Managing To Measure & Measuring To Manage Christopher Green FBCI
Today’s Session - Why Measure? What to measure? BIA Plan Development Testing BC Program
Why Measure?
Future Events?
What to Measure? • Plans ? • BIA ? • Callout ? • Exercises? • Crisis Capability ? • Whole Program ? • Reputation ?
BCM Lifecycle
Risk Heatmap PROBABILITY
7
2
6 1
10
4
3
9 8
5
SEVERITY
The Financial Cost 300 250
200
Loss of Income
150
Extra Expenses
100 Opportunity Costs
50 0 Day 1
Day 3
Week 1
The Financial Cost
+
=
The Operational Cost
Critical Operations?
What’s The HARM – 1? LEVEL OF HARM
NATURE OF HARM Financial Loss (loss of sales, unforeseen costs, legal liabilities, fraud)
Degraded performance (failure to achieve targets, loss of productivity)
A
B
C
D
E
RELEVANT MEASURE
Extremely serious harm
Very serious harm
Serious harm
Minor harm
No significant harm
Total financial impact:
Over £10m
£1m to £9.9m
£100k to £1m
£10k to £99k
Under £10k
Key targets underachieved by:
Over 10%
6% to 10%
1% to 5%
Less than 1%
No Impact
Number of staff hours wasted
Over 10,000 Staff hours.
1001 to 10,000 Staff hours
501 to 1000 Staff hours
100 to 500 staff hours
0 to 100 staff hours
What’s The HARM – 2? LEVEL OF HARM
NATURE OF HARM
RELEVANT MEASURE
Performance Loss (Customers)
Customers not Served:
Reputation Loss
Bad Publicity in:
A
B
C
Extremely serious harm
Very serious harm
Serious harm
More than 20%
12-20%
National and international media
National media, inside pages
10-12%
Local media, front
D
E
Minor harm
No significant harm
5-10%
<5%
Local media, restricted
No coverage
What’s The HARM – 3? LEVEL OF HARM
Total HARM
A (*20)
B (*5)
C (*3)
D (*2)
E (*1)
Location 5
113
4
4
2
2
3
Location 7
100
5
0
0
0
0
Location 1
100 94 85
3 3 1
5 5 4
4 2 9
0 0 5
3 3 8
LOCATION
Location 3 Location 6
Is There a Gap? BIA can show • Existing recovery “plans” beyond capabilities of staff • Inappropriate RTOs and RPOs • Unnecessary expenditure • Paying for a Ferrari solution
• May need a motorbike and a van instead
Measuring Plan Development
Measuring Plan Development We can count… Number of Plans ? Number of Changes ? Regular Sign-off ? Content of Plan ? But it’s easy to count the wrong data….
Plan Health Check
Measuring Exercises
What to Test? 50 45
40 35
Power
30
Hardware
25
Terrorism
20
Communications
15
Flooding
10
Data Corruption
5 2012
2011
2010
2009
2008
2007
2006
2005
0
Measuring Exercises Full Simulation
Co mp lex
ity
Offsite - Multiple BU Offsite Exercise - Single BU
Desktop - Timed / IT Technical Test Desktop / Walkthrough / IT Technical Test
Plan Audit / Discussion
Orientation Briefing
s ce ce ur so ran Re su e& As Tim
Co st
Event
IT DR Status System/Service Advantage Elite ALEAXIS Assistance Auda Enterprise Archive Server Audatex (Home) Audatex (Motor) Bentley Motor Claims BIS Printing Blue Bay Body Management System Business Intelligence CEDAR-O Cedar Financials (Rupert) Chordiant (Host) Chordiant (Off Host) Cicsfax COGNOS Powerplay Complaints MI Delphi Direct Connect MIS Direct Connect Voice Recording Direct Marketing Information System (Closed) Direct Connect â&#x20AC;&#x201C; SAP-RG DVLA E Commerce Daily MI E Financials (Closed) eCRM eCRM Payment Gateway Equifax Fax_web/Connect (Access to IS2000) FIDOSCAN Finsure Gentran Goldmine Hibernate HALCO (Barrell) HALCO (Guize) IS2000 ITP Rating and Pricing Landscape Lotus Notes
RAG GREEN GREEN GREEN RED GREEN GREEN AMBER AMBER AMBER AMBER AMBER GREEN RED GREEN GREEN GREEN RED GREEN RED RED GREEN RED GREEN GREEN GREEN GREEN GREEN GREEN GREEN GREEN RED GREEN GREEN GREEN RED GREEN GREEN GREEN RED GREEN GREEN
System/Service MAM Microstrategy National Hunter Claims NetConnect NetConnect SAS NET_Database NUCLEAR MEDICINE Oracle Financials Oracle FM Personnel Lines Probe PSF PULSE RAS (Closed) RAS BASE STRATA Redman Reporter Redman Scheduler Robotic manuals SAS BAA-G SAS MIA-L SAS MIA-M Solcase (Barrell) Solcase (Guize) Special Risks Application Stolen Vehicle Recovery System (TRACKER) Teamsite Toucan Lite TARDIS (Tracker) UIS (Clement) UIS (Devolved) UK MI Data Warehouse UK MI Seahorse UK Overseas Data Feeds ULTRA Vectus Vehicle Asset Management (TRACKER) Voice Recording (Family) Web Channels (Household) Web Channels (Life) Web Channels (Motor) Web Channels (UK Special Partnerships)
RAG RED GREEN GREEN GREEN GREEN RED RED GREEN GREEN GREEN RED GREEN GREEN GREEN RED RED GREEN GREEN GREEN GREEN GREEN RED RED RED GREEN AMBER GREEN AMBER AMBER AMBER GREEN GREEN GREEN GREEN GREEN GREEN GREEN GREEN GREEN GREEN GREEN
Measuring Exercise Components For Every Recovery Test Every Business Every Year .......... We measured up to 13 components
Could also apply it to crisis exercises, callout tests etc.
