business continuity awareness week: the risks you can see ...€¦ · members celebrate during...

12
www.continuity.net.au For Members of Continuity Forum Pty Ltd Edition 27: March 2013 One thing that keeps the momentum roll- ing in our industry is continuous support. One way to keep a BCM programme alive is by having regular contact with others who have walked in your shoes. Once the Christmas trees are packed away and the New Years Eve fireworks have died down, it’s often business as usual again in the workplace. Not long after this festive season, there is an annual global event called Business Continuity Awareness Week (BCAW) just around the corner. To continue leveraging the hunger for awareness, time has been set aside in March to publicly address the local industry about the importance of a BCM programme. Within Australia and New Zealand, members of Continuity Forum and the Australasian Chapter of the Business Continuity Institute (BCI) will meet together for a schedule of events that will inspire organisations. Planning for this year’s BCAW schedule of events was a team initiative between Continuity Forum and the Australasian Chapter of the BCI. Before 2012 came to an end, coordination and planning commenced to deliver a program tied in with the 2013 theme: Business Continuity: for the risks you can see and the ones you can’t. Attendees will hear from presenters who are passionate about sharing real life experience. Speakers include representatives from various backgrounds, including representatives from the Banking/Financial services, Government, Emergency Services and Information Communications Technology sector. BCAW is the time to reach further into the marketplace and share knowledge and experience to promote best practice in business continuity and disaster recovery planning. Organisations can embark on this journey of driving awareness by initiating a BCM campaign at their workplace. This newsletter is part of Continuity Forum’s vehicle for involving the industry with BCAW. To become involved this year, organisations should attend the networking events being held between 18-21 March 2013 in the Brisbane, Canberra, Melbourne, Sydney, Auckland and Wellington. To support BCAW, sponsors will join the attendees for this special occasion. The proud sponsors this year are Deloitte in Sydney and Melbourne and PwC in Canberra. Organisations that also support BCAW this year include Air New Zealand from Auckland, Wellington Region Emergency Management Office (WREMO) in Wellington and Origin Energy in Brisbane. Business Continuity Awareness Week: the risks you can see and the ones you can’t By Agnes Manlutac, Member Services Officer, Continuity Forum Pty Ltd Australia’s only Business Continuity publication Business Continuity Awareness Week 2013 Raising business continuity management awareness is an increasing effort throughout our local community of professional Business Continuity Management practitioners. Over the years, organisations have continuously developed, adopted and delivered Business Continuity Management (BCM) programmes to prevent or reduce business disruptions.

Upload: others

Post on 26-Jul-2020

7 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

www.cont inui ty.net.au

For Members of Continuity Forum Pty Ltd Edition 27: March 2013

One thing that keeps the momentum roll-ing in our industry is continuous support. One way to keep a BCM programme alive is by having regular contact with others who have walked in your shoes.

Once the Christmas trees are packed away and the New Years Eve fireworks have died down, it’s often business as usual again in the workplace. Not long after this festive season, there is an annual global event called Business Continuity Awareness Week (BCAW) just around the corner.

To continue leveraging the hunger for awareness, time has been set aside in March to publicly address the local industry about the importance of a BCM programme. Within Australia and New Zealand, members of Continuity Forum and the Australasian Chapter of the Business Continuity Institute (BCI) will meet together for a schedule of events that will inspire organisations.

Planning for this year’s BCAW schedule of events was a team initiative between Continuity Forum and the

Australasian Chapter of the BCI. Before 2012 came to an end, coordination and planning commenced to deliver a program tied in with the 2013 theme: Business Continuity: for the risks you can see and the ones you can’t.

Attendees will hear from presenters who are passionate about sharing real life experience. Speakers include representatives from various backgrounds, including representatives from the Banking/Financial services, Government, Emergency Services and Information Communications Technology sector.

BCAW is the time to reach further into the marketplace and share knowledge and experience to promote best practice in business continuity and disaster recovery planning. Organisations can embark on this journey of driving awareness by initiating a BCM campaign at their workplace.

This newsletter is part of Continuity Forum’s vehicle for involving the industry with BCAW.

To become involved this year,

organisations should attend the networking events being held between 18-21 March 2013 in the Brisbane, Canberra, Melbourne, Sydney, Auckland and Wellington.

