Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
Good Morning….
My name is Greig Fennell and this session is about “Keeping BCP High on the Corporate Priority List”
….or as I call it “Selling Life Insurance in a Singles’ Bar”
I never bought life insurance until someone gave me a reason to buy…the same is true with BCP!
How many are new to BCP…less than one year?
Less than 5 years experience?
Less than 10 years experience?
+10 years?
Before we start….Here are a few things to remember…….
IF they dislike you…..heaven help you
I hate caller id
If I ran across a manager who was resisting I would use my favorite phrase…When was the last time IA did an audit at your location?
Some other things to remember…
Like my golf game…..
The end result is not the plan…it’s the planning that is important…We put this quote on the front page of our business continuity manuals….”If you are experiencing a disaster and reading this plan for the first time…it is too late! We will talk more about this…I am a firm believer in integrating BCP within what already exists within a company.  I do not know of any other way to have a successful sustainable program. This is important….you are a teacher and a mentor.   I had one manager call me a “bloody ghoul” after discussing a new business venture they were working on….I told him, no….I’m not a bloody ghoul….I’m your Guardian Angel!! The only thing you have to take away from this presentation are these 4 principles.  IF you apply these principle to your BCP program you will be way ahead of the game. 
We are going to look back in history a little bit…..my history!!
I’m going to use Levi Strauss & Co as a case study……...
I was director of BC at LS&Co for 8 years before starting my own consulting company in 1999
Prior to 1989 there was no formal business continuity program at Levi’s.  IT did have a DR program but there was some questions as to it’s capabilities. It was not until the Loma Prieta EQ that the “light bulb” went on within the company that Levi’s had a problem.  The buildings were not damaged, but the power was off and people were asked not to come to work.  The DR Team responded by chartering a jet and flew to Chicago to recover the data.  They were in the process of restoring the data when someone in San Francisco said, “Wait a minute…what good is data recovery….we have no place to access the data!  That is when Levi’s realized DR was not enough. IA, our friend, conducted an audit in 1990 and guess what they discovered…Levi Strauss had a business risk! In Jan 1991, the COO of Levi’s walked into my office and said, “There is this new job that you are going to apply for….called Director, Business Resumption”  I said, “What is Business Resumption?” That started my journey in “selling life insurance in a singles’ bar’.  I was given the responsibility of creating this department from scratch for the largest apparel manufacturer in the world.  The more I learned, the more questions I developed….the more I learned that this was not going to be easy….having a merchandising background I starting looking at how will I market this program within the company…what is the reason to buy? In 1994 we changed the name to Business Continuity….we wanted to be more proactive in our approach…how do we lessen the level of effort of recovery and resumption prior to the disaster occurring. 
From 1991 to 1998 we accomplished a lot.
Developed BCP and ERP for the world headquarters (2000 people), developed plans for 24 plants, 5 distribution centers and 3 finishing centers and 4 Regional Sales Offices in the USA.
We recommended the Data Center be moved from SF and it was moved to Texas.
We also developed plans in all of the following major locations around the world:
Although BCP was not an easy sell, we did learn how to market BCP within the company rather successfully.  We had a strong alliance with IA and Risk Management.  We became a viable force within the company and had the Senior Management's support.
In the USA…..
We trained 72 Departmental Business Continuity Coordinators…..responsible for developing and maintaining plans….part of job description….trained on the software program Levi used. Coordinated annual exercises on all time sensitive business processes and departments.  Exercises included voice, data and desktop recovery at an alternate location.  We had a 35 member EOC at SF….which was coordinated with regional offices and facility locations within the US and around the world.  SF did exercises quarterly…Sr Ex’s participated annually.
IA Policy
In Nov 98  front cover of CPM with article profiling the work done at Levi’s.
In Dec 98 received “Award of Excellence” from BRMA for our work at Levi’s.
