Logo

Saturday, June 23, 2012

Royal Bank of Scotland Group suffers major business continuity failure




British based banks belonging to the Royal Bank of Scotland Group have experienced a major business continuity failure, with customers being unable to access bank accounts for more than 24 hours. NatWest customers have been the most affected, with some RBS and Ulster Bank customers also impacted.
The systems failure was the result of a problem with a software application. This has now been resolved but a huge backlog of information that requires processing means that customers are still unable to make transactions.
Artco Solutions will recommend the following…

Incident detection

Response BEFORE an incident occurs, upon detection of one or a series of related events that become incidents
  • ·      Detecting incidents at the earliest opportunity minimizes impact to services, reduces recovery effort, and preserves quality of service
  • ·      Investment in detection should be linked to the business continuity needs
  • ·      Hardware failures
- Malfunctions in racks, servers, storage arrays, tape devices
  • ·      Network - Data connectivity interruptions, intrusion detection etc.
  • ·      Software
- Upgrade issues, unauthorized software, malware etc.
  • ·      Data – Corrupted data sets, incomplete datasets etc.
  • ·      Processes
- System changes, maintenance etc.
  • ·      Suppliers
- Power failure, telecoms outage



Incident prevention

ICT Readiness promotes resilience
  • ·      Facilitates identification of critical components in each of the elements which make up the ICT environment
  • ·      Relates ICT criticality to wider business criticalities
  • ·      Priorities also driven by BC requirements
  • ·      Justifies resource and budget for appropriate resilience measures
  • ·      Monitors the performance of resilience measures
  • ·      Review and improvement following exercises, tests and incidents


Response
  • ·      Confirm nature and extent of incident
  • ·      Take control of situation
  • ·      Contain the incident
  • ·      Communicate with
stakeholders
  • ·      Confirm nature and extent of incident
    • o   Acquire information
    • o   Assess
    • o   How does it affect the elements of the ICT environment?
      • §  How might these affect service-users and the critical activities of the organisation?


Take control of situation
  • ·      Automatic or manual failover?
  • ·      Determine priorities for mitigating incident
    • o   People

    • o    Facilities

    • o   Technology
    • o   Data

    • o   Processes
    • o   Suppliers
  • ·      Determine resource requirements
  • ·      Communicate
  • ·      Contain the incident
    • o   Auto or manual failover?
    • o   Direct resources to manage situation
·      Communicate
  • Communication is essential through the response process
  •    Integration with overall BC incident management process
  • Is there concurrent activation of BC Incident Management?
  • Liaise with rest of organisation
  •  Activate relevant contingency arrangements
Recovery
  • ·      Technical recovery plans
  • o   In conjunction with organisational business continuity plans
    • o   Failover of immediately time- critical systems
    • ·      Recovery of less time-sensitive systems 

  • ·       Manage recovery process •
  • o    Over hours, days, weeks.....
Learning
  • ·      Audits/self assessment
  • ·      Feedback from periodic BIAs and risk assessments
  • ·      Corrective action following incidents
  • ·      Preventive action

RESILIENCE AND THE IMPORTANCE OF FAILURE

By striving to eliminate all failures or interruptions could we actually be damaging our organization’s ability to react to an unexpected crisis?


I wonder why organizations are so afraid of failure? In seeking to create resilient organizations we seem to be striving to eliminate all failures or interruptions and I cannot help but wonder if in doing so we might lose something far more valuable and undermine exactly what we seek to create.

I failed at my first attempt to pass my driving test. It hurt my pride and my self-confidence took a knock – I was only seventeen at the time and plenty of my peers passed their driving tests first time. I learnt that I needed more practice and to work harder at improving aspects of my driving skills, which I took to heart and duly passed my driving test on my second attempt. With hindsight, I’m glad the driving test examiner did not pass me first time, when my driving skills were perhaps marginally adequate. The experience of failure brought me up short; made me more diligent; made me really learn. I think it made me a better driver.