To support BCAW, sponsors will join the attendees for this special occasion. The proud sponsors this year are Deloitte in Sydney and Melbourne and PwC in Canberra. Organisations that also support BCAW this year include Air New Zealand from Auckland, Wellington Region Emergency Management Office (WREMO) in Wellington and Origin Energy in Brisbane.

Business Continuity Awareness Week: the risks you can see and the ones you can’tBy Agnes Manlutac, Member Services Officer, Continuity Forum Pty Ltd

Australia’s only Business Continuity publication

Business Continuity Awareness Week 2013

Raising business continuity management awareness is an increasing effort throughout our local community of professional Business Continuity Management practitioners. Over the years, organisations have continuously developed, adopted and delivered Business Continuity Management (BCM) programmes to prevent or reduce business disruptions.

Page 2: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

“Sharing knowledge, experience and promoting best practice in business continuity and disaster recovery planning”

2

Continuity Forum News is a quarterly newsletter for the member organisations of Continuity Forum Pty Ltd.

Continuity Forum is an active network of organisations that share an interest in seeing their business continuity and disaster recovery plans are resilient and continually reviewed.

Manager Linda Nguyen

Members Services Officer Agnes Manlutac (Editor)

Membership & Sponsorship Officer Jackie McKenzie

Adminstration Officer Kristine Nuñez

Finance Officer Laila Kabani

New Zealand Representative David Thompson

New Zealand Committee: David Thompson (Chair), Brian Potter, David Dunsheath

Australian Committee: Agnes Manlutac (Chair), Greg Saphin, Greg Bolton, Greg Hill, Saul Midler

Suggestions for contributions: [email protected]

Advertising enquiries: [email protected]

Membership and event enquiries: [email protected]

NZ general enquiries: [email protected]

Continuity Forum Pty Ltd ABN: 66 110 423 268 PO Box 810, ARTARMON NSW 1570 Australia

Ph: +61 (0)2 9415 4180 Fax: +61 (0)2 9411 8585 www.continuity.net.au

ISSN 1833-301X

Dear Members,

Welcome to the first edition of Continuity Forum News for 2013.

Coming up in the next few months members will receive information about our major conference in Sydney – the Australasian Business Continuity Summit, 4-6 June 2013 - held in partnership with the Australasian Chapter of the Business Continuity Institute. The brochure is now available and registrations are being accepted through the conference website (www.bcsummit.com.au). As always, we look forward to see-ing many of you there over the course of the three days.

With Business Continuity Awareness Week (BCAW) coming up this month from 18-22 March, we encourage our members to once again participate in raising BCM awareness by inviting their staff and colleagues to our free BCAW events right across Australia and New Zealand. Our website contains detailed information about the speakers and and our Australian sponsors, Deloitte and PwC. Because this edition of CF News is in support of BCAW we thank our contributors from the Emergency Services Telecommunications Authority, Business Aspect and RiskLogic, for their input to this important occasion.

We are pleased to be working more closely with our Advisory Committees in New Zealand and Australia. Further updates are on page four of this newsletter. Please turn there to read about plans for our upcoming professional development sessions in NZ. You will also find our first Australian Committee update in this section from the Chair, Agnes Manlutac.

As you may know, our newest team member Jackie McKenzie has taken the role of Membership & Sponsorship Officer (previously held by Ashleigh Scott). We thank Ashleigh for her work with Continuity Forum over the past 10 months and look for-ward to introducing Jackie to our members throughout the year.

Our final thoughts are with those who were impacted by the catastrophic bushfire and flood emergencies during January in Brisbane, Canberra, Melbourne and Sydney. Continuity Forum is mindful of the work that is continuing with the recovery and we do hope to speak to our members in greater detail about these emergencies later in the year.

Kind regards,

Linda Nguyen Agnes ManlutacManager Member Services Officer/EditorContinuity Forum Pty Ltd Continuity Forum Pty [email protected] [email protected]

In this editionMembers continue their support through tough times page 3NZ & Australian Advisory Committee Corner page 4Member Profile: PHIAC page 5Maintain business continuity momentum page 6Keeping the lights on business continuity page 8 The BCM cultural shift page 10Better preparing NZ to get through an earthquake page 11Six tips for Business Continuity Awareness Week page 12

Page 3: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

w w w . c o n t i n u i t y . n e t . a u

3

Members celebrate during Continuity Forum’s end of year Christmas event

Last December, over 100 members attended Continuity Forum’s annual Christmas Drinks Meeting in Sydney, Melbourne, Canberra, Brisbane and New Zealand. It was a time of celebrating and reflecting on 2012.