During this time…2 full time people and no outside help. We had a very successful program and were benchmarked by other companies at the time. Then in March 1999 things began to change……major layoffs…eliminated BC coordinator roles In March 1999 the Director position was eliminated, the position reduced to a coordinator role whose focus was on the Business side of Y2K. In November 1999, the coordinator role was eliminated and the responsibilities absorbed by another position who had a full time job. Today…BCP does not exist and it is back to developing DR Plans for the Data Center in Texas.  So if the earthquake occurs in SF, I guess the question will be asked all over again…what good is DR without a place to access the data.
The COO, CFO, and CIO all retired within 1year of each other.  All the major mentors of BCP.
Company went into a financial tail spin….sales dropped from 7.2B to 4.2B
The new CEO and CFO came from outside the company.
The new CFO said my department was uniquely focused and did not contribute to the company’s bottom line. The CEO had bigger problems to deal with than BCP…concerned about financial survival of the company. The COO, who was from inside the company, felt BCP was a waste of time.  If he had his choice, he would get rid of the department…but did not want to make the recommendation incase something happened while he was COO!!  Goes to show, even the best of programs can fall victim and erode quickly.  If it happens to you, don’t take it personally…it is the nature of the beast.
BCP is like buying a washing machine, a vacuum cleaner, or a dishwasher.  It is not as glamorous as launching new products and services that increase sales and profits.  People do not understand the true value of BCP till the disaster occurs.
This is one of the problems of being in this position…you wish for disasters to occur…just little ones to get their attention.
One Sr. VP of Operations of a company in Wisconsin fought the idea of developing an Employee Call list.  He was totally against it and thought it a waste of time…until a tornado blew through Oshkosh, WI and they had to contact employees.
But, if you do not have an effective marketing program for your product…you will have a tough sell within your company.  Your company will give you all the reasons why not.
You have to find a way to sell something people don’t what to do…
Let’s look at some Golden Rules and Guiding Principles
Must have SR. MGMT support at the beginning…it is up to you to enhance the support
IN most cases, you can’t do the job…part time…depends on the size of the company
Here are some Golden Rules to follow:
How many of your companies have a SBP….How many of you have a BCP that aligns with the companies SBP?  We’ll talk about this in a minute.
BCP is everybody’s plan…not your plan.  You have to get everyone involved at some level within the company…enterprise wide plan.
This is the most effective way to bring realism and ownership to the planning process.
It is much easier to integrate BCP requirements to what already exists than to create a whole new process.  BCP must fit within the company’s culture and management style.  Find out what is missing and enhance what is there.
As soon as possible do an exercise….even if you do not have a plan in place yet.
EXAMPLE:  Evacuation exercise….now that everyone has evacuated from the building….what do you do next?
Understand the business…speak the language. 
The people you are dealing with know their business operations better than you will ever known them.  Rely on their expertise and judgments.  Take the time to see the business through their eyes, learn how they operate and think.  Knowledge is important and adds to your credibility.
Don’t make recommendations until you truly understand the dynamics of the business operations.  Do your homework...Once someone tried to convince a DC Manager that they need to develop a third party relationship so if something went wrong, they could immediately start shipping the next day from that third party….(9-11:  Chicken little on terrorism)
20/80 Rule
 What is the 20%  that covers 80% of the financial and reputational business impacts.  Most people already know what that these are within the company.
Play “Whack-a-Mole” with the rest
Keep it simple and flexible:
I sometimes think we in BCP make the planning process cumbersome and more complex than it needs to be.  Yes, there are complex issues than need to be dealt with but the planning does not have to be cumbersome.  I see too many manuals that are 6 inches thick and think…who reads that stuff.
Think about what you need, 20/80 RULE, and go no further….
Enhance current methods of dealing with issues.
