The #1 Mistake That All Business Continuity Plan Miss!

Hello everyone.

Welcome to the Virtual Pub. My name is Boris Fisher and we have Jonathan. Happy Thursday. We've got a special guest, Rod Crowder. Rod, we've known each other for. Since 2013. Some recollection there. And seven years goes by very quickly, I must say.

Absolutely. And thank you for having me along. I've got a virtual beer 0.0 to go along and. Yeah, I didn't realize we'd known each other that long, Boaz. So. Yeah, absolutely. It's been a lot of fun along the way.

It's a pleasure to have you here. So just a quick bio and then you could fill in the gaps. So you've been in the industry for what, around 25 years around risk resilience and information security. I see that you're the lead instructor in the Disaster Recovery Institute International. I don't really know what that means, but you can explain down the track. And you're sort of a regular speaker or invited speaker to various places around the world. And you come from the uk, what more can I say?

Tick all the boxes, huh? Yeah. So let me start telling you a little bit about myself.

Yes, please do. And tell me a little bit about opscentre as well and then I'll get Sean.

Okay, so look, OP center is a business. We're basically a risk and resilience consultancy. What does that mean? We help organizations to assess their risks. So we build risk frameworks, we undertake risk assessments, build risk registers and help them to set up those processes and compliance and governance frameworks. And we do a lot of work around disaster recovery and business continuity. And what that means is basically helping organizations to understand what some of the operational risks to their business are and having a pre built plan basically so they have a response mechanism in place. As you mentioned, I'm the country representative for the Disaster Recovery Institute. Fundamentally, there are two large institutes worldwide. One is called bci, the Business Continuity Institute. One is called the DRI Disaster Recovery Institute. They're both very similar. They're both basically about, you know, educating, promoting best practice around the world. Dearite has over 15,000 certified professionals globally. They run conferences, they develop best practices, provide training courses and so on. So yeah, that's a bit about me and DRI and OP Center.

Beautiful, beautiful. Okay, so let's start, but let's set the scene. And Sean is very good at that, so off you go.

Yeah, thank you both. Okay, guys, look, in the ideal world we wouldn't need to worry about anything, but unfortunately in the real world we have some unfortunate events. Mishaps and some events that basically helps or stops us from functioning. Now organizations, they really care about the core business and they do everything to make sure that the business continue to function, keep its profit and basically run as normal. Unfortunately, and we can see today, especially in the COVID 19 pandemic situation, where a lot of employees are working from home, situation is different, has changed. And today organizations are subject to many attacks, many risks that are coming, unexpected events and unfortunate events. And what organizations I guess need to do today or they're thinking of doing is basically how to keep the organization working and functioning, how to keep the business continue. And for that we have Rod here that is specialist in business continuity planning. And to you Rob, tell us what's. How do you help organizations and what is it?

Yes, exactly. So just expanding a little bit about what I said before. I mean there are organizations that will wait for an event to occur, whatever that might be, a pandemic, a cyber incident, a flood, a fire, a data center outage, data loss, data corruption, etc. And then try and work things out after the event. So a lot of organizations will wing it. And I've had numerous people over the years in business have been running ops and now for about 20 years had numerous people sit to me and say, yeah, Ro, this all sounds great what you do, but we've never had one of those. And to be honest, it doesn't really worry me that much. Then of course there are organizations that rather than wait for that to occur and take that risk, they would like to have a plan in place that they can test, they can rehearse and they can refine so that if one of these events ever does occur, they've actually got a pre planned mechanism, a pre built plan so they can respond with calm and confidence. So just as an example with that, if you have a flood in a building and so on, obviously you have to evacuate. The first thing that happens is the emergency responders arrive and put everybody out in the car park or the park across the road. And then if you don't have a plan, well, it's like, well, what do we do next? What are our most critical functions? What are our most critical people, what are our current deadlines, who do we need to do that, etc. Etc. And of course organizations can get by by just winging it and just working out at the time. But if you have a bcp, it'll tell you which people need to go and work from home, which might need to go to work from another office or another facility, what Are the priorities who might need to be stood down, how you might access your IT environments differently, etc. Which customers and shareholders and stakeholders do we need to inform and keep in the loop? So basically it gives them that sort of confidence and a pre built plan rather than, as I say, waiting until the, till the actual disaster strikes and then going into panic mode. Yeah.