Continuity Forum thanks the host venues that assisted: Business Aspect Pty Ltd, CSC Australia, PricewaterhouseCoopers and Statistics New Zealand, and the speakers who presented from the Department of Human Services, Ministry of Civil Defence & Emergency Management, Nine Entertainment Company and Vision Super Pty Ltd. Presentations are avail-able online for members to download from www.continuity.net.au.

Howard Kenny, Nine Entertainment Company (left) and Andy Tapp, Mitigator (right)

Below - Sydney members (left to right): Arthur Lee from Allianz, Grant Davis from

Deloitte and Zoe Moulton from PwCRod Crowder, OpsCentre (left) and Ashleigh Scott, Continuity Forum (right)

Members continue their support through tough timesDespite economic uncertainty and downsizing of many organisations, the members of Continuity Forum continue to share knowledge and experience in support of each other. Involvement with speaking and hosting events has grown with more members volunteering to speak at Member Meetings.

During January 2012-February 2013, Continuity Forum selected 15 speakers to conduct thought-provoking and honest presentations. Several of these speakers had never before presented to a group

outside of their workplace and found the opportunity worthwhile. The presenters represented small-large businesses such as Air NZ, ANZ, Australian Bureau of Statistics, Defence Materiel Organisation, Department of Human Services, IP Australia, Melbourne City Council, Royal Bank of Scotland, Sydney Opera House, Telstra, Vision Super and Westpac. Popular topics were Business Impact Analysis, 2011 Brisbane floods, organisational resilience, supply chain and business continuity, testing and

exercising business continuity plans and lessons from the 2010-2011 Christchurch earthquakes.

Throughout this period, nine members also volunteered to host a meeting in their office for the first time.

In spite of challenges within the global economy, continued support indicates that connecting business continuity managers remains a priority in Continuity Forum’s network.

Disaster Response, Emergency Management and Public Safety Conferences and Expo 2012Continuity Forum endorsed the Disaster Response, Emergency Management and Public Safety Expo (DEP Expo) that took place in the Gold Coast on 22 and 23 October 2012.

The DEP Expo included the Organisational Resilience Conference, the 2nd Annual Emergency Response and Management Conference, plus an exhibition and brought together about 300 people who are involved in the prevention, management and recovery of major disruptions ranging from technical glitches to natural disasters and acts of terrorism.

The conference program showcased over 30 local and international speakers from the Sydney Opera House, Westpac, Queensland Urban Utilities, Sydney Water and the Department of Transport Victoria. Some of the issues that were covered included response & resilience, business continuity, crisis management & leadership, social media and much more.

Continuity Forum was pleased to have been involved with this successful event as an endorser. The large number of attendees across the two days included Continuity Forum Manager, Linda Nguyen and Continuity Forum members predominantly from Queensland.

Page 4: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

“Sharing knowledge, experience and promoting best practice in business continuity and disaster recovery planning”

4

Well 2013 is underway and we here at Continuity Forum in NZ have got some interesting things in store for our members this year.

Firstly though as we start this year I would like to issue a challenge to you all.

For some of us, business continuity is an all-consuming passion and for others it is a career or profession. For many though, business continuity is a task often among many tasks that have been assigned.

Business continuity is a young discipline and as such is still developing knowledge, practices, skills and standards. Therefore the challenge is for us to keep our own knowledge and skills up to date. This of course is not always easy but always worth the effort.

Upcoming professional development sessionsContinuity Forum is preparing to launch a series of professional devel-opment sessions. These short but concentrated sessions will seek to de-liver knowledge and practical skills to those interested in improving their abil-ity in the practice of BCM.

We will be polling our NZ members soon as to what topics they wish to see presented in these sessions.

2012-2013 activitiesOur most recent conference “Business Continuity: Plan to Succeed” was held on 28 November 2012. We had brilliant speakers and overall attendees rated the confer-ence an “8 out of 10”.

