SJU In House Ownership Organizational Leadership Discussion

SJU In House Ownership Organizational Leadership Discussion

Sample Answer for SJU In House Ownership Organizational Leadership Discussion Included After Question

SJU In House Ownership Organizational Leadership Discussion

Each of your posts to every topic each week should consist of at least two substantial paragraphs. Each member of the group is asked to respond meaningfully to at least one other member’s posts—when practical. “Meaningful response” suggests that your comments go beyond, “I agree,” or “good thought!” Please note the following VERY carefully. Discussion boards are just that; they are not mini-term papers. Obviously, you will use a source or two in your response, but what YOU say about it is most important. Make certain that you use internal documentation (parenthetical citing) when you write your discussion, e.g.(Smith, 2018). It is not good enough to simply put the reference citation in the post at the bottom. That is needed, but make sure that the reader can identify which sentence(s) refer to the citations. Hence, the parenthetical reference, a.k.a. Internal Documentation. Q/ Section 3.3 on page 42 discusses “A Launch Argument Formula: Seven Principles.” Examine the concept of In-House Ownership and discuss what it means in some detail. Find one related citation from credible sources that further amplifies the concept of ownership of a business related function and share major principles underlying the entire concept with other participants. On a side note, present your concept of “ownership” of a concept, activity, or project in an individual basis. What does a mean to own a concept or product? Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 42 3.2.1 Initial Project Copyright 2016. Rothstein Publishing. All rights reserved. May not be reproduced in any form without permission from the publisher, except fair uses permitted under U.S. or applicable copyright law. During the initial project phase the emphasis is on exploring the possibilities and developing the procedures. In many large-scale organizations the startup team forms a center of excellence which provides ongoing support for a number of local administrators. e startup team visits each department, division, or location and carries out the project part of the program before moving on to their next target area. In this way, the core group builds up knowledge and skill without getting bogged down with too much of the detail. For the central core group, BC is a unique and interesting vocation with a worthwhile outcome, while the local administrators are more likely to see it as an important job that needs to be done properly with due care and attention to detail. …bring the BC discipline to management’s attention, provide the tools, and help along the way. 3.2.2 Permanent Process BC management is a permanent, iterative process which it is usually best to approach as the second phase following on from an initial project. A different attitude and mindset are required for the ongoing maintenance process. is is when things are more or less stable and attention to detail and accuracy come to the fore. Administrative teams are given a set of tools and procedures to enable them to carry out regular reviews, revise the procedures where necessary, and keep the records up-to-date. 3.3 A Launch Argument Formula: Seven Principles My arguments for a BC launch are normally based upon seven principles. Occasionally, circumstances might dictate that I follow some in-house rules, in which case I apply as many of my principles as I can without straying too far from the given requirement. ◗ ◗ ◗ ◗ ◗ ◗ ◗ Ensure in-house ownership. Provide five relevant examples. Display observance. Allow cognitive marketing. Reach and withdraw. Remain realistic. One step at a time. 3.3.1 In-House Ownership From the very outset you need to make it perfectly clear that company leaders are the owners of the whole program, which is going to be for the benefit of their business, their customers, and their staff. As a consultant, or a facilitator, you will be bringing the skills, tools, and techniques to the party but, in the long term, they will need to do the bulk of the work themselves because they are the only ones who really understand all the nuances and subtleties of how the business actually operates on a day-to-day basis. As outsiders, you and I can only set them up and point them in the right direction. Now, I can hear some of you saying that you are not consultants or that you do not consider yourselves as outsiders. However, from a practical perspective, all BC practitioners are external to the business activities which they seek to protect. Your task as a BC professional is to bring the BC discipline to management’s attention, provide the tools, and help along the way. roughout this process, you will be transferring skills to EBSCO Publishing : eBook Business Collection (EBSCOhost) – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS AN: 1216841 ; Burtles, Jim, Noakes-Fry, Kristen.; Principles and Practice of Business Continuity : Tools and Techniques Second Edition Account: s4084935.main.ehost Getting Started Chapter 3 43 managers at various levels, aer which you will stand back and let them get on with it. As the center of competence, you will remain available as a reference source and support center. It is vitally important that the business operators own their BC plans and procedures. ese documents and their implications must never be seen or regarded as items on the shelf which have been brought in from outside. ey need to be seen as the living, breathing components of survival in the event of something going wrong – as it inevitably must. It is important for you to make it clear that your involvement should be not seen as an eternal commitment. Too oen, I have seen consultants who seem unable to “let go.” ey come in and set up a permanent program which requires them to return time and time again, to review and update the plans and procedures ad infinitum. Oen their excuse is that the subtleties and complexities of the methodology require specialist knowledge or training. Of course, they have not passed on that vital knowledge or training to their customers, leaving them in the dark and dependent. BC customers should not be regarded as a captive audience to be enslaved but as independent and fully capable free spirits who can, and should, take responsibility for their own success and survival. 