Failure and success are intertwined like Yin and Yang. JK Rowling spoke eloquently about how she might never have written the Harry Potter books that made her fortune had she not sunk to such a low point in her life that all that remained was her dream and determination. Richard Branson's successes make it easy to forget that he has lost far more money through failed ventures than most people make in their entire lives. He has a very positive attitude towards failure:

“My mother always taught me never to look back in regret but to move on to the next thing. The amount of time people waste dwelling on failures rather than putting that energy into another project, always amazes me. I have fun running ALL the Virgin businesses - so a setback is never a bad experience, just a learning curve.” [From an interview with The Good Entrepreneur.]

A BBC article earlier this year about a top girls’ school planning ‘failure week’ to teach pupils to embrace risk, build resilience and learn from their mistakes really resonated with my thinking. You can read the article at http://www.bbc.co.uk/news/education-16879336

The lessons I value most have come not from formal education or training courses but from the ‘University of Real Life, School of Hard Knocks’. The sometimes blisteringly hard lessons that test your character and your personal resilience, that seek to break you, that knock you down and challenge you to get back up again. Of course education and training helps, if you’re lucky giving you some insight and skills to face the challenge when it comes, but it’s experiencing and eventually overcoming the challenge itself that embeds learning like no training course ever can. Experience trumps all other forms of learning– a hypothesis backed by evidence in countless job advertisements and interviews in which employers seek someone that’s done the job successfully before. If you work through ‘real life’ challenging experiences, learn from them and use that knowledge to develop and improve yourself then you become a more resilient person, better able to adapt and overcome similar future challenges.

Resilient organizations ‘fail well’. On an organizational level, perhaps we need to design ways in which the organization learns how to fail well instead of seeking to insulate it from all failure. A resilient organization is able to cope with failure rather than seek to avoid it. This means it is better able to learn and adapt to changing circumstances, which will in turn promote its success and resilience over time.

Author: 
Robin Gaddum MBA FBCI

Corporate Entrepreneurship (CE)


 Corporate entrepreneurship is an organizational state or supportive environment allowing innovative and future-oriented thinking to flourish at all levels of the organization. It is about thinking innovatively in order to act strategically and flexibly while managing the demands and pressures experienced by the established organization. Corporate entrepreneurship can take any organization, even the most traditional or established, on to a new level of productivity and flexibility.

The term corporate entrepreneurship (CE) refers to the establishment of a state or environment in an organization that draws on the spirit of enterprise often associated with start-up companies.

Lessons learnt from the start-up

·    Contemporary innovation: traditionally, entrepreneurs have been seen as “investors” who brought new ideas to the marketplace. The evolving role of innovation encourages input from all levels within the organization.
·       Leaner/flatter/smarter: the small, flat and flexibility of the start-up is particularly valuable in its capacity to manage, and thrive on, change. They can respond quickly to demands for change in direction, driven by client demand or economic and social circumstance, without losing sight of the overall vision
·       Responsive means competitive: start –up organisations evaluate ideas and then act up upon the evaluation, i.e. they are astute in deploying innovative thinking via decision-making and resource allocation
·       Eye on the future: a proactive approach through forward thinking and anticipating the need and demands of customers before they arise
·       Clear perception of client needs: breaking through the parameters of current activities to deliver something new. Several of the most innovative start-ups have created new markets, rather than simply offer a ‘better’ version of an existing product or service.

The lessons of innovative thinking and flexibility gather from start-ups must be balanced by the careful encouragement, gathering and deployment of innovative thinking.

The key is finding a balance between encouraging innovation and managing new thinking to ensure that the overall aims and objectives of the organization are maintained. For example, a health trust full of maverick thinking and behavior would be inappropriate given the political and social responsibility of public sector health organization. However, a trust entirely lacking in innovation, and burdened by past experience, will be inefficient and slow to respond to change.

Balancing the management of innovation for the good of the entire organization, while maximizing the potential of the individual innovating employee, is the key to success offered by the CE environment.