Tell them what you want done..fill in the blanks
 Integrate as much as possible...Department Business Continuity Planners...You are a coach and mentor
Make it fun...MOD Squad t-shirt…recognition for going through the training...Company newsletter
Remember you are marketing a product
A company is comprised of many departments, business processes and people, all of which are aligned around the company’s strategic business plan and supports the company’s objectives.  The major responsibility of the company’s management team is to assure the continuation of the business by making a profit while providing cost effective services or products for their customers.  Survivability is based on being innovative, flexible and providing services or products that are valued by their customers. Business Continuity Planning must follow the same principles.  If you do not have agreement on what events could disrupt the business or you do not provide services that are valued by your customers, you will fail.  For Business Continuity Planning to be successful within a company, the Business Continuity Planner must have agreement on what could disrupt the business and then strategically align the business departments around accepted strategies for minimizing business disruptions.  You must develop a Strategic Business Plan for safe guarding the enterprise. This is accomplished through the BIA. Most companies have many departments that evaluate and mitigate risks within a company.  Some departments focus on the location where work is performed.  Other departments focus on the work done in the locations.  There are many departments within a company that provide a service of identifying, evaluating and planning for events that could significantly affect where and how work is done.  Most of these departments are “uniquely focused” on their own areas of expertise and seldom communicate with each other. A frustrated European Manager once blurting out to me, ”What is wrong with you, don’t you guys talk to each other?” after he was visited by Security, then Facilities, then Internal Audit, then Risk Management, and finally Business Continuity.  Each group came separately to evaluate the new Distribution Center being built and had basically asked him the same questions. That manger was right!  Most of these departments seldom talk to each other, they have their own agendas, and risk mitigation is not centrally planned within a company.  Rarely do these departments look at the same risks at the same time.  In today’s’ environment, looking at company risks in an independent and decentralized manner is ineffective and redundant.  This is where you can begin to add value by aligning key departments and individuals around company issues associated with BCP.  Your job is to ID issues and align departments...be a “foster parent”
Keeping BCP high on the RADAR screen is more about “how you do it”  verses “what you do”.  It is your job to establish the methodology and then guide the company through the process in an efficient and thoughtful manner.  If the process is perceived as being never ending, cumbersome or not value-added…you will loose credibility and people will not want to work with you.  Remember BCP is not a priority with them.  It is something that they were told to do. They do not think it is part of their job.  Your job is to add value.  The other thing to remember is that they know what is mission critical to the company or their department.  Also they know the implications if there is a problem…from their perspective.  What is almost never achieved is a “holistic” look at the problem, or from different people’s perspectives.  Your job is to organize key people around the potential business impacts, assess the implications and develop some strategies for decision by the management team.  The important element is getting management to make a decision…once the decision is made, it then becomes an action plan with individuals assigned.  The last thing you want is for the management team to not realize a potential problem. What is important is the process. By combining the company’s resource, risk mitigation efforts can become more efficient and BCP can become a stronger discipline within the company.  Key business issues can be identified and prioritized more proactively within the company. Risk mitigation solutions become a business decision based on a holistic view of the issue.  The more integrated the process for identifying and assessing potential risks to the business, the easier the decision by management.
When developing plans roles and responsibilities must be clearly understood by the people developing the plans.
SENIOR MANAGEMENT OF THE COMPANY:  They are responsible for the strategic decisions and developing guiding principles.  This direction comes from the recommendations of the BIA  and the LRA..  In some cases, the Senior Management may not go along with the recommendations….for a number of reasons.
In any case…what they decide becomes the responsibility of the company to execute.
MANAGEMENT TEAMS:  They are responsible for assuring the plans developed meet the expectations of the Sr. Management.  They approve the plans and provide plan oversight.
BUSINESS UNITS:  Responsible for developing the plans and the execution of the plans.  This group deals in the details of the planning process.
Keep meetings short and focused…walk in with an agenda.
What ever you do:  Respect these levels of management during plan development.  If you start taking the details of the planning to the SENIOR  MANAGEMENT then you will begin to loose credibility.  If they want to know the details…tell them…but only if they ask….On the other hand, you do not want the BU’s deciding strategic direction….