So a side question, I mean you sort of reflected in what you just said why it is important, is there anything else, why organizations should really look at it more seriously. And then the other question, the supporting question is from what you've seen around Australasia and elsewhere, what's the percentage that organizations do something with bcp?

So you know, why is it important? People do it for different reasons, many different reasons. First of all, in many industries it's regulatory requirement. So if you're a bank, you're a finance company, you're under ASIC or APRA regulations, you have to have it. If you're a bank, you're a superannuation fund, you're a broker, you're investor, you're a funds manager, you haven't got a choice, you don't get a license unless you have a business continuity plan and you attest to the fact that it's tested, ongoing, people are trained, it's exercised and so on. If you're a supplier to those organizations as well. So a lot of our customers are actually suppliers to the banks and the finance organizations. And of course, if those banks and so on outsource part of their functions to a second tier, that second tier also has to have that. So why is it important? You can't do business without it. In many cases there are obviously directors, fiduciary duties to shareholders. So if you're a publicly listed company, absolutely critical. The ASX listing rules do make mention of best practice around business continuity and disaster recovery and risk management. They don't mandate, you must absolutely have it. However, as a director of a business, you're personally liable for impacts to shareholders and so on. So that's very important. And finally it just makes good sense. You know, why do people do it? Why is it important? A lot of people just want to, you know, be able to sleep at night knowing that there's a plan in place that is going to protect their business operations and their reputation. I've often said, you know, you can insure the physical assets of your business with an insurance policy. You can't insure your reputation and your name in the marketplace. And we see it every day, right? We see organizations Hitting the front page because of whatever reason, whatever's gone wrong, whatever crisis and so on.

Okay, so what are some of the vulnerabilities do businesses normally try to address?

So look, we typically start with an organization's risk register. An organization's risk register, if it's done properly, will look at a range of different risks. They'll look at strategic risks, operational risks, compliance risks, financial risks and so on. And what drops out of that is the operational risks are what the BCP really responds to. So anything around types of geographic threats, floods, extreme weather events, storms, hail IT incidents, IT outages, data center outages, cyber incidents, and sort of failure of suppliers and key critical third parties is also becoming increasingly importantly. Okay, excellent question.

Yeah, having who is responsible of a BCP in organizations and also supporting questions.

What are the first or initial steps

when you start to a BCP plan?

So who's responsible? It's a very good question. It's not completely consistent. It depends on the size of the organisation, the culture of the organisation. It can be the CEO in a small organization it's often the cfo, who generally is the person that has a seat at the audit and risk committee in a mid tier type organisation. So generally most listed companies will have an arc, an audit and risk committee and the CFO will sit on that. For larger organisations they might have a risk and compliance manager who would own business continuity. And in a lot of organizations, quite wrongly, it still owns business continuity because it's seen as a system thing. It's seen that it's all about systems, it's all just about it. In fact, it's not just about it, it is a component, but it's about keeping the business running, not just about keeping it running. So there's no one answer, I'm afraid, Sean. Everyone always asks that who is the owner? Again, it really comes down to the nature of the organization, the size the industry you're in and so on. We have some clients that have hundreds or dozens, like you know, the global banks. I think Citibank has two and a half thousand people in business continuity globally, you know, so, you know, teams of people in countries. We'll have some organizations that have absolutely nobody in BCP and we basically outsource that function for them.

Okay, and what are the main things to look at when planning your bcp?