3.3.2 Five Examples Having assured the top management team that you do not see them as a so touch and that you are going to make their people responsible for, and capable of, continuity, you need to convince them that it is necessary. e best way to get this message across is to use some real-life examples of things going wrong. You can quote statistics, such as the number of fires that have occurred or the frequency of power outages, but numbers don’t create vivid pictures in the listeners’ minds, and it is colorful images that carry weight in an intellectual argument. Carry out some research about unexpected and disruptive events which have recently occurred. …develop a body of knowledge which will give you the confidence to put forward a good argument…. I always try to offer five instances of significant events. Anything less than five leaves room for explanations or excuses. Here I am thinking of responses like: “Oh that couldn’t happen to us, we’ve got security guards.” “Our local authority has flood plans.” “e fire service has that under control.” On the other hand, more than five makes you sound like a merchant of doom trying to predict the very worst, and the worst has never happened to us – yet. e rule here is recent, relevant, and remarkable. ◗ ◗ ◗ Recent makes it more interesting because they may not know the full details. e 1896 earthquake in San Francisco or the destruction of Pompeii is unlikely to persuade a business person of the need to pay attention to what comes next. Relevant makes it even more interesting because it is closer to home and, therefore, more meaningful. Relevance means something which happened locally, something which happened to someone your listeners know, or something which happened in a place like theirs. Remarkable tends to ring alarm bells and make people wonder whether they have got that base covered. Wondering leads them towards worrying, and worry can spark action. Here we are looking for the unexpected which could be a question of something unusual, a matter of scale, or surprise that it was allowed to happen. Five different types of events will add variety and help your audience to see things from alternate perspectives. Almost always, there will be a recent fire which made the news. Another common disruptive scenario is bad EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 44 Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition weather, which could take the form of hurricanes, tornadoes, floods, freezing conditions, or dust storms. Power outages are also commonplace in most parts of the world. Tsunamis and earthquakes can occur in many regions. Transport problems are yet another common cause of disruption. Pollution may also be a contender in some areas and some industries. Of course, in some industry sectors there may be a regulatory requirement for BC, but that could result in a tick-in-the-box solution which may prove to be quite ineffective in a real emergency. Something which simply appeases regulators or satisfies auditors is not necessarily going to generate enough support and enthusiasm to thoroughly prepare for the worst case scenario. Before confronting your audience with these scenarios, think about how you would respond to any challenges which they might throw back at you. Make sure you have your facts and figures at your fingertips, and it might help if you have a couple of additional similar examples up your sleeve to reinforce the message you are trying to get across. In other words, try to develop a body of knowledge which will give you the confidence to put forward a good argument based on facts delivered with a convincing degree of certainty. 3.3.3 Observance I find that it improves my image if I demonstrate my powers for observation. It shows that I am on the ball in the sense that I know what I am doing and also in the sense that I am alert and taking their case seriously. You may work for the company and are not coming in as a consultant, but, as I said earlier, from a practical perspective all BC practitioners are external to the business activities which they seek to protect. When you look at your company from a BC perspective, you are looking at it with new eyes. Before I cross the threshold of a new customer for the first time, I take a few minutes driving through the surrounding area looking for clues about running a business in that part of the world. I am looking to see if there are any potential problems in the immediate neighborhood. Is there ease of access? Are there any factors which might affect staff or visitors should they have to evacuate the premises? e sort of things I am looking for are signs of parking restrictions, busy roads, catering facilities, and somewhere where they can take shelter or gather together in comfort and safety. Perhaps there is a company parking lot which could be used as an assembly area, or there might be a park nearby. As I enter the premises and pass through reception, I make a point of checking the emergency evacuation signs and any instructions about fire alarms or other emergencies. Sometimes the receptionist or the security desk will point out whether the company plans to have a fire drill or test the alarm. In a really well organized, or a particularly hazardous, location there will be safety or evacuation instructions available for visitors. Oen these instructions are incorporated into the visitor’s pass. In any case, I usually find enough little snippets to be able to make a few casual remarks about the environment in which the company appears to operate. Even if I am wrong about my interpretation of what I’ve seen, at least I was paying attention, and the experience has had a chance to teach me something useful. 3.3.4 Cognitive Marketing Cognitive marketing is a conversational concept which I have constructed for myself as a psychological tool for use in a teaching or a marketing situation. It is a relatively simple concept, but it only works if you are careful and patient when applying it. If you want someone to believe something, then you should allow them to discover it for themselves. When you stumble across a useful piece of information or clear understanding, you are much more likely to accept it and trust it because it is yours, it is your discovery. is moment of cognition or realization embeds that piece of EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Getting Started Chapter 3 45 data into the private and personal area of your mind and memory. From then on, it becomes a part of you. On the other hand, if someone were to simply tell you that same fact, you will remember it or grant it significance only if it aligns with what you already know. Example In 1993 an enterprising young businessman by the name of Richard Pursey was thinking about launching a disaster recovery service. His intention was to provide customers with rapid access to an emergency supply of PCs. e reasoning behind this was simple: in the event of a disaster, companies need people, premises, and computers in order to be able to do business. People and premises, at that time, were in plentiful supply, but it was not easy to obtain large supplies of PCs at short notice. Richard met the recently knighted Andrew Lloyd Webber at a dinner party (they both lived in the same neighborhood). Andrew spoke enthusiastically about a new musical (Sunset Boulevard) he was working on and aer a while he turned to Richard and said, “Tell me what’s going on in your head these days?” Richard explained how important it was for commercial organizations to have access to computers, especially if they had just lost their premises due to a fire or some other kind of emergency. Andrew interrupted with a big smile on his face. “ere is a business opportunity here! I’d like to invest in it if you think you could make it work.” Rather than argue or elaborate, Richard was sensible enough to smile and offer his hand. Richard went home with a check for £150,000 in his pocket. Andrew went home thinking he had just invented what we now call “business continuity.” A new disaster recovery service named Neverfail was launched shortly aerwards. To this day, Andrew Lloyd Webber still believes that he created a new industry when he discovered that his friend had a problem at the back of his mind. 3.3.5 Reach and Withdraw Another subtle way of persuading people to want what you might be able to offer is a technique that I call reach and withdraw. It is a subtle form of teasing in which you reach out towards them with a tentative