Initial Assessment Team:  Develop SBP for BCP (Facilities, Security, RM, Corp Comm,Voice, Data, BC
Risk mitigation strategies and contingency plans can be logically thought through when cross-functional teams identify and assess potential business disruptions.  It is important to include key suppliers, vendors and customers in this planning process.  A cross-functional team approach allows each area to give their perspective of what they feel are the issues and solutions to identified business disruptions.  In some cases, what one area feels is an issue, may be discounted by another department’s knowledge. NIKE LOGISTICS EXAMPLE:  An internal department team...trying to determine what events could cause potential business disruptions with producing and shipping products from Asia-Pacific to the United States and Europe….identified several potential supply chain disruptions…some of the disruptions were external to the company….invited key vendors and other service providers to join the team….vendors and services providers came with their own list of potential disruptions….As the cross-functional team discussed each of their issues, they realize that what they thought were significant problems were not problems at all, or could be easily mitigated…. they agreed on what the “real” business disruptions partnered in developing realistic plans. The team learned a valuable lesson.  teams need to include internal and external cross-functional expertise so the problem can be viewed from a variety of perspectives.  Including internal and external departments early in the process provides additional eyes.  Multiple perspectives enable the right business decisions to be made based on all the information.  The old say, “The more eyes the better,” again proved itself true. Generally, these people, along with internal departments like Internal Audit or Risk Management would not get involved until after the work was completed.  It was then that the “locusts” would swarm down and point out everything that was wrong.  Getting involved after the work is completed gave these departments the reputation of being a hindrance to the process rather than part of the solution.  By not being involved early in the process….could only tell people what not to do, rather than telling them what they could do. Using cross functional teams enables your company to effectively examine their interdependencies and enables the management team to make sound business decisions. The more integrated the process for identifying and assessing potential risks to the business, the easier the decision by management.  A cross-functional team can better define the business impacts, probabilities and costs. 
Your job is to facilitate the process
The teams identify the issues and develop the the solutions.  They own it…not you.
How can management argue with the recommendations from a team of cross-functional experts?
All companies have effective processes in place to manage the company’s day-to-day business. Integrate your program into the existing process. It is more beneficial to integrate a process than it is to convert over to another process at the time of the disaster.
Remember…if you do not do it every day…don’t expect it to work when you really need it…
Why do you want to do this???
Application Methodology….
New Business development….
Risk Assessment….
What will enhance your credibility and worth in the eyes of your Sr. Management team is your ability to understand the company, how if functions and pick the spots that will insure the integration of the principles of BCP within the company’s organization and management.
Your job is to be the Company’s Guardian Angel
Your value added to the company is not producing a plan, but integrating the principals of BCP within the company…. Change is constant…if you do not integrate within the company’s culture and management style …you are wasting your time.
Exercises validate the process you and the teams have created.
Exercises are where people learn…you rehearse, rehearse, rehearse….
Teams need to get comfortable with each other….builds trust…comfort levels…confidence with the process…the more you practice…the better you become. Start having exercises as soon as possible…. If you are not sure about a certain plan…have an exercise…as soon as the “call tree” is developed, have an exercise. Start with table tops and build toward simulations…build upon each prior exercise….try different scenarios…test the process for reacting to different disaster situations.
Include the technical and business people in developing and exercise.
Make it fun…it is a learning process…it is ok to make a mistake…it is ok to fail…that is why you exercise.
Set dates and stick with them…forces people to put their plans together.
Use other employees to help build the exercise.
Start your planning well ahead of the date
Immediately after the exercise….have a debrief  and lots of good food.  Recognize people for their efforts
You must add value.  The minute you stop adding value, is the minute your program begins to loose its support within the company.  It is like any product or service…are you going to buy something in which you don’t see any value.
Be a credible advocate of the principles of BCP within your company.  You are the “light house”…
You are teaching the business about how disasters affect the business so they can incorporate the leaning in how they do business.  Remember... There is no one way to develop BC plans within your company…there are many ways.  What works in one company, may not work in another company. Your job is to integrate  the principals of BCP within the culture of your company.
Integrate…what more can I say???
Facilitate the process…be the organizer…foster parent
Most of all make it fun for those involved