Business Continuity of Operations and Recovery Planning BCORP

1
Business Continuity of Operations and Recovery
Planning (BCORP)
Presented by Art Holdsworth, CPFO Deputy
Director, Management Budget Oakland County,
Michigan June 8, 2007
2
Outline

• Why Business Continuity of Operations and
  Recovery Planning (BCORP)?
• Inter-Governmental Cooperation (IGC)
• Sources of Planning Information
• The Central Role of BCORP Planning
• BCORP Template
• Personal Preparedness / Fly-Away Kits
• Minimizing Absenteeism
• BCORP Testing
• Implementing an Organization-wide BCORP Program

3
(No Transcript)
4
Oakland County is

• 910 square miles
• 62 local communities
• 1.2 million residents
• Urban and rural environments
• Six county-wide elected officials
• Judiciary
• 25 elected commissioners
• 80 departments and agencies
• 4,400 employees

5
Why Business Continuity of Operations and
Recovery Planning (BCORP)?

• Governments face many types of unscheduled
  disruptions to business operations from a variety
  of causes. Threat situations, domestic attacks,
  and natural disasters all present challenges to
  maintaining business operations.
• While many organizations have a Disaster Recovery
  (DR) Plan, it tends to focus mainly on
  information technology and related physical
  assets.
• A Business Continuity of Operations and Recovery
  Plan (BCORP) focuses on people and processes,
  integrates with the DR Plan, and address
  facilities and equipment as well.

6
Why Business Continuity of Operations and
Recovery Planning (BCORP)?

• Many government services are essential to the
  publics health and safety and to the protection
  of property.
• Governments have a responsibility to minimize
  disruptions to essential services and mitigate
  the effects of disasters on the communities they
  serve.
• The Government Finance Officers Association
  (GFOA) recommends that governments develop, test,
  and maintain a plan to continue their basic
  business operations, mitigate risk, and control
  costs during and immediately after disruptive
  events.
• The GFOA recommended practice on business
  continuity planning is attached and can be found
  on-line at www.gfoa.org/downloads/budgetBusiness_
  ContinuityRP.pdf.

7
Why Business Continuity of Operations and
Recovery Planning (BCORP)?

• Lets look at the potential impact of emergencies
  on government operations
• An emergency (e.g., an Avian Influenza pandemic
  outbreak) may result in significant illness or
  even death to individuals.
• Families will likely shelter-in-place, raising
  absenteeism.
• Schools and some businesses, including vendors,
  may shut down
• The result will be a major business disruption of
  / wild fluctuations in both supply and demand for
  government services. This will affect the
  Countys operations and work schedules, possibly
  resulting in the partial or complete shut down.

8
Inter-Governmental Cooperation (IGC)

• Sharing resources with other Departments may ease
  supply / demand fluctuations, but may not be
  effective when an entity is broadly affected.
• Therefore, consider establishing formal or
  informal Inter-Governmental Cooperation (IGC)
  agreements with counterparts in neighboring
  communities / counties
• During and after emergencies Share staff and
  assets
• Before an emergency Consider an IGC arrangement
  whereby assets are jointly purchased and shared
  as part of normal business operations (Economies
  of Scale, Scope, and Size), forms and processes
  are standardized, and staff are cross-trained.
  This reduces redundancy and risk by making each
  entity less vulnerable to isolated emergencies.

9
Sources of Planning Information

• www.Ready.gov, Sample Emergency Plan
• www.drj.com, Disaster Recovery Journal
• www.fema.gov, (1) Emergency Operations Planning
  Guidance, (2) Interim Guidelines, Terrorist
  Incidents, (3) Tool Kit, Terrorist Incidents, (4)
  State and Local Guide for All-Hazards EOP, (5)
  Emergency Operations Center Assessment Checklist,
  and (6) Continuity of Operations Guidance for
  State and Local Governments
• www.CDC.gov, Business Pandemic Influenza
  Planning Checklist
• www.OSHA.gov, Preparing Workplaces for an
  Influenza Pandemic

10
Sources of Planning Information

• www.NACo.org, National Incident Management System
  (NIMS) Guide
• www.Pandemicflu.gov, US Department of Health and
  Human Services, Pandemic Influenza Planning
• www.gfoa.org/services/rp/
• www.rothstein.com, Business Continuity Planning
  guide
• www.EnvoyWorldWide.com, Survey on Trends in
  Business Continuity and Risk Management

