseCoopers, interest in CSR from big business has now reached boiling point. The problem lies not in converting companies to the merits of CSR, but in getting them to put into practice. “A lot of it is about changing the culture of the ways companies are run, and that can be quite a daunting prospect,” he says.

The main barrier, Lane feels, is the fear factor linked to transparent reporting. “There is a feeling that companies don't want to rush into it and make mistakes that could put them in the firing line.”

But experience has shown Lane and his team that, once a company appreciates the fundamentals of CSR, these fears diminish.

Whether companies choose to adopt a full CSR strategy or not, they cannot ignore the growing pressure for greater accountability from institutional shareholders, insurance companies, pressure groups, the Government and the media. One of the consequences of this pressure is that risk has become one of the key facets of modern reporting.

“Risk management now extends a long way beyond the financial because so much hinges on reputation,” Lane says. “There's an acceptance that risk has to be approached in a much broader way, using a much more subtle process to capture possible liabilities. It's rather like a radar screen where you can see what's coming at you.”

The effect of enhanced risk management and the greater emphasis on ethical profit-making has led to a situation where, whether they like the idea of becoming eco-warriors or not, financial managers are finding themselves playing a central role in developing CSR strategies.

Lane believes that in the future one of the key roles of the finance director will be to ensure that CSR is part of a company's core strategy. “To get investors and analysts to understand why CSR issues are important, finance directors need to communicate how these issues generate both risk and opportunity for their business in the short and long term,” he says. “This means positioning CSR in the context of the company's core strategy for creating value.”

At the other end of the spectrum, Deborah Doane, chair of the Corporate Responsibility Coalition, urges financial managers to ensure that their CSR strategy documents are supported by measurable indicators.

Doane also believes it's important for those driving CSR to ensure that there is an open and balanced dialogue with all stakeholders and, in particular, those involved in the company supply chain.


Written by Camilla Berens. This article first appeared in Financial Management, a monthly magazine published by the Chartered Institute of Management Accountants (CIMA), United Kingdom, for its members. For more information, please contact The Chartered Institute of Management Accountants (CIMA) Malaysia at Tel: +603 – 7723 0230 or e-mail: kualalumpur@cimaglobal.com Website: http://www.cimaglobal.com

Chen Ming-fa's note: Some actual examples of CSR in action in Malaysia.

1. New use for old batteries

http://thestar.com.my/metro/story.asp?file=/2009/5/25/central/3966450&sec=central

2. Disabled buddies find their niche at hypermart

http://www.nst.com.my/Saturday/National/2563860/Article/index_html

3. The disabled get a break at GCH Retail

http://biz.thestar.com.my/news/story.asp?file=/2009/3/21/business/3398175&sec=business

4. Clearwater focusing on green projects

http://www.star-space.com/news/story.asp?file=/2009/5/23/pnews/3949044&sec=pnews

5. Foundation of tyres

http://thestar.com.my/lifestyle/story.asp?file=/2009/4/7/lifefocus/3626139&sec=lifefocus

6. Panasonic: Go Green, Live Green

http://thestar.com.my/gogreenlivegreen/story.asp?file=/2009/4/7/gogreenlivegreen/3591347&sec=gogreenlivegreen

7. Shell: Gas to Liquids (GTL)

http://www.shell.com/home/content/shellgasandpower-en/products_and_services/what_is_gtl/dir_what_is_gtl_1205.html