Benefit of the CE environment

CE as an endeavor sits somewhere between change management, innovation and leadership, and provides the potential for todays organization to constantly evolve and adapt to changing circumstances.

The benefits or output of CE for an organization

·        The capacity to manage change affecting the organization itself or its market environment
·       The ability to make creative/ imaginative use of the resources currently held by the organization
·       The ability to meet client needs and satisfy them
·       The capacity to anticipate client needs that may not fully demonstrate as yet
·       The capacity, led by the decision-making and resource-developing manager of the organization, to weigh risks, against potential gains generated by new thinking

The Corporate entrepreneur

Today, the skills of the entrepreneur are understood to stem not from a rigid set of innate traits, but from a learning process undergone over time. CE is, therefore, also a skill set held by the organisation’s managers that enable them to draw innovative thinking from all employees, and to deploy it to address client needs, and to manage the organizational environment. Creating a culture that encourages, acts upon, and rewards innovative thinking is vital, in order to ensure that the ‘raw materials’ are available for these entrepreneurial managers. Equally, employees must be trained in the importance of creativity and opportunity seeking; educated as to much thinking fits within the overall organizational cultural state of CE; and encouraged and supported in generating new and value-adding ideas, even where managing risk is involved.

Private vs public sector entrepreneurship

CE has adopted and adapted by the public and private sector in subtly different ways. This difference is largely due to the differing objectives, responsibilities and environmental pressures experienced by organisations in these two sectors.

The corporate entrepreneur is found in the private sectors, and use their skills to improve internal processes, products and services to create organizational or market change that will ultimately improve the bottom line.

The social entrepreneur transfers the tactics, strategies and benefits of CE to the social sphere, i.e. the public sector. The responsibility of the organization is of course social in the first instance, and must be financially viable rather than necessarily profit generating. Rather than being though of in purely financial terms, the success of the social entrepreneurship endeavors is measured by the improvement and further development of services, or the establishment of new services and resources.

The social entrepreneur act as a change agent within the public sector
·       Working within a pre- establish remit to create a sustainable social value
·       Periodically identifying new opportunities to support and improve services, and reviewing the underlying social mission of the organization
·       Learning, innovating and reviewing in constant cycle
It also important to note when adopting CE in a public sector, leader will need to take into account the particular environmental constraints on the sector.

CE is the practice of establishing an entrepreneurial environment in a non start up organization; which encourages innovation thinking across the workforce, and establishes entrepreneurial skill sets at the managerial level in order to maximize the potential impact of thinking. CE adds value by systematically, but creatively, addressing change, managing future client demands, and harnessing the capacity for innovation often already latent within the workforce.

Tuesday, June 5, 2012

HOW TO EXERCISE YOUR CRISIS MANAGEMENT TEAM By Chris MacArthur, CBCP, MBCI.


The new chief information officer summoned two executives and myself, the BCP coordinator, to his office to be briefed on our business continuity management program.  As we reviewed the latest executive dashboard report, I could sense his growing impatience.  Finally he blurted out that while he appreciated the update, he really needed to know what exactly to do if disaster struck one of our data centers / centres.

Is your crisis management team (CMT) ready for the unexpected? Do you feel comfortable that they know exactly what to do in a disaster situation?  Don’t fall into the trap that just because they are executives that they will be able to ‘figure it out.’  As we all know a disaster is not the time to think about what to do next.  Now is the time to take steps to improve your organization’s readiness to respond to a disaster while boosting the credibility of your plans and organisation.

Key benefits:

There are several key benefits that your CMT as well as your organization will realize by investing the time to practice what to do in the event of a disaster:

- Improve confidence in knowing exactly what to do. By facilitating a well-planned exercise the CMT will have more experience and knowledge about how they should respond in a disaster scenario.  