offer of something enticing. en, when you have gained their attention and interest, you withdraw or walk away. eir natural instinct is to follow you because you have caused them to want something at a subconscious level. For the moment they are like putty in your hands – until someone or something else catches their attention. In a BC launch context, I use this technique to show them that some desirable objects can emerge from the BC process. The most appealing benefits at this early stage are those which are tangible rather than virtual. Something tangible which they can touch and feel is going to be more meaningful than the promise of some virtual service that they don’t yet fully understand. If it can be seen to exist physically, then there is no doubt that it is real, whereas a promise, a description, or a fancy title carries very little weight in a hypothetical argument. e way it works is like this. I arrive with a bag of hidden goodies. e bag is obvious because I put it on the desk and make sure it is always close to hand. ere is a subtle unspoken message here: I value what’s in that bag, it’s precious. When we get around to discussing the business of the day, which is “when things go wrong,” I reach into the bag and produce a newspaper clipping or a photo of a recent disaster. is is an illustration to reinforce what I am saying, food for thought but not something to dwell on. So I put the picture down and move on to talk about what might be useful if ever something like that happened to them. I mention that one possibility would be to send someone on a training course, at the end of which he or she would come back with a binder full of ideas and solutions. I reach into my bag and produce a course manual which I put on the desk. Shortly aerwards, I add a few other goodies which the student might acquire: some sample documents, a few templates, and a mounted certificate. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 46 I suggest that if they were to sign up with a disaster recovery service, for example, then they would get an instruction manual and some invocation instructions, together with a map showing how to get there. More stuff out of the bag. By now, I have amassed quite a pile of useful items. Whenever possible, support your ideas with powerful visual aids… en I suggest that, as an alternative, they may prefer to rely on their own resources and appoint one of their staff to prepare some BC plans. is leads me to describe the outcomes of such a program and, one by one, a series of reports and plans emerges from the bag. In closing, I say, “Armed with all these sources of information, I would feel quite confident about dealing with whatever might happen, but you might see things differently.” At this point, I gather up all my goodies and put them back in the bag ready to walk away. Usually my withdrawal leads to someone wanting to explore this whole subject in a bit more detail. “Don’t run away, we were just getting interested in what you were saying.” 3.3.6 Remain Realistic roughout this argument, which is, aer all, a sales campaign, you have to remain realistic and try not to exaggerate. Two methods of creating realism are: ◗ ◗ Use relevant references, stay real, and avoid flights of fancy. Use images to convey solid messages. Relevance will be achieved if you stick with local, or at least familiar, reference points. Stick with reality, don’t exaggerate, and avoid flights of fancy. Try to bear in mind your customers’ areas of interest and their background. Keep your examples within the experience of the listeners. ere is no point in talking about a plague of red frogs that has only ever occurred once on a remote island in the Pacific, unless, of course, you happen to be in that part of the world. Imagine you were a football or soccer player getting ready for an important match. Would you be interested in hearing about how my uncle prepares the village green for a cricket match? You might prefer to know what David Beckham says about being mentally prepared. I can’t tell you because I don’t know, but we could discuss it and share our views. Images are our most powerful communication tools. e whole purpose of any dialog is to create pictures in the mind of the receiver; otherwise, nothing meaningful occurs. Whenever possible, support your ideas with powerful visual aids. roughout the argument, remember that words and sounds don’t always have the same impact as visible physical objects. ey do say that “a picture paints a thousand words.” I would add that 3D is better than 2D. In other words, a realistic model is even more powerful as a means of conveying a message than a painting or photograph. e addition of mass into the mental equation literally adds weight to your argument. Even something as simple as the “goody bag” in the section above offers an impactful visual message not possible in a thousand words. In my pocket I always carry a Swiss penknife and oen use it as an example of planning ahead, preparing for the unknown, and excellent workmanship. Whenever I talk about it, I show it to people and then let them handle it so they can get the feel of it. If they open it up they can see how it works and imagine themselves using it. From then on it symbolizes to them just how practical I am, especially if I embroider the conversation with a few tales EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Getting Started Chapter 3 47 about making use of the scissors, screwdriver, tweezers, and sharp blades. It does more for my credibility than asking them to read a two-page CV. 3.3.7 One Step at a Time Although you and I know that BC is a continuous program with a number of stages, many of which are reiterative, it is best to allow management to focus on one task at a time rather than try to get them to commit to supporting a long, complex, and probably expensive campaign. It is better to approach it as a stepby-step process in which each step will lead inevitably towards the next. You should also allow for each of these steps to deliver a final outcome, at least in the minds of your sponsors. For example, the first step in the BC process would be to carry out some form of investigation regarding the potential threats and the defense measures which are already in place. It is reasonable to suppose that the report at the end of this process will contain recommendations about dealing with the threats. However, you should also allow for the possibility that there may appear to be no need for further action. Although, in fact, this is a rather remote possibility it should not be ruled out. Otherwise, you will be seen to be instigating a self-fulfilling prophecy, a short-term project with a hidden long-term agenda. Another school of thought maintains that it is best to gain board-level commitment to BCM in entirety at the outset. If you can achieve that, then you have gained support for the whole of the program. It is a bold approach which brings dividends if you can pull it off; however, you may prefer the more tentative incremental style. 