With Business Continuity Awareness Week coming up, we are working with our colleagues in the BCI to bring this important event to New Zealand. The BCI team

will be leading the charge this year supported by us at Continuity Forum.

Stop Press – new Standard releasedThe International Standards Organisation (ISO) released in late 2012 their companion guide to ISO22301. ISO 22313:2012 - Societal security - Business continuity management systems - Guidance is now available from ISO. Continuity Forum has a bulk pur-chase arrangement with Standards New Zealand and members can let us know if they are interested in pur-chasing this standard.

With the installation of our Australian Advisory Committee, I am pleased to collaborate with colleagues from the ACT, NSW, QLD and VIC for leadership in setting our member events and newsletter.

The committee was established in August 2012 and I’m confident that our members will benefit from our newly established team.

Our representatives are:• Saul Midler, Managing

Director, Linus Information Security Solutions (VIC)

• Greg Hill, Project Officer, NSW Rural Fire Service (NSW)

• Greg Bolton, Business

Resilience Manager, Queensland Rail (QLD)

• Greg Saphin, Director of Business Continuity, Department of Immigration and Citizenship (ACT)

We wish to thank Amardeep Singh, Business Continuity Consultant, CSC, for his assistance during August-December 2012 as our ACT representative.

During the beginning of 2013 the committee discussed ideas to improve the direction of Continuity Forum News. We look forward to updating our members soon with more developments.

To contact our Advisory Committee please email [email protected]. Your feedback about our past events or newsletters is most welcome.

New Zealand Committee Corner: News From the NZ Advisory Committee

Australian Committee Corner: News From the Australian Advisory Committee

David Thompson (Chair)

Agnes Manlutac (Chair)

Page 5: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

w w w . c o n t i n u i t y . n e t . a u

5

Member profile: PHIAC - Crisis management and business continuityThe Private Health Insurance Administration Council (PHIAC) is a small regulatory agency that plays a big role in ensuring the private health insur-ance industry remains competitive, effi-cient and financially sound.

PHIAC is governed by a board that is supported in the discharge of their legislated functions by 33 staff located in Barton, ACT.

PHIAC has established an enterprise-wide risk management framework that manages enterprise-wide risks in three different categories:

• Strategic• Industry• CorporateCrisis management and business

continuity is one of 14 corporate risks, receiving appropriate priority within the organisation due to its inclusion as an enterprise level risk.

To control crisis management and business continuity, PHIAC has established a crisis management framework that incorporates the following.

Emergency responsePHIAC has established emergency re-sponse guidelines that are designed to provide staff with response actions and key contacts for a range of crisis events that may occur in the PHIAC of-fice environment.

Business continuityBusiness impact assessments have been conducted for all critical business objectives to identify the business pro-cesses behind each objective, under-stand which resources enable those processes and develop business conti-nuity plans for the times when those re-sources are not available.

Disaster recoveryPHIAC has established disaster recov-ery plans for each enabling resource to facilitate recovery of a resource following

the loss of its availability. These enabling resources are:

• People• Property• IT• Records

Risk management and corporate services teamPHIAC has allocated responsibility for control of the crisis management and business continuity risk to the Director of the Risk Management and Corporate Services.

The Director, together with the Risk Management and Corporate Compliance Officer implement a range of activities to achieve control of this risk. This includes:• Developing, maintaining and testing

the emergency response guidelines• Completing business impact assess-

ments for critical business objectives• Developing and testing business

continuity plans for critical business objectives

• Developing and testing disaster re-covery plans

• Completing the risk assessment of the crisis management and business continuity risk and implementing the required controls

• Reporting on control of the cri-sis management and business continuity risk to the Board, Audit and Compliance Committee, and Executive.

Private Health InsuranceAdministration Council

Miles Pearson (left) and Dick Courtney (right) implementing crisis management in PHIAC

PHIAC's Crisis Management Framework

Disaster Recovery

Business Continuity

Emergency Response

Crisis Management

Page 6: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 20136

Like a pendulum, organisational awareness of risks to the continuity of business needs to be pushed often - it gains momentum during and immediately following a major disaster or other significant event. During times of stability, however business continuity momentum is often lost.Continuity plans become out dated – contact details change, contingencies don’t get updated to account for new business processes, version control is lost. Technologists become complacent - backups often fail, documentation be-comes out dated and that spare laptop in the corner has been used for the new starter in accounting.