- Save valuable time and effort. It is said that in a serious medical emergency there is what is called the ‘golden hour’ in which there is that brief window of time - often sixty minutes - following an injury where there is a higher chance that critically injured patients can be saved if they receive prompt medical treatment.  Based on my personal experience if your senior management are familiar with the pre-defined protocols to follow within the first 60 minutes of a disaster being declared, then there is more likely a more favourable outcome to be achieved. Precious time will be saved if they are provided with awareness and training on how to respond.
\
Provide knowledge on the appropriate response actions to take. During a crisis management readiness exercise your executive team will acquire more knowledge of the response action steps they may need to take when faced with a disaster. This may help to reduce the severity of the crisis, as some confusion would be alleviated.
Let’s now explore concrete ideas to help you improve the readiness of your CMT.  Although there are many choices available, I would like to recommend a table top exercise. This type of exercise is low in cost, has a high degree of finding errors, and will contribute to your executive’s ability to respond more quickly and effectively in a non-threatening environment. Let’s explore some steps to consider to help you develop this type of an exercise.

CMT table top exercise design

As you begin to design your CMT readiness exercise, treat this like a project. This means you will need clear objectives, scope, timeline, budget, top management support, and stakeholder involvement. Although the actual table top exercise should last about two-three hours, there are many hours of preparation needed to ensure you will have a successful outcome.

Here is an outline to assist you:
- Obtain support and commitment from senior management. I recommend you develop a clearly worded memo to the CMT stating the purpose of the exercise, the benefits, and expected outcomes. Don’t forget to include the budget required (i.e. catering costs, travel for out of town participants, meeting room costs, etc.), and the date and time duration of the exercise. Due to the amount of advance planning required, aim for an exercise date at least two months away. Prior to sending the memo verify that there are no other conflicting events which may prevent the majority of your CMT members from participating. Although this may be a challenge each CMT member should have a pre-designated back up person. If the primary isn’t available then the back-up person should be invited to participate. 

- Scope and objectives. Considering our data center example, you will need to form a working group comprised of stakeholders from the data center, a CMT member (alternate member is suggested), communications, operations, and other groups as required. 

- Craft a memo inviting your stakeholders to the working group meeting. Once again you will need to articulate the purpose, benefits, time commitment, and expected outcome of the exercise. In regards to the time required state that there will be a need to meet bi-weekly for about one-two hours for the next two months. Experience has also shown that if this stakeholder memo were to be sent from an executive sponsor it may have more impact. Doing this clearly demonstrates top management support and it will influence your stakeholders.  
- Develop key issues to focus on in the table top exercise. When engaging stakeholders consider using open ended questions to get the discussions flowing. This should help you to identify some common areas of concern. Review any prior documentation that may help you better understand how your CMT responded to previous business interruption events.  Obtain agreement from key stakeholders on the key issue(s) that need to be focused on in the exercise. For example: All CMT members need to clearly understand their roles and responsibilities in determining whether or not to invoke affected disaster recovery plans.


- Identify exercise objectives. Once you have agreement on the issues, engage your stakeholders in discussions to set two-three exercise objectives. Some possibilities are:
  • create awareness of the protocol to follow in a disaster situation;
  • validate the completeness of the CMT guideline package.
- Scenario development. Involve the working group members in developing a scenario and in selecting a triggering event. Some possible sources could be the results of a recent BIA. Should your BIA be not up to date or not yet finalized you may consider facilitating a discussion with the working group to reach a common understanding of the threat landscape. This conversation would need to identify threats and risks, list the internal and external risks, categorize the probability of occurrence and impact, and identify current mitigation strategies and controls that are in place.

- Once this information has been documented, it may be helpful to complete a risk and vulnerability assessment. As you know this requires reviewing the data you have compiled and classifying and assigning a weighting factor to the risks and vulnerability of the data center. This information will be included in your table top scenario, and as well aid the team immensely in risk mitigation for the data centre.

- The final step is to prioritize the threats and vulnerabilities based on the weighting factor. I suggest that you consider a matrix to make this information more visual. Please note that during the table top exercise the CMT members will be asked to also review, validate, and prioritize this information.

