EPCB Risk Management Services

Risk Assessment ≠ Risk Analysis

2012-02-11T14:20:00.003+10:30

One distinction between "risk management" in the USA and the rest of the world was - and maybe to a degree still is - the different meanings of "anaysis" and "assessment".

For the United States: "Assessment = Analysis"

For the rest: "Assessment = Identification + Analysis + Evaluation"

Aligned with the Intenational Risk Management Principles and Guidelines (ISO 31000)

Context and Identification are about nailing your risk issues by focusing on their consequences in relation to "the things you value" (objectives).
Analysis is about premising the likelihood of those consequences (given the effectiveness of current controls).
Evaluation involves judgment of acceptability.

To help address this issue and add some value to those who may want to consider it, we have developed a risk assessment tool which is aligned with the International Risk Management Standard, easy to use, inexpensive and works on Excel software as old as 1997 - or the most recent version.

The structure of the tool fully aligns with the structure of the ISO 31000 process.

More information on how the Risk Assessment Tool works is available by downloading this pdf.

We are please to make this immediate download available for the SALE price of only US$14.95

EPCB weekly Risk Management Newsletter launched

2012-01-16T18:36:00.000+10:30

To bring together items of common interest and tweets, EPCB will make available a "Paper.li" web-based publication which will provide a collection of (hopefully) interesting items in the one spot -The url for the publication is http://paper.li/risk_reward/1326694527 for those of you who want to consider subscribing to a weekly notification.

Three steps to developing a sound SIPOC diagram

2011-12-15T14:36:00.000+10:30

Overview Handout

Purpose: The purpose of a SIPOC Diagram is to define and document the key elements of an activity. This includes Customers/Requirements, Outputs, Process Steps/Requirements, Inputs and Suppliers.

Materials: SIPOC overview handout, whiteboard, worksheets, flipcharts, PowerPoint (not preferred as it can take away from engagement and participation), Posters, PostIts™ (or my favourite, coloured sticky arrows – which are then placed on a large, blank, laminated SIPOC chart)

Time: Varies. Plan for at least two hours based on the complexity of the process, the knowledge of the participants of the process, and their previous experience creating SIPOCs.

Step ONE: Get everyone on the same “purpose” page

Note 1 to facilitator: Do this step even if working with a knowledgeable group by reviewing the elements critical to conducting a successful SIPOC session.

Use this review as a means of setting a positive tone and developing a “conversational” style of facilitating the session.

The five critical elements to a good SIPOC are:

1. Provide participants a brief overview of the SIPOC structure and how it important to manage its use in terms of range of purposes.

Apply the Covey principle “begin with the end in mind”– SIPOCs are flexible tools and can be focused on achieving a range of purposes – such as project planning, or vulnerability mapping or organisational restructuring. So be mindful – ask how will you USE this SIPOC?

2. The challenge for service industries (as distinct from making widgets) is to think beyond the process column (where many SIPOCs start). The challenge for individuals is to think outside of their square.

3. When recording on the SIPOC use only as much detail as needed to understand/communicate effectively.

4. Record the agreed purpose of this SIPOC session – make the agreed purpose the label of the “car park”. The “car park” is an area of white space, such as butcher’s paper or a whiteboard on wheels, which is structured to capture – as they relate to the SIPOC element being mapped at the time - (1) assumptions (2) constraints (3) risks and (4) decision criteria

5. This is not an academic exercise - define how things really get done, not how we might want them to be.

Step TWO: Establish the Framework

Note 2 to facilitator: Groups sometimes prefer to be more “organic” than systematic. Be flexible and accommodate as long as the entire SIPOC form is completed with enough detail to understand the process. Be flexible and use plain language. Write it down, and then ask open-ended, clarifying questions to get it right. Place the “thing” or “issue” on the SIPOC at a place of best agreed fit. Challenge the status quo, test the understanding of the process, and encourage dialogue.

Note 3 to facilitator: A challenge from here on out in this process is to keep the group at a high level of detail - not allow them to get too granular. The detail can come later in the process flow diagram mapping or you can go back and break each key process step into sub-steps and SIPOC them. (It depends on the purpose of the SIPOC and the complexity of the process.)

Use the SIPOC framework (on the wall chart, computer, whiteboard, worksheet, or flipchart).

1. Seek permission and agreement from the group to start “backwards from the right” - from the Customer column.

Identify customers (some will be stakeholders with specified needs to be met which are contractual, or legally obligatory - others stakeholders may have a more indirect and general interest, needing only to be appropriately informed).
“Back into” the customer requirements column by now clearly stating the requirement(s) of each stakeholder.

(This two set customer column should be reviewed whenever something changes – so that the ripple effects can be mapped and managed.)

2. List the outputs from the process which will deliver the requirements of the customer – and collectively, achieve the required outcome of the activity.

3. Structure a process which will deliver the outputs effectively and efficiently.

Clearly identify the START of your process (cue, prompt, trigger that requires you to act).
Clearly identify the END of your process (how do you know you are done?).
List the 3-5 (NO MORE THAN 7) key steps in the process being mapped.
Incorporate feedback loops – how will you, your customer, your supplier communicate?