So the way it basically works is that we need to understand what are the business functions and processes. So we typically start out with an organisation chart. It's as simple as that. We look across the organization, say Right, you've got all of the corporate functions, HR, finance, IT, legal, marketing, sales, etc. And then as I always put it, there's a pointy end to the business, which is the unique part. You might be running a prison, you might be running a marketing agency, you might be running a bank, you might be running a credit union, you might be running a hospital. So that's where it all differs. So all of those corporate functions are quite easily, everyone wants to get paid. So when you're talking to finance, one of the most critical functions and processes is payroll, financial reporting and budgeting and so on. Probably something that can wait in the event of a disaster. So all those corporate functions are relatively easy to define and look at the criticality of some of the other ones in some of the, as I say, the actual business operations area can be a bit more challenging. But what we do is we sit down with each of those groups and we basically paint scenarios and say, look, as simple as this, if it was an outage that caused you say, to be out of the building without systems, without people for 30 days, what are the impacts on your business functions and processes? What is most important right now? And people sort of often scratch their head and we say, well, look, imagine you're standing at the evacuation point, the muster point. What are you going to do right now if you've got to get your area of the business back up and running? And they'll say, okay, well, first of all, I need Mary and Jim from the accounts receivable area. And then in two days time, I'm going to need this person and I'm going to actually add on this. And then they're going to build the team back up over time. Because what you don't want to do with the business continuity plan is assume that everybody is available right from the minute of any sort of impact, because that can create absolute chaos. And the typical rule around the BCI and the DRI is that you're probably looking at about 30 to 35% of your normal complement of staff. So if you had 100 or 100 people in an organization and you have some sort of disaster, you're probably looking for the first few days of needing about 30 of those people, 25, 30 of those people to basically get your core operations back up and running.

Tell me, Rod, is there a confusion between BCP and disaster recovery?

Absolutely. There are a lot of areas to resilience and continuity management, not just BCP and drp. Emergency management is where it sort of starts. And that's the life safety piece, if we're going to start, roll back to that. So emergency management is, you know, where the fire is coming. If you've got some sort of physical incident, they evacuate everybody out of the building, they go through all the toilets and all the meeting rooms and so on and they get everybody out and they sweep the building. But that's where their responsibility basically ends. You know, once people are out of the building and it's safe, you know, emergency services don't really care whether your business survives or not. They've just done their bit. They predicted protected life safety. Then you've got things like, you know, kicking like crisis management, crisis communications and then of course you've got business continuity and disaster recovery. Now disaster recovery really focuses on technology, just terminology. It's still disaster, still business continuity. They all sound very similar, but sort of the one thing that the whole industry or the whole, you know, all the professionals have really agreed on is that, you know, we do agree that DRP is really around systems and technology and BCP is about the broader issues of business, the whole of business. So premises, suppliers, people, supply chain, etc. And business continuity tends to, if it's done properly, is not just about the recovery aspects post an incident, it's also about looking at preparedness and countermeasures and what can we do now to minimize the impacts of some of these things should they occur. So you might, as part of business continuity, not just say, well, if we have a disaster, these are the things that we need to recover. We should also be saying, what can we do now? Let's look at our insurance, let's remove that sole supplier of materials for a particular process, let's put better backups in place to improve our it, let's remove some key vertical risks and so on. So business continuity is really preparedness and response, whereas DRP is typically just a response mechanism.

Okay, so let's get to the crux of the discussion. How does BCP address the human element? So this is something that Shulem itself are really keen to understand how you go about it.

So look, a bcp, a good BCP isn't necessarily incident based and what I mean by that is it's not if we have a fire, if we have a flood, if we have, if we have a cyber attack, if we have whatever. Typically a BCP is based around what we call an all hazards approach. So we're looking at what resources are impacted and what BCPs typically do is they look at really best practices around four types of resources. We're looking at loss or impact to your premises. We're looking at loss of impact to your IT systems, loss of impact to your supply chain, which is obviously very critical because nearly every organization outsource is something these days. And loss or impact to your people. Now from a people perspective, people generally look at or BCPs generally look at large numbers of people. So they look at, you know, weather extremities affecting lots of people trying to get to their office and so on, or pandemics like at the moment and so on. But they don't generally look at individual people, as it were. So yeah, they do address the human element, but it's generally en masse, not individually and.

Yeah, just a question,

Sorry, go ahead

because I love you asking questions. Rod, you mentioned something about impact and it also relates to people, you know, would you agree? And it's also only my assumption that organization, when they plan, when they do that disaster recovery or the continuity plan, when they look at what, what could go wrong in organizations, do they calculate the impact only from first degree or they look at collateral impacts of organizations? Is this something that you discuss with them? What could go wrong? Not as a direct impact where it's very obvious, but also the non obvious. And your consultation basically point them to these areas where they can stop the snowball from growing.

Yeah, it's a really good point, Sean. I remember I went to a conference in the US and there was a gentleman there after Fukushima, Japanese gentleman. And we had an interpreter who was interpreting on his behalf and he gave a story about how an organization which was six levels down the supply chain basically brought the whole car industry.