- Prepare a crisis response team guideline package which participants would refer to during the exercise. Some points to consider in this guide include:
  • Word document table which consists of a timeline and associated description of actions to take in a disaster. (See below for an example.)
  • Complete contact information for the executive team (don't forget this must also include contact information of a designated back up). The contact information should include not only work and number numbers but also up-to-date Blackberry PIN numbers in the event that the voice network is congested.
  • Conference bridge number reserved exclusively for the CMT;
  • Primary and secondary meeting location that includes the tools the team will need (i.e. white board, conference phone, spare cell phone chargers, LAN connection, laptop and projector).
You now have all of the ingredients necessary to deliver an effective table top exercise which should last no more than two-three hours.

In conclusion, a well-planned crisis management team table top exercise can significantly improve the readiness of your executive team. They will be better equipped to make informed decisions while the clock is ticking. There is no question this will also raise awareness on the strategic value of the business continuity management program and boost the credibility of your plans and your organisation.

Sample CMT Quick Reference Guide


TimeDescription
0:00Disaster Event
Key trigger issues that would lead to activation of the BCP or DRP are:
  • Total loss of all communications
  • Total loss of power
  • Flooding of the premises
  • Loss of the building
< 30 minutesThe CIO may be contacted by either the Departmental Security Officer,  the BCP Coordinator, or by a Data Center Manager that a disaster has occurred
< 60 minutesCIO informs CMT members of disaster event and establishes communication protocol (e-mail, teleconference, in person)  
1 hour 30 minutesCMT convenes and is presented with situation details and impacts from:
  • DSO
  • Data Center Manager
  • BCP Coordinator
 There are three possible options
    • Stand down.  
      • Follow pre-defined BCP procedures
    • Stand by and wait for further details
      • Follow pre-defined BCP procedures
      • Meet in an agreed time to review situation. 
    • BCP invoked
      • Follow pre-defined communications packages
      • BCP Co-ordinator will inform BCP owner and responsible senior manager to action BCP
      • BCP owner instructs the Disaster Recovery Team to activate the Disaster Recovery plan and follow the pre-defined Disaster Recovery steps and procedures.
      • BCP owner updates the CMT at the completion of each major phase of the DR plan (respond, recover, resume,  restore at home site).
      • Disaster has ended CMT de-activates DRP



AuthorChris MacArthur is the IT-Business Continuity Lead for a large department in the Government of Canada. During the past six years he has played a lead role in evolving business continuity from a reactive to a proactive business model. He is often seen as the 'go to' person for providing business continuity advice and guidance. He is a certified business continuity professional (CBCP, MBCI) and is familiar with all aspects of business continuity and disaster recovery planning. cmacarthur@rogers.com

Cyber resilience needs to be top priority for CEOs: World Economic Forum


Hyperconnectivity and the evolution in cyber attacks require CEOs to take ownership of cyber risk management, according to a new report launched by the World Economic Forum developed in collaboration with Deloitte.

According to the report, ‘Risk and Responsibility in a Hyperconnected World – Pathways to Global Cyber Resilience’, hyperconnectivity is drastically changing the way businesses and governments interact, demanding a renewed examination of roles and responsibilities. The report encourages chief executives to commit to a basic set of Principles for Cyber Resilience, and to take the initiative to improve cyber resilience in their organisation.

Deloitte has been working with the World Economic Forum over the past year on the Risk and Responsibility in a Hyperconnected World project to identify and address emerging global systemic risks arising from the increasing connectivity of people, processes and objects. In particular, the project has focused on cyber security as a first priority, working with the private sector and governments to identify pathways to a more secure shared online environment.

Read Risk and Responsibility in a Hyperconnected World – Pathways to Global Cyber Resilience.

Leadership & Strategy: Drucker’s Discipline of innovation


When Peter Drucker makes an observation, the chances are that it will still be highly relevant many years later. Nowhere is this more true than Drucker’s 1985 HBR article, ’The discipline of innovation’. In it, Drucker make a case for three neglected qualities of innovation: not talent, ingenuity or knowledge, essential though they may be: but diligence, persistence and commitment.