3.4 Board-Level Motivators The launch presentation which we have just explored is a means of creating interest in the subject and possibly promoting some debate. Hopefully it will help you to gain the support of a board-level champion. However, it is unlikely to generate more than a token commitment from a financial perspective, and without any funds your program is not going to last very long. Beyond the initial launch, you may need to build a proper business case in order to justify the anticipated investment involved in setting up a permanent BC process. You will be asked to submit a proper proposal with some numbers attached. This book will explore four particular aspects of the business case for investing in a BC program. A solid case can be built within these principal dimensions: ◗ ◗ ◗ ◗ External influences, i.e., understanding the drivers. Internal factors, i.e., estimating the impacts (backlog trap). Practical considerations, i.e., adopting the techniques. Suitable timing, i.e., developing the opportunities. ese ideas can also be grouped according to why, how, and when. e ideas presented here are based on generalities rather than local knowledge, and you will need to adapt them to fit your own particular circumstances. 3.4.1 External Influences In almost any industry or sector there will be a number of external influences which affect the manner in which the company is managed and operated. ese are oen referred to as business drivers because they do steer the business in what others see as the right direction. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 48 Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition Government Guidelines, Regulations, and Standards Your local or national government may issue guidelines or regulations which suggest or require some form of BC planning or preparation. In some parts of the world, local governments actively promote BC. In the UK this is a direct result of the Civil Contingencies Act 2004 which requires local government to offer support in this area. e Monetary Authority of Singapore issues Business Continuity Management Guidelines to its financial institutions and expects auditors to check for compliance against these guidelines. If a business collapses unexpectedly or if someone gets hurt… it can result in an investigation that could lead to a court case. In South Africa, all listed companies are required to follow the governance principles which are outlined in the King Report III 2009. e report includes references to what it calls “business rescue and integrated sustainability” which can be achieved through BC. ose industries which are regulated are normally required to comply with a detailed code of conduct or guide to good practice. Almost all of them have some reference to the need for BC planning. (For more about standards, see Section 3.6 below.) Risk of Liability or Negligence Another important external factor is often overlooked. In the event of something going wrong, somebody is going to be liable. If a business collapses unexpectedly or if someone gets hurt as a result of negligence, it can result in an investigation that could lead to a court case. At the inquiry or in the courtroom, the prosecuting counsel is probably going to ask for evidence of proper planning and training to deal with such an event. Even if the lawyer fails to impress the judge, there is no doubt that the media will have a field day. e likely charges are criminal negligence or corporate manslaughter, and the penalties can be quite harsh. In the UK, for example, e Corporate Manslaughter and Homicide Act 2007 facilitates the prosecution of corporate entities where a death is caused by a breach of a duty of care, and senior management failings are a substantial element of such a breach. e suggested starting point for a fine following a corporate manslaughter conviction is £500,000 according to the sentencing guidelines. Although there have been relatively few prosecutions to date, organizations should not be lured into a false sense of security. Recent figures suggest that the UK Crown Prosecution Service investigated 40% more corporate manslaughter cases in 2012 than it did the previous year. From a public relations perspective it is good corporate citizenship to be fully prepared to meet the needs and expectations of the staff and customers. Meeting these needs includes offering staff a sustainable and safe working environment while offering customers a continuous supply of goods and services. erefore a weak or missing BC program must be seen as a sure sign of poor corporate citizenship and inadequate governance. 3.4.2 Internal Factors Failure to Exercise Plans In an ideal world any organization of any substance would already have a policy in place which supports the requirement for regular exercising of their BC arrangements. Of course, there are many enterprises which are somewhat less emphatic about the need to prepare for the inevitable. There are three likely reasons for a EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Getting Started Chapter 3 49 lackadaisical approach to risks and threats: either they don’t know, they can’t see, or they simply don’t care. In the latter case it might be easier to walk away than bang your head against a brick wall. Where there is lack of knowledge or vision, then you can offer to open their eyes or provide them with some facts. Failure to Review Physical Risks Offer to conduct a review of the physical threats with a view to identifying whether there is a need for some BC measures. is only needs to be a simple overview which can be carried out fairly quickly without much effort. An hour spent with the facilities manager, or an equivalent staff member, will soon reveal whether further action should be considered. Unfortunately, spare capacity is probably rather limited, and the team spirit may not survive the incident. Backlog Trap Perhaps the most important factor which allows top management to underestimate the need for some effective response and recovery procedures is the backlog trap which this book covered in the first chapter. It is easy and natural to assume that the return to business as usual is just a matter of engendering a bit of team spirit, calling for a concerted effort, and making full use of the spare capacity. Unfortunately, spare capacity is probably rather limited, and the team spirit may not survive the incident. 3.4.3 Practical Considerations Before top executives agree to authorize you to embark on something relatively new to them, they will want some reassurance that you know what you are doing and how you are going to go about it. Some basic decisions need to be made here before you can put forward a proper business case. Reassuring Management About Sources of Techniques Executives will want answers to questions like: “Where do you get your ideas from?” “Whose methodology or techniques will you be using?” “How will you adapt it to fit our organization?” “Will it fit into our culture?” “Can we really afford it?” You should reassure them that any of the standards or guidelines which you use as your reference will allow sufficient flexibility to enable you to adapt the concepts behind their recommendations to fit their needs and requirements. Explain that all of these models will have been developed by people with some degree of expertise, and because no two organizations are alike at the detail level, experts will have drawn up their guidelines to be relatively flexible and user-friendly rather than pedantically precise or restrictive. However, you should be prepared to give them a clear picture of how you propose to approach the work. (See Section 3.6 below.) Deciding Whether to Select a Consultant Whether you want to call for any outside help will depend upon your own confidence and capability as well as the corporate culture. Some companies regard consultants or other external experts as unwelcome and unnecessary, whereas others see them as helpful and unavoidable. Where specialists are frowned upon, you will need to work out how you are going to acquire the skills and techniques to do the job yourself, perhaps in collaboration with others. If you think that you might be allowed to bring in outside help, then you should do some research into who might be able to help and how the person you are considering would like to approach the job. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 50 Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition Explore a range of choices: If you are looking to refer to consultants, then you need to be fairly selective and explore a range of choices. Consultancy practices come in all sizes and varying degrees of specialization; bigger is not necessarily better. What matters most is the background, skill, and experience of the individual with whom you will be working. Make sure that you get to meet this person and understand his or her approach before you commit to using this consultancy and its methodology. In particular, you need to ensure that there will be some skills transfer included in the project so that you do not have to rely on the consultant permanently. Ideally, your consultant should be able to provide you with references which show familiarity with your industry sector and your part of the world. You also need to establish that the consultant will follow good practice and can deliver a complete package which will suit your needs. Review qualifications: Make sure that companies being considered are properly qualified and experienced, especially if you are looking for them to take the lead throughout the work. In any case, it is well worth checking their references, looking for evidence that they have experience that is relevant to your industry sector and your part of the world; otherwise, the expertise is irrelevant. If the consultant has a certificate, that qualification will prove that he or she has at least had some formal education in the subject. Ideally, that certificate should be aligned to a recognized standard or a code of practice, such as ISO 22301 or Good Practice Guidelines 2013. …the whole organization should be dealt with gradually… rather than one single massive effort. A more robust and meaningful qualification would be membership of the Business Continuity Institute (BCI) because this shows that the consultant has proved his or her knowledge in an examination and has some practical experience in the subject. Statutory membership of the BCI entitles the consultant to have letters after his or her name and also means that the consultants follow an ethical code of professional practice and are competent in following the discipline of BC. Statutory or official grades include Associate Member (AMBCI), Member (MBCI), Associate Fellow (AFBCI), and Fellow (FBCI). In addition, BCI offers a certificate (CBCI) or a diploma (DBCI) to recognize those who have demonstrated their knowledge of the subject in a formal examination. CBCI is awarded to those candidates who passed the CBCI examination but have not achieved full statutory membership. DBCI is awarded to those who have an academic qualification by taking a distance learning program in partnership with Buckinghamshire New University. Evaluate methodology and software: Ask whether your consultant, or external adviser, will recommend, endorse, or insist upon using a particular methodology or soware at any stage of the game. If he or she expects you to use a proprietary soware tool, there will no doubt be an associated cost of which you should be aware. Another issue could be the question of where that soware and associated information is expected to be located. It may or may not be wise to entrust the intimate details of your business operation to what is, in effect, a third party. You also need to seek assurance that their approach will be compatible with any standards with which you may want to align or comply. 3.4.4 Suitable Timing Because the risks and threats, whatever they may be, are eternally present, it makes sense to implement your protection and recovery program as soon as realistically possible. However, there are oen many more pressing and apparently important tasks to be considered, especially when viewed from a high-level corporate perspective. On the other hand, there are oen quieter periods when top management can afford the time and energy to consider some of the secondary issues which they tend to hold in abeyance most of the time. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Getting Started Chapter 3 51 You need to choose the right moment to make your bid for their attention. is means you need to be aware of what I call the “corporate chronology.” ere will be regular busy times of the year and month, occasional frantic periods, and a few periods of relative calm and stability. Obviously, you have to time your bid for their attention so that other more pressing matters don’t conflict. In addition, there may be seasonal concerns. For example, one of my clients who was in the jewelry trade reckoned to do 90% of his turnover in the six-week period before Christmas and about 8% in the four weeks before St. Valentine’s Day. us, for 42 weeks of the year, his shop was there simply to establish his presence in the market in readiness for the few weeks when he expected to make a profit. Needless to say, there were times of the year I didn’t get to visit him. 3.5 Scaling to Fit Your overall game plan should take account of the number of business divisions, units, and locations. is means that the whole organization should be dealt with gradually as a series of relatively small projects rather than one single massive effort. us, you may end up with a large number of plans with several relating to each location. In order to manage and maintain these plans it is desirable for them all to follow a similar layout and form part of a well-organized structure. e easiest way to do this is for you to emulate the structure of the organization itself. Regard it as a series of separate entities, each of which is a relatively independent business unit or function. Harmony is achieved by means of a management hierarchy which you can represent through an overarching emergency response plan for each location. At an even higher level, you can prepare a crisis response plan to cater for the protection of the brand and image of the whole enterprise. By adopting an approach which is based on a separate plan for each business entity, you can use the same tools and techniques no matter how large or diverse the enterprise is. Of course, you can combine the plans for all of the entities at one location to form a local master plan, which consists of a number of similar modules. However, each entity will only need to have and to use the particular module which covers its recovery procedures. Further details of this modular approach to BC will be revealed in Part III of this book, which addresses the shape and contents of the various types and levels of plans. 