11
The Central Role of BCORP Planning


12
The Central Role of BCORP Planning
Incident Command Post (s) Primary Responders and
Local Public Officials (CEO Mayor/Twp Sup
overwhelmed and requests assistance
Stafford Act Disaster, Catastrophic Incident of
National Significance or Terrorist Attack
FEMA
MSP-EMHS
OCERP
13
The Central Role of BCORP Planning

• Focus first on immediate, high-impact threats.
  Oakland County approached its planning effort in
  two phases
• A Public Health (Pandemic Influenza) BCORP
• A General (fire, tornado, flood, terrorist
  attack, toxic gas release, earthquake, hurricane)
  BCORP
• Be sure to comply with applicable local, state,
  federal, Occupational Safety and Health
  Administration (OSHA), and Environmental
  Protection Agency (EPA) guidelines, as we as Sate
  laws governing what can and cannot be done in an
  emergency (Emergency Powers)
• Be sure to keep the BCORP Plans up-to-date (e.g.,
  recommend a semi-annual review)

14
BCORP Template

• Cover page
• Summary of Who, What, Where

15
BCORP Template

• Approvals and Order of Succession
• Table 1
• Table 2
• Each department should identify an order of
  succession, and ensure that all individuals are
  prepared to perform emergency duties

16
BCORP Template

• Incident Response Team
• Table 3
• An Incident Response/Recovery Team should be
  identified and then briefed on what to do (e.g.,
  how to implement this plan) in a public health
  emergency

17
BCORP Template

• Mission-Critical Business Processes
• Identifying mission-critical business processes
  is the foundation from which all other components
  of the BCORP plan are developed

18
BCORP Template

• Mission-Critical Business Processes/Functions
• Part of this step necessarily involves
  prioritizing those processes. Some
  processes/functions may be suspended in an
  emergency, or at least the level of service
  diminished, for a period of time. Prioritization
  should be based on whether
• The process is essential to the publics health,
  safety, and welfare
• The process provided by the County is legally
  mandated
• The process is an integral part of
  processes/functions provided by other County
  departments or external entities
• The process provided is a major revenue source
  for the County
• The process accounts for the majority of
  departmental expenditures

19
BCORP Template

• Recovery Action Plan Pre-Disaster

20
BCORP Template

• Table 5 Recovery Action Plan
• Note that the Table needs to be completed for
  each mission-critical Business Process/Function
• Note, also, that a single Recovery Action Plan
  may be designed to address more than one or
  even all of the departments mission-critical
  Business Processes/ Functions
• Step Execution Timeframe sequence deadline
• Pre- vs. Post-Disaster

21
BCORP Template

• Recovery Action Plan Post-Disaster

22
BCORP Template

• Post-Disaster (Emergency) Action Plan Flowchart
• Note that activation of the BOCRP Plan occurs
  well into a disaster
• Other Plans come into play first for the Health
  Well-being of staff and the public

23
BCORP Template

• Inventory of Assets

24
BCORP Template

• A single source of information on
  mission-critical resources necessary to maintain
  operations before, during, and after an emergency
  should be compiled and included in the Plan.
• This includes
• Customers
• Furniture
• Computers
• Other operating equipment
• Vital Records (Forms, Policies Procedures, etc.)

25
BCORP Template

• Crisis Communication Plan
• Each department needs to document how it plans to
  communicate with employees, the public, the
  media, etc., during and after an emergency

26
BCORP Template

• A list of who to contact, along with their phone
  numbers and email addresses, should be
  documented. Consider a fan out approach,
  whereby a set of initial contacts are made to
  individuals who in turn contact others and so on
  until everyone listed in the Crisis Communication
  Plan has been contacted.
• A Common Crisis Communication Plan should be
  prepared and posted on-line for quick access, as
  well as included in each BCORP Plan. Contact
  information would be included for public safety
  departments, Red Cross, hospitals, ERP
  departments (local and State), utility companies,
  Board/Council and executive staff, the media, the
  Medical Examiner, Animal Control, and key
  internal departments (Health Department,
  Corporation Counsel, Human Resources, Information
  Technology, Facilities Management, Purchasing,
  etc.)