All of these situations are more than like-ly to lead to a failure to recover from a di-saster in a timely manner, no matter how much time and effort has initially been put into the development of a plan or re-dundant systems and processes.

So how do we keep the momentum go-ing so that staff maintain an awareness and understanding of their role and re-sponsibilities in a disaster situation? Some approaches to consider include the following.

Training and awareness programs• Without formal training or previ-

ous experience, most people in an organisation will not understand what business continuity involves, or will see it as an IT problem. Some funda-mental training “Business Continuity 101” should be considered for all staff – Lunch ‘n Learn sessions are a great way of encouraging staff to attend.

• Consider integrating business con-tinuity into regular emergency man-agement, information security or other cyclic training and awareness programs.

• Run Business Continuity Awareness Week (BCAW) activities and make use of BCAW marketing material with-in your organisation. Some ideas in-clude competitions, distribution of fact sheets on previous disasters and sta-tistics and case studies.

• Join organisations, such as the Continuity Forum and Business Continuity Institute (BCI) and distrib-ute awareness material.

Regular business continuity exercisesImplement a schedule of regular test-ing of the plan/s and ensure all staff who may potentially play a role in the recov-ery attend at least annually. Make use of interesting scenarios to gain and hold the interest of the team.

Integration with other processes• Ensure business continuity impacts

are considered throughout the risk management process. Risks and im-pacts to the continuity of business should be assessed throughout the lifecycle of the organisation.

• Change management methodologies should incorporate an assessment of business continuity impacts e.g. changing an ICT system or moving fa-cilities may have significant impacts on the ability to respond or recover from a disaster.

• Project management methodologies should ensure risks to continuity are

Maintain business continuity momentumBy Robyn Bailey, Risk & Continuity Consultant, Business Aspect Pty Ltd

“Sharing knowledge, experience and promoting best practice in business continuity and disaster recovery planning”

Page 7: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

w w w . c o n t i n u i t y . n e t . a u

7

identified as early in the lifecycle of a project as possible, and treated ac-cordingly throughout. The project team, usually made up of team mem-bers from many disciplines (IT, admin, finance, HR etc) will also gain a good understanding of business continuity through the project and may champi-on or advocate to their peers.

Ensure executive accountabilityEnsure that business continuity risks are an agenda item within your organisa-tion’s Audit / Risk Committee and pro-vide regular reporting to these forums and executives.

Move staff around or take them offline for a periodOver reliance on human resources is a common risk to business resilience. Many organisations rely on individuals to perform a function, which is often undocumented. This is especially common, and highly vulnerable in IT support and recovery processes.

Consider a program of documentation review and testing to determine if the documentation is current. Regardless of the approach taken the key is to ensure it’s cyclic. A one-off awareness session or program will tend to gather momentum and interest amongst staff only for the short term. Interest will soon be lost if the

pendulum isn’t regularly pushed. For organisations that have not implemented a cyclic program, it is often prudent to start with the basics which can then be further refined over multiple awareness cycles to meet the specific needs of the organisation. The opportunity and intent to improve is another benefit of having a cyclic program.

“A one-off awareness session

or program will tend to gather

momentum and interest amongst

staff only for the short term...

interest will be soon lost if the

pendulum isn’t pushed often”

Maintain business continuity momentumBy Robyn Bailey, Risk & Continuity Consultant, Business Aspect Pty Ltd

Page 8: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

“Sharing knowledge, experience and promoting best practice in business continuity and disaster recovery planning”

8

Keeping the lights on business continuity - raising the BCM awareness of dispersed field and office staff at AusgridIn 2011 Ausgrid developed and deployed an e-learning BCM awareness program for its critical process staff. The program was highly successful and continues to be completed by staff members who come into a role in a critical process. More than 1000 staff have completed it to date. The program was a finalist in the AITD National Training Excellence Awards.

Ausgrid is a NSW State Owned Corporation distributing power to an area of 22,275 square kilometres including Sydney, Central Coast and the Hunter. It is a 24/7 operation with about 6000 of-fice and field based staff, a Sydney CBD head office, a major administration cen-tre at Wallsend (Newcastle) and about 50 suburban and regional depots, offices and training centres.