3.6 Standards and Their Interpretation Your top management is likely to want assurance that whatever you do in pursuit of your desire to deliver BC will align with the recognized standards. ey may not know what those standards are, but they will be pretty sure that something exists and will expect you to be in a position to reassure them. As you can imagine, a number of existing and planned standards cover BC and related subject matter, many of which are of local or limited scope and applicability. However, four key regions can be identified, in which BC is a well-established and recognized discipline: the international scene, UK, US, and Australia. International In 2012, the International Organization for Standardization (ISO) published ISO 22301:2012, Societal security – Business continuity management systems – Requirements, which specifies a system for managing an organization’s business continuity arrangements. is document is rather formal in style in order to facilitate auditing for compliance and certification. It is supported by ISO 22313:2012, Societal security – Business continuity management systems – Guidance, which offers more practical advice about implementing and EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 52 running a BC management system. ere is also ISO/IEC 27031:2011, Information security – Security techniques – Guidelines for information and communication technology [ICT] readiness for business continuity, which offers guidance on the ICT aspects of BC management. is latter aspect of the BC discipline is also commonly known as disaster recovery. According to Andrew Hiles, ISO 22301, because of its emphasis on preparedness rather than recovery, “will become the most applied standard world-wide,” possibly winning “long-term commitment to BC from the Csuite.” Compared to previous standards, Hiles notes that the compliance requirements of ISO 22301 “will cause more maintenance effort, but should result in more consistent and continually improved efforts within BCM” (Hiles, 2014). United Kingdom Prior to the release of ISO 22301, BC standards progressed through two iterations in the UK. In 2003, the British Standards Institution (BSI) offered Publicly Available Specification PAS 56 for review and comment. In 2006, BSI introduced British Standard BS 25999, a two-part BC management standard. Part 1 – A Code of Practice offered pragmatic implementation guidance, and Part 2 – A Specification formally specified a set of requirements for a BC management system. In 2012, both PAS 56 and BS 25999 were withdrawn and replaced by ISO 22301. e Business Continuity Institute (BCI) published Good Practice Guidelines (GPG) 2013 as an independent body of knowledge for good practice in BC around the world. e terminology and concepts used in these guidelines are in line with those used in ISO 22301. United States Published by the National Fire Protection Association, NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs has been described by many experts as a clear and unambiguous outline of what to do and how to do it in a sensible progressive manner. Originally published in 1995 as a set of recommendations for good practice, it was upgraded to the status of a standard in 2000. e 2013 edition of NFPA 1600 includes: ◗ ◗ ◗ A section covering training and education. A comparison between the standard and Professional Practices published by the Disaster Recovery Institute International (DRII). (Note: Professional Practices is intended as a guide for practitioners and a tool for auditors. The body of knowledge covers the 10 core disciplines of BC management.) An annex or appendix about using NFPA 1600 as a Management System Standard. NFPA 1600 is deemed critical for emergency management officials in the private, public, and not-for-profit sectors, and for professionals charged with BC. Australia Two guides published by Standards Australia, HB 292-2006: A practitioner’s guide to business continuity management and HB 293-2006: Executive guide to business continuity management, offer an overview of what they describe as “generally accepted practices” and emerging new practices, particularly in Australasia, the US, and the UK. The practitioner’s guide also points out that what works well in one organization may EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Getting Started Chapter 3 53 not suit a different one, advising that caution be exercised when deciding exactly how BC should be implemented. The executive guide explains why a business enterprise should invest time, money, and effort into protecting the interests of all its stakeholders. For a truly comprehensive overview of all the relevant standards and regulations that apply in different regions around the world, you should consult BCM Legislations, Regulations, Standards and Good Practice, published by the BCI. The 84-page document summarizes the current legislation, regulations, and standards that exist both nationally and internationally for BC management (Business Continuity Institute, 2014). 3.6.1 Compliance Issues Many of our major industries and sectors are governed or regulated by sets of rules, regulations, or guidelines and, as time goes by, more and more of our business operations will be in a position where they have to take compliance issues into account as a regular part of their organizational governance. Inevitably, BC is being included as a key component of such compliance. …there will be many opportunities to spot better and safer, ways of doing thing. With regulations, standards, and statutes increasingly adding to the administrative burden, many executives are beginning to wonder whether it is even possible to comply with all of these rules. Surely, some of these independently formulated models are going to be at odds with each other which must mean compliance with one directive or guideline is almost bound to lead to non-compliance in another area. is leaves decision-makers with the question of which to choose in order to be the least exposed – or is it better to ignore them all and take a chance? e regulators, watchdogs, and other authorities will gradually persuade us that opting out is neither in their best interest nor ours. Eventually, the authorities will take measures to ensure we do comply with their guidelines or standards. When it comes to BC, we are in the fortunate position that the various standards which have sprung up around the world do tend to align with commonly accepted good practice. As a profession, we have been careful to make sure our expert opinion was taken into account during the development of almost all of these sets of formal documentation. e concepts behind these outlines are really very similar, although the detail may differ according to local ways of doing things – and then there is the inevitable jargon which creeps in to confuse the issue. Aer all, BC is mostly structured common sense; so it should always be recognizably similar in its approach, even if some of the specifics are variable. Compliance, then, is largely a matter of interpreting the concepts behind the standard and applying those concepts to your particular situation and circumstance. Any reasonably competent reviewer, auditor, or inspector should understand that this is the only way to make BC fulfill its intention rather than use it as a means of obtaining a tick in an obscure box. 3.7 Hidden Benefits Whereas most people know and accept that BC provides both resilience and protection for the core business operations, many fail to appreciate the hidden benefits which can spring from such a program. ere are several areas where BC can deliver bonuses, and there are other areas where BC principles, processes, or procedures can be used to advantage. Some of the areas where BC management can help will include: EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 54 ◗ ◗ ◗ ◗ ◗ ◗ ◗ 3.8 Mergers of businesses, operations, or functions. By viewing the project as a planned emergency, the benefits will include risk