27
Personal Preparedness / Fly-Away Kits

• The kits contain mission-critical information and
  supplies to maintain operations. For example
• The Department's BCORP plan
• Cash / P-Cards
• Forms, books, files, back-up tape, and other
  hard-copy documents necessary to day-to-day
  operations
• Vendor names, numbers, and lists of their
  products/services
• Policies and Procedures / Job descriptions
• Safe combination and office, desk, file cabinet,
  and petty cash box keys
• Equipment operating manuals / procedures (How
  To guides)
• Flashlights and batteries / light sticks,
  battery-powered radios, drinking water,
  non-perishable food goods, operating supplies,
  First Aid kits, AEDs (Auto External
  Defibrillators), protective masks latex gloves,
  extension cords, etc.

28
Minimizing Absenteeism

• Cross-training of staff / Identify staff
  available for back-filling in other departments.
  Pre-training / screening may be necessary to
  back-fill for certain positions.
• Intergovernmental Cooperation agreements
• Operate an emergency staffing center as follows
• Employees call their department if they are
  unable to report due to their own illness, or
  that of a family member. Departments would then
  first fill their critical need positions.
• After critical positions were filled, the
  Departments would be responsible to provide the
  staffing center with employee names available for
  reassignment.
• The staffing center would field Department
  requests for staffing and then dispatch
  employees.
• Employees would be responsible for letting their
  Department know they have been reassigned.

29
BCORP Testing

• A governments disaster and emergency recovery
  plan should be tested periodically.
• The Homeland Security Exercise and Evaluation
  Program (HSEEP), which is under the ODP, provides
  both a rationale and policy for designing,
  developing, conducting and evaluating testing
  exercises. HSEEP provides a series of four
  reference manuals to assist state and local
  jurisdictions in designing training exercises,
  conducting the exercises, evaluating the results,
  and improving the plan to correct deficiencies.
• Case Study Oakland Countys Public Health BCORP
  testing scenario

30
The Daily News
April 2, 2007
Cloudy Skies High 64ºF Low 53ºF Wind NE 10 mph
Dow 12,463.15-38.37 (-0.31)   Nasdaq
2,415.290.00 (0.00)   SP 500 1,418.30-6.43
(-0.45)
One-lane back up due to construction on I75
N I94W accident in right lane
Department of Homeland Security Intercepts Radio
Transmission of Terrorist Ploy for U.S. Airports
Credibility Undetermined
Wings decimate Maple Leafs 5-1 Next Stop
Chicago.
Adam Graham
Detroit. Alskdjliwaalwkejroiene goin gaoin aowin
oain goine waieona wigne lwjken ki wing alisngt
ehe alfklfjwhe in dkjg lwje aow kjie oiw giogorI
aioh al Aosif wione owie afoinf ionaowineoimw
hjie ciwme iekjwoie. Daoiwe icha glwike lwkajg
eign alkeg ening wlioin eghw ieliong ien ghe
lkajldj lwkj owel. Ioen owiao gl. In goiewoein
oin goi, inw
Continued on C8
Associated Press
Washington D.C. alskdjliwaalwkejroiene goin gaoin
aowin oain goine waieona wigne lwjken ki wing
alisngt ehe alfklfjwhe in dkjg lwje aow kjie oiw
giogorI aioh al Aosif wione owie afoinf
ionaowineoimw hjie ciwme iekjwoie. Daoiwe icha
glwike lwkajg eign alkeg ening wlioin eghw
ieliong ien ghe lkajldj lwkj owel. Ioen owiao gl.
In goiewoein oin goi, inw eigioe wnoal kge, ian
gine lkwi goin weg. oiwneoifn eoiang
oeinoginw. Inoinwoine goiew eg. oioi noioinw
oien oien owigne gline gowien. Oaidn fowine
flsdkjfwoien old.d,mf wloaoie ioaghowieg auihg.
Woeituoinbixldkg. Woingo wienjkgkd ,
lkwoiegineg wieh goiwei r. Wioeng woajkgne
giwong ieng woeing woie goe gaundeclared. Oinw
goieeng weiong salc. Sitllwjkeiug iowne goian
lakjwoie joi tol. wing eoithea thet eoiht e,
said toiauwne ioht epoit the gng etaopptjlekjtle
t. Owinemto ieoit, the woinet l
Continued on A14
Romney Submits Final Paperwork for 2008 Bid
Nyota James
No Doubt for Local Physicians Flu-season is
Here! What you can do to prepare.
Detroit. Lkajwoine goieha oithea w eoitn eit
kikike aliowjaknvbyc ealmcy ncy yzlokdj. Stim
lgien ghwldim geha the tlalktjelak jtien alg.ie
ghgei t.ike gwyn dkalwigne yN vlqo Aosif wione
owie afoinf ionaowineoimw hjie ciwme iekjwoie.
Daoiwe icha glwike lwkajg eign alkeg ening wlioin
eghw ieliong ien ghe lkajldj lwkj owel. Ioen
owiao gl. In goiewoein oin goi, inw. Sitllwjkeiug
iowne goian dkg wlekng eig
Catherine Burkhart, Health Editor
Detroit. Lkajwoine goieha oithea w eoitn eit
kikike aliowjaknvbyc ealmcy ncy yzlokdj. Stim
lgien ghwldim geha the tlalktjelak jtien alg.ie
ghgei t.ike gwyn dkalwigne yN vlqo. woit aoitjhw
etheo tihaoiwe, saing
31
Increased Symptomatic Patients
April 3, 2007 630 A.M.