Ausgrid has over 100 critical processes and an annual BCM program

1. Build in flexibilityThe learning program needed to be de-livered to individuals at their desks but also to team meetings of field staff. Most office staff members have access to a PC and could access the program on the Ausgrid e-learning platform. For the others Ausgrid developed and delivered the program in a workshop style as part of regular team briefing meetings. The content works equally well in individual learning or facilitator led group briefings.

including extensive review and recovery test programs.

Ausgrid Business Continuity Awareness e-learning programHere are some of the key success fac-tors for development and deployment of the e-learning program.

Page 9: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

w w w . c o n t i n u i t y . n e t . a u

Keeping the lights on business continuity - raising the BCM awareness of dispersed field and office staff at Ausgrid

2. Keep the learning design simpleIn the early stages, Ausgrid discussed using multiple incident scenarios but eventually settled on using a single sce-nario with visuals tailored to separate-ly suit an office based audience or a field based one. Ausgrid first wanted to do a range of BCM scenarios, but re-alised it introduced complexity that really wouldn’t add value to the learners.

3. Use the real language of the businessThere is a lot of precise technical jar-gon in the electricity business and it was a challenge to make sure that the cor-rect terms were used while developing a script that was engaging and communi-cated well.

4. Use familiar faces and scenesThe photos used for the e-learning pro-gram were of staff at an Ausgrid depot. A shot list was created and volunteers found to be photographed as the main characters in our scenario. Ausgrid used a scheduled emergency evacuation drill and photographed the staff evacuating the building. The scenario tells the story of staff members who are at work when the incident happens and the actions taken by themselves, their supervisors and co-workers who are off shift or off site at the time.

5. Beta test the programThe designers came up with an “electri-cal” style to the overall look and feel, us-ing a power grid style design which added to its appeal. Then, when the beta version of the program was delivered, Ausgrid conducted some trials with admin staff and field staff. Having real learners watch it was helpful in finding elements where more explanation was needed, transitions improved, and words improved to en-hance meaning.

6. Tightly manage the projectIt required a precise production sched-ule and an internal project manager. The project manager had a background in e-learning. Getting everyone involved to re-view and comment in a timely fashion was challenging but achieved through regular project control meetings and deadlines.

There was a window of only six weeks for the initial group of 800 critical process staff members to complete the e-learning program once it was launched. Ausgrid generated a report each fortnight on completions and reported them to the appropriate steering committee so individual learners could be reminded to complete the program.

7. Review and update the programFollowing the initial group of learners do-ing the program, Ausgrid conducted a

survey and produced an updated version based on user feedback. Ausgrid updated it to include some additional music, auto-mate some transitions, and add a bit more narration. We also changed a few screens to require completion of elements that had originally been optional readings.

ResultThe program’s ongoing availability on the internal e-learning platform makes it a very easy way to give newcomers a sound in-troduction to the Ausgrid BCM approach. Participation in completing the program has led to a significantly increased aware-ness of BCM across the organisation.

This article is adapted from a paper presented by Graham Nisbet MBCI, during the Australasian Business Continuity Summit 2012.

Continuity Forum News March 2013 9

Page 10: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

“Sharing knowledge, experience and promoting best practice in business continuity and disaster recovery planning”

10

The business continuity management cultural shiftSo you have landed that BCM role you have been looking for and are ready to tackle the tasks ahead. It may not be all good news however…

Perhaps your predecessor left a program that was incomplete and fraying at the edges. Perhaps the management team needs revitalising on the business value of BCM. The early gains of BCM can look promising, but closer examination may reveal “a meeting of compliance” approach by the organisation. What you are really looking for is that elusive “cultural shift” – the organisation that understands the value of BCM and the link between BCM, its objectives and business directions.

Here are five practical tips to help with that cultural shift.

1. The one organisation approachTo begin with try to get the structure right. I believe it is invaluable to link Risk Management and BCM, both structurally and within process. Not just because the BCM program can gain leverage from within the Risk Management framework, but also because it is logical and appropriate to keep them linked. Many of the risk controls and treatments on the risk register rely on BCM activities to mitigate those risks. In addition, many gaps within the BCM program bubble up and become risks on the register themselves.

