Business Continuity: Best Practices - World-Class Business Continuity Managemen - Softcover

Hiles, Andrew N

Softcover

ISBN 10: 1931332223 ISBN 13: 9781931332224

Publisher: Rothstein Publishing, 2005

Synopsis

This book is a guide to implementation of World-Class Business Continuity Management within an enterprise. It may be used as a step-by-step guide by those new to Business Continuity Management or dipped into by the more seasoned professional for ideas and updates on specific topics. There is no absolute "right way" to perform business continuity management - although there are plenty of wrong ways. Business Continuity is not rocket science: it is applied common sense. Yes, experience helps, but it is no mystic art. This book makes the processes transparent and provide the reader with everything necessary to do the job. Many examples are provided throughout this guide: these all have their roots in real cases and real organizations, and come heavily laden with pragmatism. Over fifteen years of business continuity experience in environments large and small, public and private, has gone into developing the methods described. Your own "right way" for business continuity management means picking, matching and tailoring from the cases and examples provided and combining these with existing best practice within your organization. EXCERPT FROM THE PREFACE Melvyn Musson, FBCI, CBCP, CISSP I was very pleased to be asked to write a preface to this much-needed book. There are many books that have been written covering various aspects of hazard control, emergency response, disaster recovery and business continuity, but not one that pulls all areas together under the auspices of the individual sections of the BCI and DRII Professional Practices. Why my interest? To quote from a letter I wrote to the National Fire Protection Association (NFPA) in 1991 when they were considering the establishment of a Technical Committee to develop a Standard on Disaster Management: "Disaster Management, or Business Continuation Planning as we prefer to call it, is a natural progression from Hazard/Loss Control through Emergency Response to the recovery process. "The best hazard/loss control programs cannot prevent emergency or catastrophic situations occurring. The emergency response procedures that most companies have developed or which may be required by law, deal with such aspects as initial fire fighting, evacuation, life safety, etc. - what one might term the stabilization of the situation. They cover the first hours of the emergency. They do not deal with the long-term recovery, which could take several months. "Disaster Management, or some other similarly named program, is needed to enable the company to institute procedures to return to normal operations as soon as possible. That standard is now available as NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. Within that standard are details of the BCI/DRII Professional Practices, albeit as part of the various sections of the standard and not as an individual, specific section. In addition to NFPA 1600, other standards and guides such as BS7779 in Great Britain and the recent Australian Risk Management Standard are incorporating the Professional Practices either by specific reference or wording relating to the practices. The advent of the Turnbull Report introduces a new consideration and need, which the Professional Practices can support. This makes it all the more important to have a reference material that can clearly detail what should be considered in each of the ten subject areas, together with appropriate examples and details of not only the benefits but also the problems that can be expected with each of those subject areas. Andrew Hiles has been able to do so in the development of this book. In addition, since Andrew intends to issue periodic updates, this book becomes a living document, which will address both changes in the Professional Practices and developments within the industry.

About this title

About the Author

Andrew Hiles was founder and for almost 15 years Chairman of the first international user group for business continuity planning. He was a founding Director of the Business Continuity Institute, an international body for certification of business continuity professionals, and a founder of the World Food Safety Organization. Having begun his management career with the Royal Air Force, he pioneered IT systems before leaving to take up a position within the Finance Department of London Transport. Subsequently in their Central Productivity Unit he was a Senior Projects Manager and later became responsible for the business re-engineering function, implementing new services and major technical projects. He left to take up a position with the UK Post Office as their first Business Systems Consultant responsible for major projects. Andrew then joined the UK Atomic Energy Authority at the Harwell Laboratories where he managed the supercomputing, mainframe and other bureau and outsourcing services.

Andrew was a founding director of Kingswell, an international consulting company with a blue chip client base specializing in Enterprise Risk Management, Business Continuity, Disaster Recovery and in Service Management. He is a pragmatic global consultant and trainer on these topics.

Andrew is an international speaker on risk management, business continuity and contingency planning and has featured on conference programs in the USA, Southern Africa, Europe, the Middle East and the Pacific Rim. He has presented workshops and seminars on these topics for Frost & Sullivan (Europe), IIR (Europe and Middle East), AIC (South Africa), CEL (Hong Kong), UPOM (Saudi Arabia) and other companies, having also lectured at Ashridge, Cranfield, GEC Dunchurch and Henley Management Colleges in the UK. He has broadcast on radio, TV and on Internet webinars.

He has designed the training programs Emergency Business Management for the 350,000 members of the American Institute of Certified Public Accountants (AICPA) which run successfully in North America and his highly acclaimed workshop The ABC of Business Continuity Management has been franchised for use in several other countries. With IIR, the world’s biggest conference company, he designed and delivered a Certified Risk management course specifically addressing the needs of the Middle East.

He has over 300 published articles on business continuity. Andrew is also the author of Enterprise Risk Management: Best Practices, published by Rothstein Associates Inc. 2002 and of Guide to Risk Management, published by the Chartered Institute of Accountants of England and Wales in 2002. He co-edited and was the major contributor to The Definitive Guide to Business Continuity Management (published by Wiley, 1999) and The IBM GUIDE UK Disaster Recovery Manual. He contributed to the Confederation of British Industry business guide, Business Continuity Management and to the UK Institute of Directors / Department of Trade and Industry Business Continuity Guide.

Andrew is a Fellow of the Business Continuity Institute, a Member of the British Computer Society and a Freeman of the City of London.

Excerpt. © Reprinted by permission. All rights reserved.

The events of 9/11 have cast a long shadow over the world and led to a vital reappraisal of Enterprise Risk Management and Business Continuity Management.

The Federal Reserve Bank of New York, Federal Reserve System, the Office of the Comptroller of the Currency, the New York State Banking Department, and the Securities and Exchange Commission sponsored the Financial Industry Summit, held on February 26, 2002. I can do no better than to repeat Roger Ferguson’s summary of the key vulnerabilities that regulators and institutions have to face in the aftermath:
· "First, contingency planning generally did not account for region-wide events. Some firms found they lost both primary and back-up sites. There were significant concerns about the loss of or inaccessibility of staff.
· "Second, concentrations, both market-based and geographic, were really evident and became a source of vulnerability.
· "Third, the critical interdependencies across the industry, although understood in the context of planning Year 2000, were never so readily apparent. This was evident in the impact of the problems at key infrastructure providers on wide range of financial institutions. Even institutions far removed from New York City were significantly affected by interdependencies."

These factors apply not only to financial institutions that were particularly hit by the tragedy, but also to many other industries that could be impacted by disasters having a similar impact.

Key lessons have been painfully learned:
· People issues are paramount: staff availability, risk awareness and training are critical
· Operations distributed over a wide geographic area have a better chance of recovering and may recover quicker. Reliance on single points of failure should be avoided.
· Focus on the outcomes of disaster rather than the causes and on the deliverables rather than on the processes of delivery
· It is not enough to pay lip service to business continuity: planning must be whole hearted, thorough and tested. Testing may need to extend across the industry, across industries and into the supply chain, including infrastructure providers.

It is our hope that effective risk management, emergency and continuity planning may help to prevent deliberate disasters and to mitigate the consequences of those that do occur.

Edition details

• Publisher: Rothstein Publishing
• Publication date: 2005
• ISBN 10: 1931332223
• ISBN 13: 9781931332224
• Binding: Paperback
• Language: English
• Edition number: 2
• Number of pages: 294