identification and reduction as well as the means for prompt recognition and response to any out-of-line situations which may develop during the merger. Relocations or the establishment of a new operation. In the same way, the transfer of existing operations or the establishment of new operations should be approached as a potential emergency. In addition, the event can be viewed, and used, as a real-life emergency response exercise with a number of lessons to be captured for future occasions. Functional and procedural improvements. During the assessment and analysis stages of BC, there will be many opportunities to spot better, and safer, ways of doing things. As a result, you could end up with a robust business operation which is not only stronger but also more effective. Sales and marketing strategies. By looking at the marketplace from the perspective of BC, using scenario planning techniques, you can help decision-makers to gain a fresh perspective on long-term sales and marketing strategies. Sales and marketing opportunities. In the event of changes in the market, those who are best prepared to spot the changes and respond rapidly and effectively are likely to gain market share in both the short term and the long term. BC plans should take such matters into account and develop techniques and strategies which are designed to maximize such opportunities. Flexibility in operating procedures. While preparing for a possible emergency, the continuity planning process will naturally identify alternate ways of serving the corporate mission or meeting customers’ needs. Most, if not all, of these ideas can be employed to provide flexibility, if required. Improving the utilization of key resources. e early stages of BC require a fairly thorough analysis of the functioning of the organization and the way it employs and manages its key resources. Because this work is carried out from a relatively unbiased viewpoint, the output can be seen as a relatively honest appraisal of resource utilization. ere is an obvious opportunity here to review and improve the current way of doing things. However, if any significant changes are made, the analysis will need to be revisited. The Auditor’s Role Wherever there is an internal audit function, you have an immediate ally who can help to set the scene for the successful launch of a BC program. There is a strong chance your internal auditor or audit department will already be aware of the benefits of BC. On the other hand, if your auditors are not up to speed on the subject, then a short period of education should soon bring them around to recognizing that a BC program would be a distinct advantage. …without a proper BC plan, you could be in breach of data protection legislation… BC is also an essential part of protecting the data which is held by an organization. e implication here is that without a proper BC plan, you could be in breach of data protection legislation which is common to most countries in one form or another. e only exception might be a claim that your records do not contain the names and addresses of any individuals and therefore you can claim exemption. However, there are very few organizations where this applies in practice. In the longer term, your auditors can help to keep the program rolling by asking to see evidence of progress, such as reports of tests and exercises. ey might even wish to cast their eye over the actual plans themselves. Although auditors may not have the expertise to make meaningful comment, they can express interest or concern in their annual reports, which will be seen and read at the highest level. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Chapter 3 Getting Started Self-Examination Questions 1. The kick-off meeting for the business continuity (BC) program must be designed to A. verify that all response-and-recovery teams are ready to go into action. B. confirm with the legal department that the BC program is in compliance with regulations. C. establish the need for a BC plan in the minds of senior managers and ensure their buy-in. 2. When developing the action plan for the BC program, it is important to A. achieve a series of deliverables with a logical sequence. B. encompass all the organization’s needs in one initial step. C. impress management with your expertise so they let you implement the program the way you see fit. 3. Which of the following is NOT one of the seven principles used as the basis for a BC program launch? A. Provide five relevant examples. B. Reach and withdraw. C. Use scare tactics. 4. Cognitive marketing can be described as A. appealing to the audience’s intellect rather than to their emotions. B. persuading someone of an idea by allowing them to discover it for themselves. C. carefully observing the environment of an organization for details that may be useful. 5. Which of the following would be an example of an external influence to include in the business case for BC? A. Failure to exercise BC plans. B. Industry guide to good practice. C. Assurance that BC practices will be adapted to the organization. 6. Of the following standards, which is likely to become the most applied internationally because of its emphasis on preparedness? A. ISO 22301. B. NFPA 1600. C. BS 25999. 7. Relocating the firm’s operations or initiating new operations A. is not related to BC, and such business activities should never be confounded with disaster preparation and recovery. B. intersects with BC only in that the new premises or operations will need to be incorporated into the scope of the BC program. C. can be approached as a potential emergency, with lessons learned captured from the exercise. 8. The BC manager should view the organization’s auditors as A. natural allies, as they have an interest in data recovery and a penchant for reviewing tests of the organization’s systems. B. probably uninterested, as their expertise lies in the organization’s financials and BC has a holistic focus. C. possible opponents, since the costs of BC can be difficult to incorporate into the cost-accounting structure. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 55 Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 56 Food for Thought In this chapter we have begun to look at how to get your BC program off the ground in what we have called a launch argument. Here we are using the term argument to suggest a meaningful debate in which you aim to persuade others to accept your point of view. Now try to imagine how you might apply those principles to your own organization. You could also consider how you would approach the task in relation to a college or a nearby shopping mall with which you are familiar. Another possibility would be to use the example of a company where a family member or friend works. Exercises 1. How and when might you be able to arrange the opportunity to deliver a launch argument? › Who will form the audience for this argument? › Will it be a specially arranged meeting or a regular scheduled meeting? › How will you ensure that you get the chance to air your views? 2. Develop a draft launch argument. › What recent and relevant events could be used to illustrate your argument? › Which five of these recent events will you use in your presentation? 3. Define exactly what you expect to gain from this meeting. › Make a list of the possible outcomes and rank them in order of probability and preference. › How do you propose to ensure that you get the best of the possible outcomes? 