Let me go even further - Disaster Recovery is part of BCM which in turn is a part of overall risk management – that is the natural linkage. The Board of Directors and the management teams are switched onto risk management so leverage your BC actions from within that to get more success.

2. Focus the engagementSometimes the task ahead looms large and difficult. It is imper-ative to focus only on key functions or critical parts of the busi-nesses. Leverage from the successes there and apply them to others. Don’t worry about “blockers”, just work around them.

Be mindful also of the organisational culture because expectations can vary. For example, a small organisation in a high growth mode may have a different approach BCM to another organisation which is “market mature” and focusing on protecting a shrinking market share.

3. The simple message“Everything should be made as simple as possible, but not simpler” – Albert Einstein

When it’s your turn to push the BC program through, consid-er your audience and do away with the detailed, flashy power-point deck. Be clear, honest and concise. Provide solutions not problems. Also don’t even dream of attempting to win the BCM strategy lower down in your organisation until it is clearly won at the executive level. No amount of work done lower down in the organisation can succeed without that clear direction from the top.

4. BCM – continuous improvementIt is important to ensure that your BCM program is on a contin-uous improvement path. For a start get the language right. It is more credible within the organisation to have uniform terminol-ogy e.g. exercise not “test”; event not “disaster”; recovery not “restoration”; maximum acceptable outage not “Recovery Time Objective”; contingency not “workaround”.

Step away from those never ending spreadsheets into a central BCM system which is hosted in the cloud. Skill your BC champions and focus them on self-service. Remember the BC plans are owned by the business.

You can also establish and monitor an improvement measurement tool for the BCM program. Then assess your current business continuity maturity quarterly and set targets for improvement over the short/long term.

5. Regular exercisingFinally, I believe that business continuity exercising is one of the best avenues to BCM exposure. The Business Continuity Awareness Week campaign running this month provides a per-fect opportunity to conduct an important exercise within your organisation to raise awareness. Large and comprehensive exercises can be difficult to organise and conduct. Also these are likely to be held infrequently. It may be beneficial to run regular, small and focused exercises as this keeps BCM on the radar frequently.

By Peter Budd, Manager, Risk & Business Continuity for ESTA000 - Emergency Services

Telecommunications Authority

Page 11: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Continuity Forum News March 2013

w w w . c o n t i n u i t y . n e t . a u

11

When New Zealand staged its largest ever earthquake preparedness campaign, New Zealand ShakeOut, more than 1.3 million people participated. The campaign aimed to help people in New Zealand better pre-pare themselves for a large earthquake and culminated with a nationwide Drop, Cover and Hold earthquake drill, which was held at 9:26am on Wednesday 26 September 2012 (9:26-26:9).

Approximately thirty percent of the country’s population, participated in the drill (see table below).

Category ParticipantsIndividuals/Families 20,492Pre-schools 108,936Schools 650,962Youth Organisations 1,345Tertiary Education 134,140Iwi 384Government Agencies 72,497Local Authorities 28,623Emergency Services 17,510Businesses 203,570Health & Disability Sector 59,220Non-Government Agencies 14,961Volunteer/Service Clubs 1,440Animal Shelter/Service Providers 274Agriculture/Livestock 311Science/Eng Organisations 5,234Media Organisations 2,103Community Groups 9,378Other 8,800TOTAL 1,340,180

Drop, Cover and HoldFollowing the devastating earthquakes in Canterbury in 2010 and 2011, all New Zealanders

became very aware of the impacts large ear thquakes can have. New Zealand ShakeOut built on this awareness and encouraged people to take actions to prepare themselves for future earthquakes. Although there is a variation in the level of earthquake activity across the country, a large earthquake could happen anywhere in New Zealand, and everyone needs to know what to do should one occur.

One of the main objectives of the campaign was to have people throughout New Zealand understand the right actions to take in an earthquake - Drop, Cover and Hold. The six month campaign focussed very much on communicating this right action and the importance of practising this in the nationwide earthquake drill. The drill was the focal point of the campaign as it was a clear and simple action that people could take to prepare themselves for an earthquake.

Participation at an organisational levelThe ShakeOut was not just about the earth-quake drill. People were encouraged to look closer at their preparedness and as a result many businesses and organisations devel-oped, reviewed or tested their emergency plans, and families wrote and/or tested their household emergency plans.

