New Risks, New Business Continuity Strategies

1
New Risks, New Business Continuity Strategies
Scot Ferrell CBCP, FBCI Senior Vice President San
Francisco, CA scot.ferrell_at_marsh.com 415-743-864
6
2
Are you Prepared to Respond?
What are the threats that can interrupt your
organization?
3
What will Executives Need to Know?
When an interruption occurs, Executives should be
able to answer

• Are customers and employees safe?
• Can executives effectively communicate as a team
  and is there a command structure for the
  organization?
• How does corporate support the field?
• If corporate is impacted, what are the key
  business processes and how will they be
  recovered?
• What is the impact to service?
• Will the impacts be mitigated by a recovery plan
  or insurance?

4
The Value of Preparedness
IMPACT
Crisis event
Lost time/productivity
Without preparedness
Time
It reduces the negative impact and speeds
recovery from all kinds of events (regional or
Pandemic)
Damage to financial results, reputation andkey
relationships
Negative impact
5
Get Senior Management InvolvedSooner Rather Than
Later
The Impact on Shareholder Value
20
15
After initial reflex (10 days) market begins to
assess companys response
10
5
Effective Crisis Responses
7
0
Cumulative Abnormal Returns ()i.e., change in
market cap adjusted for market movement
Ineffective Crisis Responses
-15
5
10
15
20
25
50
75
100
125
150
175
200
250
275
Trading Days After the Event
Source The Impact of Catastrophes on
Shareholder Value, Rory F. Knight Deborah J.
Pretty, Templeton College, University of Oxford,
p. 3.
6
Refocus of Operations

• Companies are re-evaluating their Risk Management
  perspective on responding to events
• New threats demand evolution of current
  philosophies, procedures and relationship
  structures
• Organizations are developing revenue protection
  programs that go beyond completing a business
  continuity template
• Command structures are being developed that
  enhance/support current BCP programs

RISK
Service
Cost
7
BCM Trends Within the Utility Industry

• Increased pressures from community, audit
  committees and stakeholders
• Pressure to eliminate single points of failure
  and develop back-office recovery plans to support
  field operations
• Increased cost of insurance and consolidated
  reviews of business continuity with insurance
  coverage
• Development of cost effective mitigation plans
• Heightened awareness of key and emerging risks
  (natural disasters, terrorist, pandemic)

8
Pandemic Planning
9
Objections and Facts to Pandemic Planning
Facts
10
Whats Different in Planning for a Pandemic?

• Understand what is a Pandemic and the potential
  for a Pandemic
• Determine the potential impact to operational
  continuity
• Assess the utility network interdependencies for
  services
• Evaluate human capital

11
Background on Avian Flu Pandemic Prediction

• It is only a matter of time before an avian flu
  virus - most likely H5N1- acquires the ability to
  be transmitted from human to human, sparking the
  outbreak of human pandemic influenza. We dont
  know when this will happen. But we do know that
  it will happen.
• Lee Jong-Wook, Director General of the World
  Health Organization (WHO)

12
Background on Avian Flu Pandemics Global Threat

• Represents extreme end of low-frequency,
  high-severity events such as hurricanes, tsunamis
  and earthquakes
• International impacts with no demarcation
  byculture, industry or geography
• Do not know when it will occur
• Do not know if it will occur
• Will not know severity until it is over
• Expected mortality rate significant (50)
• Individual impacts for 2-3 weeks
• Will escalate quickly with infection in
  sequential waves over 6-9 months
• Secondary waves and impacts will be significant

13
Projected Pandemic Global Threats and Impact

• 7 million350 million deaths(World Health
  Organization-WHO)
• 89,000207,000 deaths in United States (Center
  for Disease Control-CDC)
• 25 percent of workers sick 5 to 20 days (UK
  Department of Health)
• 800 billion in worldwide economic damages (The
  World Bank)
• Major disruptions to every business, particularly
  lodging, health care, travel
• Quarantine individuals and communities ban use
  of public transportation and public gatherings
• Source Congressional Budget Office, Brookings
  Institute, Nesbitt Burns

190 cases, 107 deaths as of 3 April 2006 (source
World Health Organization
14
Determine Impact to Operational Continuity

• Have the anticipated risks from a pandemic been
  evaluated?
• Is there an existing business continuity plan
  (BCP) with recovery procedures for critical
  locations and business functions?
• Has your organization completed a recent in-depth
  BCP review?
• Do existing recovery procedures consider
  significant staff reductions and loss of support
  resources over an extended period of time?
• Have your recovery plans been adequately tested?
• Can you keep your organization operating if a
  large portion of employees or critical staff
  cannot/do not come to work?
• Have existing crisis management plans been
  recently reviewed?
• Has a crisis management team been established?
• roles and responsibilities defined?
• individuals trained?
• resources allocated?
• team exercised?