• Patients arrive at hospitals and private clinics
  throughout the entire southeast Michigan area
  with high fever, chills, fatigue, and persistent
  coughs. A majority of these cases, which includes
  otherwise healthy adults, exhibit signs and
  symptoms more serious than the common cold.

32
Contact Community Members
April 3, 2007 730 A.M.

• Environmental Protection Investigation Unit
  notified to begin call-outs
• Local Hospitals
• Michigan Department Community Health (MDCH)
• Sentinel Physicians
• Bio-Watch Detection System

33
Disease Unidentified
April 3, 2007 100 P.M.

• Many of the patients with flu-like symptoms are
  not responding to decongestants, analgesics,
  antibiotics, or antiviral medications. Rapid
  antigen screening tests for influenza have not
  returned from the lab. Blood tests and cultures
  for fungal, viral, and other infectious diseases
  are still pending.

34
Increased Cases
April 3, 2007 730 P.M.

• By now, approximately 3,010 patients have
  reported to area hospitals and clinics in each
  county with the same mild to severe flu-like
  illness. The most severe cases are hospitalized.
  In the mean time, hospitals have been reporting
  to local public health departments that ED wait
  times have been increasing in the emergency room
  and hospital beds are filling rapidly.

35
BCORP Testing

• All County departments are invited to attend the
  tabletop testing exercise held in our Emergency
  Operations Center
• Different plans are tested simultaneously to
  ensure they all integrate seamlessly, e.g.,
  Facility Emergency Preparedness (Evacuation)
  Plan, BCORP Plan, various Health Department
  response plans, etc.
• The scenario is stepped through and each
  department is tasked with responding real-time
  along with their peers
• A moderator oversees the test and the results /
  reactions / responses are transcribed for later
  evaluation

36
Implementing an Organization-wide BCORP Program

• Prioritize all departments / operations relative
  to each other, and list inter-dependencies
  between them. Provide this prioritization to the
  HR Staffing Center.
• Secure P-cards with high dollar limits for
  emergency use
• Store BCORPs on-line, off site, and at each
  office
• Work out arrangements with secondary vendors to
  manage the supply chain when primary vendors
  temporarily shut down
• Designate who will declare the emergency and who
  will notify others that an emergency has been
  declared
• Survey staff to determine their readiness to
  telecommute in the event of an emergency. Each
  department must make this determination, then IT
  must establish the infrastructure and procedures
  to facilitate remote access.

37
Implementing an Organization-wide BCORP Program

• Establish a leave time / compensation policy for
  staff during and after emergencies
• Establish an illness / infection policy, e.g.,
  when exposed or ill staff are sent home / can
  return to work
• Establish a vaccination policy
• Establish an infection control supplies / First
  Aid Kit / AED policy
• Be sure to back up the hard drives of
  mission-critical staff
• A web page and a central file directory should be
  set up for archiving completed plans, the BCORP
  template, and any other supporting materials

38
The BCORP Program

• All public entities have a duty to prepare for
  emergencies and ensure continued provision of
  mission-critical services to their constituents.
  The organization-wide effort of implementing a
  BCORP Program, and then having all departments
  complete and test Plans, is crucial to fulfilling
  that duty.

39
Questions Answers
For copies of the Oakland County BCORP Template,
or this PowerPoint presentation, contact Wm.
Art Holdsworth holdswortha_at_oakgov.com
40
(No Transcript)
41
(No Transcript)
42
(No Transcript)