New Plymouth District CouncilAll 500 staff of New Plymouth District Council actively participated in New Zealand ShakeOut activities. As well as participat-ing in the earthquake drill at 9:26am on 26 September, the council took the opportunity

to test their newly developed emer-gency management and business continuity plans. An earthquake exercise was developed to test

the plans, and working through this led to raised awareness of the

need to be prepared for emergencies and greater confidence that the Council had a good set of plans to respond to emer-gency events. The district council is now working on incorporating recommendations into their plans.

New Plymouth District Council staff test their emergency management and business continuity plans for NZ ShakeOut (courtesy of Kestrel Group)

Te Aroha HospitalTe Aroha Community Hospital got fully on board with New Zealand ShakeOut and con-ducted a 24-hour exercise, which included shutting off the power and water supplies. The purpose of the exercise was to test the hospital’s emergency plan and to figure out if what they had in the plan was realistic. The exercise spanned three shifts and in-cluded both staff and hospital residents. Staff practised using alternative lighting, cooling and heating sources. The exercise achieved its purpose and as a result their plans will be updated and more robust.

Better preparing New Zealanders to get through an earthquake By Anita Komen, Emergency Management

Advisor, Ministry of Civil Defence & Emergency Management

Page 12: Business Continuity Awareness Week: the risks you can see ...€¦ · Members celebrate during Continuity Forum’s end of year Christmas event Last December, over 100 members attended

Executives such as the CEO can harness the im-portance of BCM through existing communication tools. For instance, the CEO may wish to add some supporting words in their weekly or monthly blogs regarding BCAW. It’s an opportunity for senior ex-ecutives to be another mouth piece for your BCM program. Make sure to involve senior executives with your planning, as it can be a helpful way to re-mind them that BCM is an active and lively practice that should be part of the organisation’s priorities.

5. How can the senior executives become involved

with raising BCM awareness?

I don’t think it’s so much about the size of your organisation that matters. It actually comes down to the culture of your organisation and the tools available to communicate to staff. You should think about how people normally respond to messages and what message you are putting across. For instance, how can you create greater value from staff and what is it about your BCM program that you want others to know about? If your BCM program has some gaps, your message to staff during BCAW should demonstrate proactive measures for filling the gaps. If not thought of well in advance, this can be quite negative and can open up criticism. Updates via your intranet, social media and awareness events are great ways to involve staff from all levels of the business. I would also recommend people speak to other contacts in their industry throughout the year.

4. Is there a one-size-fits-all approach for organisations?

Six tips for Business Continuity Awareness WeekIn the lead up to Business Continuity Awareness Week (BCAW), Continuity Forum wanted to find out the best way to develop an awareness campaign for business continuity management. For some insight and tips, Agnes Manlutac spoke to Jodie Wentworth from RiskLogic.

A lack of planning and time management can cause some problems if you are about to run an aware-ness campaign for your BCM program. If plan-ning and communication is last minute, this can work against you. As a BC practitioner, you need to prepare yourself for receiving more queries and preparation can become time consuming as well. You should engage with different people from your organisation to strengthen the message you are put-ting across. Ultimately, if your BCM program isn’t up to scratch, it could possibly prompt people to scrutinise your program or your intentions.

3. Are there cons that BC managers and coordinators might face?

BCAW is very much about bringing business continuity back into the forefront of everybody’s minds. It’s an opportunity to flag your BCM program within your organisation and BCAW is a good time to refresh your staff about the importance of your BCM program. BCAW is also beneficial for acknowledging that BCM is a professional practice and a mature process in the industry.

1. What are your thoughts with BCAW coming up in March this year?

If the response to your campaign is low it could mean that people haven’t seen the campaign. You want to make sure that people provide the right feedback. Be prepared for any challenges if you receive cynical comments. But ultimately a successful campaign shows that your engage-ment continues beyond BCAW week.

6. How do you know if your awareness campaign has failed?

Your awareness campaign can be a useful tool to reach the masses in your workplace. BCAW is a good way for business continuity managers to communicate to their entire organisation about the benefits of having a robust BCM program. It can be used creatively to drive staff awareness and staff will appreciate that their organisation cares for them and their organisation. An awareness campaign can also be useful if your organisation has recently gone through a disruption.

2. What are the pros of running an awareness

campaign in the workplace?