4. What additional advantages or side benefits would support your argument? › Rank them in order of their value or attractiveness to the organization. › Develop the top three into a meaningful message, i.e., get the wording and sequence right. 5. Who might be able and willing to support or add weight to your argument? › Will you be referring to regulators, standard makers, or legislators? › How will you go about enlisting the aid of auditors? › What about suppliers, customers, or the local community? EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Chapter 3 Getting Started 57 Downloadable Business Continuity Toolkit You can download information and tools from the Business Continuity Toolkit that will help you make the case for BC to management. References Business Continuity Institute (2014, January). BCM legislations, regulations, standards and good practice. Retrieved from www.bcifiles.com/BCMLegislationsandRegulationsJan2014.pdf Hiles, A. (2014). Business continuity management: Global best practices (4th ed.). Brookfield, CT: Rothstein Publishing, chapter 2. National Fire Protection Association (2013). NFPA 1600 standard on disaster/emergency management and business continuity programs. Retrieved from http://www.nfpa.org/assets/files/AbouteCodes/1600/1600-13-PDF.pdf, p. 1600-5. For Additional Reading Business Continuity Institute (2013). Good practice guidelines. Available from http://www.thebci.org/index.php/resources/the-good-practice-guidelines (May be downloaded free by BCI members, or purchased by non-members.) EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 58 Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Part II Building a Foundation EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Part I: Preparation and Startup Part II: Building a Foundation Part III: Responding and Recovering Part IV: Planning and Implementing Part V: Long-Term Continuity Understanding impacts and consequences is essential to your business continuity (BC) preparation. At the base of all of your efforts will be how effectively you identify possible threats, deal with the symptoms of that threat, and prevent the consequences of a threat in the event that it materializes. In Part I, you explored the practical aspects of getting started in BC. Now, in Part II, Building a Foundation, you will do the basic research and information gathering that will allow you to identify threats and critical functions and make the choices that will protect the survival of the business. Chapter 4 – Understanding Your Risks ◗ Describes how to assess the risks and explain them to others. Chapter 5 – Impacts and Consequences ◗ Covers analyzing the risks and understanding their consequences. Chapter 6 – Continuity Strategies and Options ◗ Presents alternative approaches to implementing practical BC. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use 4 Understanding Your Risks B y now you should have an appreciation of business continuity (BC) and why it is important. Once you have successfully launched a BC program, as covered in Chapter 3, the next important stage is to understand the specific reasons why your organization actually needs to have plans in place. So far, your people have been asked to consider only generalities and concepts which need not necessarily apply to their environment. You will need to explore precisely why, and where, the business enterprise might be exposed to specific threats and risks. Once you are able to explain how such an event might impact the business operation, your explanation will lead to the development of plans and procedures to deal with an interruption.   Approach the need for risk assessment from a BC perspective. This chapter will help you to:   See the difference between qualitative and quantitative risk assessment.   Discover, evaluate, and report risks.   Focus on the possibility rather than the probability of an occurrence.   Apply several risk analysis methodologies, such as Grid Impact Analysis, QwikRisk, and SMARTRisk.   Present your findings in a simple but effective manner. 61 EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use Principles and Practice of Business Continuity | Tools and Techniques | 2nd Edition 62 4.1 Risk from a Business Continuity Perspective For background, you need to be aware of the key definitions within the world of risk management. As the concept of resiliency is added to traditional BC, one of your tasks will be to integrate these concepts in how planning and decision-making are conducted at all levels in your organization. Your goal is to balance the two main areas of risk management: ◗ ◗ Enterprise risk – is is the area in which you work to mitigate events that may impact the organization in terms of people, facilities, information technology (IT), and assets. Operational risk – is is the area in which you work to mitigate vulnerabilities in business operations, including the effectiveness of processes, analysis of downtime, governance, and reporting – making processes work better. 4.1.1 Risk and the Six Disruptive Scenarios e regular scope of risk management is rather wide and concerns itself with many aspects of risk which are not pertinent to the purpose of BC and, thus, are well outside your remit or specific task. In considering risk as it applies to BC, you need to be concerned only with those threats which are likely to result in one of the six disruptive scenarios that were introduced earlier in Chapter 1: ◗ ◗ ◗ ◗ ◗ ◗ Loss of access. Loss of people. Loss of supplies. Loss of communication. Loss of function. Loss of data. Any of these situations would be made worse if you were either unaware of the loss or unable to assess the situation through lack of information about the circumstances. erefore, your risk assessment needs to be based on those risks which can lead to these potential outcomes. eoretically, you could develop a set of plans to cope with almost any situation; however, it seems reasonable to identify the most significant threats and then to plan accordingly. Your information about these threats ensures support for the program because you will be able to demonstrate a definite need together with a sound solution to a known set of problems. 4.1.2 The Regular Risk Management Review In most organizations, some form of risk management protocol will already be in place. e identification, assessment, and mitigation of risk are integral elements of any conscientious management system and a basic requirement of good governance. For example: The UK Corporate Governance Code (September 2012) C.2 states that: “e board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives. e board should maintain sound risk management and internal control systems” (Financial Reporting Council, 2012). It goes on to say: “e board should, at least annually, conduct a review of the effectiveness of the company’s risk management and internal control systems.… e review should cover all material controls, including financial, operational and compliance controls.” Similar codes, regulations, or guidelines are in place around the world. EBSCOhost – printed on 8/23/2020 10:28 AM via THOMAS JEFFERSON UNIVERSITY – EAST FALLS. All use subject to https://www.ebsco.com/terms-of-use

Click here to ORDER an A++ paper from our Verified MASTERS and DOCTORATE WRITERS:SJU In House Ownership Organizational Leadership Discussion

A

• Grid View

A Sample Answer For the Assignment: SJU In House Ownership Organizational Leadership Discussion

Title: SJU In House Ownership Organizational Leadership Discussion