Measuring an Exercise - 1 Q1: How many STAFF will take part in the exercise compared with full recovery requirements? 10
9
8
7
6
5
4
3
2
1
Criticality (1 to 10)
Measuring an Exercise - 2 Q2: How much HARDWARE is in scope compared with full recovery requirements?
10
9
8
7
6
5
4
3
2
1
Not part Criticality of plan (1 to 10)
Measuring an Exercise - 3 Q3: How many APPLICATIONS are being tested compared with full recovery requirements? 10
9
8
7
6
5
4
3
2
1
Not part Criticality of plan (1 to 10)
Scale and Score
Key Risk Indicators â&#x20AC;&#x201C; 1 Division
Target
Actual
KRI
RAG
Div A
68
76.58
58
Green
Div B
68
74.45
58
Green
Div C
68
78.91
58
Green
Div D
68
69.26
58
Green
Div E
68
50.71
58
Red
Div F
68
56.18
58
Red
Div G
68
63.43
58
Amber
Div H
68
61.30
58
Amber
Div J
68
76.99
58
Green
Div K
68
50.41
58
Red
Average
68
67.88
58
Amber
Key Risk Indicators â&#x20AC;&#x201C; 2 BCM Testing KRI - Score
80
Score
70 60
Target
50
Actual
40
KRI
30 20 Div A Div B Div C Div D Div E Div F Div G Div H Div J Div K Division
Key Risk Indicators â&#x20AC;&#x201C; 3 Division
Target
Actual
KRI
RAG
Div A
68.0
69.21
58
Green
Div B
72.2
74.45
64
Green
Div C
72.2
78.91
64
Green
Div D
75.8
77.26
66
Green
Div E
56.5
42.12
50
Red
Div F
56.0
48.20
50
Red
Div G
56.0
53.56
50
Amber
Div H
80.0
75.60
72
Amber
Div J
85.5
85.88
75
Green
Div K
85.5
74.33
75
Red
Average
73.0
72.41
62.4
Amber
Key Risk Indicators â&#x20AC;&#x201C; 4 BCM Testing KRI - Score
100 90 Score
80
Target
70
Actual
60 50
KRI
40 30 20 Div A Div B Div C Div D Div E Div F Div G Div H Div J Div K Division
Programme Measurement
Programme Measurement
Variable Targets
Detailed Statements
Location Risk Wheels Water
Water Mains
Run Time
Generator
Water
Run Time
Generator
UPS Desk
UPS Comms
UPS Comms
Water
Mains
Run Time
Generator
UPS Desk UPS Comms
Mains Water
Cooling
Cooling
Mains
Cooling
Cooling
Cooling
UPS Desk
Water
Mains
Mains
Cooling
Run Time
Generator
Run Time
Generator Run Time
UPS Desk
UPS Comms
Generator
UPS Desk UPS Comms
UPS Desk UPS Comms
Supplier Reviews 1. Quality Scores Below are the agreed quality scores for the contract which reflect the level of compliance with Policy and the overall effectiveness of the controls in place. QUALITY SCORE FOR EACH REVIEW SECTION Relationship Management
Financial Review
Value Improvement
Contract Management
Change Management
Risk Management
Exit Arrangements
Business Continuity Mgt.
Total Quality Rating
BCM
Performance
Supplier Performance
2012 Review Score
2
3
2
3
3
3
2
3
21 Green
2011 Review Score
2
3
0
0
2
2
0
2
11 Red
Supplier Reviews
Supplier Reviews Contract Value vs Review Score
In the main, higher value contracts have a better score = better managed.
100 90
Contract Value
80 70 60 Contract Value (ÂŁm)
50
However, some large value contracts have poor scores
40 30 20
10 0 0
5
10
15 Review Score
20
25
30
Trend Analysis 100 90 80
70 60
2009 2010
50
2011 40
2012
30 20 10 0 Div A
Div B
Div C
Div D
Div E
Div F
Summary Why Measure? What to Measure? BIA Testing BC Programme
Is BCM an Expense......? Common views by senior management? “BC costs us money”
“It’s a necessary evil” “It doesn’t increase the bottom
line”
.....or an Investment? Benefits Easier bid / tender
qualification
Differentiates our
proposition – offers quality and reliable service
Reduces risk in supply or
value chain network
ISO 22301?
Measurement Adds Value Measurement provides level playing field Applicable to public, private and voluntary
sectors: size doesn’t matter
Measurement provides roadmap Can be used to enhance current BCM Incentive for senior management to take it more
seriously
Helps target investment
Thanks