15
Industry Challenges
16
Assess the Utility Network Interdependencies
(Illustrative, see NARUC, Technical Assistance
Briefs, 2005)
17
Assess the Human DependenciesIf Failure Occurs,
Provide the Best Recovery Options
An example of common skill groups involving
engineers showing levels of skill overlaps and
what incumbents would be the best matches to fill
in for an Engineer III.
Nuclear shift supervisor
Nuclear room operator
Asst. nuclear shift supv.
68
44
Engineer intern
Supervisor nuclear engineering
Mgr. nuclear engineering
100
49
78
Engineer I
39
90
Engineer III
80
61
85
Engineer II
45
Consulting engineer
Transmission access specialist
Percentages represent degree of commonality in
skill s between jobs. This is a hypothetical
example.
18
Review HR Policies and Procedures

• Many HR policies and procedures should be
  reviewed including
• Leave policies
• Quarantine policies
• Return to work policies
• Travel policies
• Compensation policies
• Evacuation policies
• The steps would include
• Defining the impact of a pandemic on your
  industry
• Identifying and analyze your current policies
• Conducting a gap analysis
• Drafting amendments
• Testing various scenarios

19
Quarantine Policy

• Virus may be brought to the workplace by
  employees or visitor
• Strong insistence that staff who feel ill should
  not report to work (together with liberal leave
  policies and non-punitive sick leave
• Factors that organizations may focus on include
• isolate infected individuals in quarantine (at
  home or other) to avoid further infections
• provide necessary level of medical care
• transport individuals to appropriate quarantine
  facilities
• As part of the communication strategy to
  employees, need to emphasize
• symptoms of the virus
• actions that employees should take if they
  believe they are at risk
• who to contact within the company if a co-worker
  or visitor is showing symptoms

20
Travel Policy

• Establish travel guidelines and restrictions to
  and from pandemic-infected regions
• Possibly evacuate expatriate employees in
  infected regions or those not engaged in business
  critical functions
• Quarantine of employees from infected regions or
  requiring isolation period following exposure
• Questionnaire at building entrance of all
  visitors of recent travel to infected countries

21
Social Distancing

• Social distancing is a key component of
  containment activities
• It needs to be adapted to the needs of each
  organization
• Could include
• mechanisms for working remotely and accessing
  data securely
• increase use of telephone and video conferencing
• avoid unnecessary travel
• encourage telecommuting and flex hours
• avoid public transportation
• alternative work locations
• screening personal and visitors entering workplace

22
Hygiene Protocol

• Organizations may consider upgrading their
  cleaning protocols in areas such as
• general office environment
• maintenance of air-conditioning system
• telephone handset, doorknobs, access buttons,
  etc
• common areas including restrooms, lunchrooms,
  elevators, etc
• Employees should be issued instructions
  recommending adherence to personal hygiene
  guidelines
• Include recommendations about personal protective
  equipment
• Gloves, masks, disinfectants plus thermometers

23
Internal Communications

• Does a crisis communications plan for all
  employees and internal stakeholders exist?
• Have pre-incident messages been developed?
• What are distinct pandemic or infectious
  biological risk-related messages? Why are they
  distinct and does one need to reinvent the wheel?
• As part of the communications strategy to
  employees, there is a need to emphasize
• symptoms of the virus
• actions that employees should take if they
  believe they are at risk
• who to contact within the company if they believe
  that they, a co-worker, or visitor is showing
  symptoms
• What communications networks exist to collect
  critical information?

24
External Communications

• Does a crisis communications plan for all
  employees and external stakeholders exist?
• What information should be disseminated to key
  external stakeholders?
• Have pre-incident messages been developed?
• What are distinct pandemic or infectious
  biological risk-related messages? Why are they
  distinct and does one need to reinvent the wheel?
• What communications networks exist to collect
  critical information?

25
Review Benefits Program

• The benefit programs should be reviewed
  including
• Healthcare coverage
• Short- and long-term disability insurance
• Life insurance
• The steps would include
• Defining your organizations benefits philosophy
• Identifying your current benefits package
• Conducting a gap analysis
• Implementing solutions to cover identified gaps

26
Lessons Learned from SARS

• Maintain regular communications
• Employees
• Customers
• Head office
• Building management
• Other key stakeholders
• Provide guidance to employees
• Reassurance
• Flexibility on working location
• Anticipate
• Anxiety from staff and stakeholders
• Loss of work force (40)
• Loss of clients and suppliers
• Travel restrictions and impacts
• Expatriate staff requests to leave affected areas
• Senior management working from remote locations
• Limited antiviral supplies (hording and
  distribution problems)
• Do not rely solely on assistance from public
  health agencies

27
Self- Assessment
28
What Should Companies Do to Prepare?

• Assemble a team with focus on both the economic
  (keep the business running) and social/health
  event
• Include security, mental physical health needs,
  40 loss of workforce, three orders of
  succession, and lack of external assistance into
  your planning assumptions
• Create integrated continuity plans based on
  pandemic related assumptions understand impacts
• Establish a communications protocol, establish
  relationships, and practice, practice, practice
• Institute an employee tracking capability
• Review healthcare and benefits arrangements
• Monitor the event, communicate with employees
• Educate, train and provide on-ongoing awareness
• Test, test, test

29
Thank You
Scot Ferrell CBCP, FBCI Senior Vice
President Business Continuity Management San
Francisco, CA scot.ferrell_at_marsh.com 415-743-864
6