The popular image of the process of innovation is that of serendipity combined with genius; of Archimedes leaping from the baths shouting ‘eureka’; of Newton emerging semi-comatose from beneath the apple tree. Drucker’s article seeks dispel that notion. He argues that innovation rarely comes about in a ‘flash of genius’ but as a result of a ‘conscious, purposeful search for innovation opportunities’. For Drucker, there are seven kinds of opportunity. The first tour tend to occur with an organization or industry, the others are external:

Organisational Opportunities
  • ·       Unexpected occurrences
  • ·       Incongruities
  • ·       Process needs
  • ·       Industry and market changes


External Opportunities
  • ·       Demographic changes
  • ·       Change ion perception
  • ·       New knowledge


Unexpected occurrences

For Drucker, these are opportunities where a product designed for one purpose is found to have more valuable or lucrative possibilities elsewhere. Drucker gives the example of IBM who developed the world’s first accounting machine right at the start of the great depression in the early 1930s. Its intended market, the banks, was not interested however but the company was saved by the then prosperous national libraries who found a use for the machines. Drucker notes however that companies are often reluctant grasp those opportunities which they did not forsee. Indeed ‘most businesses dismiss them, disregard them, and even resent them’. There are consequently greater opportunities for those far-sighted and lateral minded enough to know a good idea when they see one, and understand how to adapt it to different circumstances.

Incongruities

Drucker believes that incongruities between expectations and results, between assumptions are realities, are intensely valuable sources of innovation. He notes how the shipping industry faced financial ruin in the 1950s, despite striving towards what everyone though was needed: faster ships requiring less fuel. As soon it was realized that the problem was not the cost incurred travelling from A to B, buth rather wasting time unloading at B, innovation followed. Once the incongruity was exposed, it was a simple matter of adapting the techniques of land-based freight to shipping: roll-on, roll-off and container ships were the logical innovation that resulted and shipping became a significant growth industry.

Process needs

Once again, Drucker explains this term by example, locating the origins of the mass circulation newspaper in 1890s America. For the newspaper as it is known today required two innovations, which resulted from, a process need: the linotype, for the mass production of print; and the social innovation of newspaper advertising.

Industry and market changes

Drucker notes that fast growth often leads to significant changes in the structure of an industry. At times like these, established companies are likely to concentrate on defending existing markets and neglect the major growth industries. Innovative newcomers can take advantages of these changes.

Demographic changes

Of the three external opportunities for innovation cited by Drucker, demographic changes are the most predictable. Drucker urges companies to take advantages of certainty, highlighting how the Japanese manufacturing industry’s ten years lead in robotic began with reliable prediction of a decline in the manual labour force as a result of ‘a baby bust and education explosion’.

‘The innovation opportunities made possible by changes in the number of people – and in §their age distribution, education, occupations and geographic location – are among the most rewarding and least risky of entrepreneurial pursuits.’

Change in perception

How people perceive different situations has important implications for innovation. Drucker speaks of how a shift from an optimistic to a pessimistic view of a situation can either stimulate or impede innovation.

New knowledge

New knowledge is the most complex and time consuming of all innovation opportunities. Example of knowledge based inniovation include commercial banking, the automobile, the computer, the commercial airline industry, all of which required the convergence o numerous different knowledge components, and an individual or group capable of seeing the big picture and pulling them together.

Making use of opportunity

Although it is unlikely that a successful innovator will make use all seven types of opportunity, the chances of being successful are strengthened if each type is borne in mind. Drucker is careful to stress the entrepreneurial element of innovation; identifying a need; analyzing how an innovation will slot to existing markets; studying the habitts and expectations of potential users.

Finally, Drucker stresses how important it is to keep innovation simple. Good innovations ‘try to do on specific thing’. But it should be specific thing that nobody has yet thought to do. And finding what that doesn’t require genius. It needs a lot of hard work.