(Record: Process name; Process owner; Process performance measures/metrics – structured to inform improvement opportunities; any known operational definitions of key process elements; any known assumptions/constraints and immediately apparent risks - record in “car park)

Note 4 to facilitator: Remind the group that the assumptions and operational definitions are ongoing lists and may be added to as needed during the session. The idea is to make sure everyone is working on the same sheet of paper and means the same thing when using a term and those assumptions are made visible, discussed, and validated or challenged as appropriate.

4. List the inputs into each step of the process

List the requirements of each input (your view – the person doing the work)
List the supplier of each input of the process

5. List or highlight the Critical-to-Quality (CTQ) elements for the process

Step THREE: Check your work

• Review the completed SIPOC.

• Verify all key components are completed/addressed.

• Determine Next Steps/Action Plan.

• Make sure all assumptions are visible, discussed, validated, and documented.

• Document operational definitions of terms, symbols, acronyms, equipment, standards, etc.

• Do not forget to identify your information/communication loops and feedback mechanisms.

• Document source specifications, standard operating procedures, and/or references for your process.

• Review where you need to have Service Level Agreements (SLAs) – between you and supplier, you and customer.

Updated - EPCB's Buttress Facebook page

2011-12-11T16:38:00.002+10:30

http://www.facebook.com/pages/Buttress/113599418683658

Want to immediately purchase and download Buttress?

2011-12-11T14:08:00.001+10:30

Click on the screenshot to go to the secure purchase and download site

Only US$85.50 with the Coupon X147

Become an EPCB software sales partner (40% commission).

2011-12-10T16:08:00.001+10:30

Click on the screenshot to register as an EPCB software sales partner.

"I get knocked down ... I get up again"

2011-12-09T17:35:00.005+10:30

One of our favourite clients was recently hit by a significant fire (see video below).

The conclusions of the report to their governing body highlighted that:

"The early initiation of the Business Continuity Plan proved effective. A well managed and strategic approach to decision-making was evident. The Crisis Management Team was engaged at an early stage and managed the situation in a structured and strategic manner. The Business Continuity Plan worked well, and adequate administrative support and equipment was available."
(Reference: Report OCM.109/11 of 20 September 2011 on 'Portable Office Building Fire 15 June 2011', Section 5.3 Page 3).

The structure invoked and applied is based on EPCB's "Buttress" methodology.

The Buttress Software Package which is available as an immediate download (Database, Instructions, and Planning Template) is currently discounted - for less than $100 - plus another 10% off if you insert the Coupon X147

EPCB releases heavily discounted Business Continuity and Crisis Management Software

2011-12-08T21:49:00.003+10:30

EPCB is pleased to announce the release of the new Beta version of Buttress™

Buttress™ will help you understand your risks, evaluate your exposures, and take timely action. It is based on an easy to use Access Database which focuses on the vulnerability of your resources - to ensure you are more resilient to any source of risk – and to enable you to bounce back effectively.

As an integrated business continuity and crisis management package, Buttress™ has three distinguishing features.

First, it focuses on the things you need in order to run your business effectively. That is your resources – the assets, people, skills, information (electronic / non electronic), technology (including plant and equipment), premises and supplies which underpin your critical activities. This ensures an alignment with best practices business continuity standards, which have moved their focus away from hazard events towards business vulnerabilities.

Second, Buttress™ has a significant mitigation component – which empowers you to reduce your vulnerability before an incident – to build resilience into the structures and functions of your business.

Third, Buttress™ supports the decision making processes to manage the consequences of impact after an incident.

In summary, whether it is mitigation before an incident or crisis management after impact, Buttress provides a platform which allows straightforward data entry and the production of tailored reports to meet your decision making needs.

The Buttress™ package is made up of an Access Database, PowerPoint Guidelines (PDF), and a Crisis Management Planning Framework (PDF). It is available for immediate download as a Zip file.

At under $100, this current software offering is a heavily discounted Beta version which has been validated by EPCB clients across both the public and private sectors over the last two years. (Clients who had been significantly impacted by extreme events – fires, floods, and reputation loss. Clients who knew they needed a better approach.) To take advantage of this offer, go to the secure purchasing site.

National Emergency Risk Assessment Guidelines (NERAG)

2011-12-06T17:22:00.000+10:30

The National Emergency Risk Assessment Guidelines
(Click above for a free PDF download of the Guidelines)

"Enterprise Risk Management" - COSO or ISO 31000

2011-05-05T17:34:00.007+09:30

I have been recently asked to conduct a "workshop" on "Enterprise Risk Management". You know, the "COSO thing" which was a reaction to poor financial management. Followed by SOX et al. Ended up being a tick the box exercise for too many - and we had continued uncertainty and poor risk management. Not a good combination - as the latest financial crisis demonstrates.

So I was initially a little skeptical. Old wine, new bottles - maybe even a "corked" wine. However the organisers have been kind enough to steer away from a narrow, linear promotion of doctrine. Instead, I will facilitate the exploration of using the international risk management principles and guidelines (ISO 31000) to achieve enterprise-wide risk management outcomes. Ha! I hear you scoff - "that's hardly different". Well my friends, having worked in a few places and been around the traps for a few years I can tell you - not many entities actually have a tailored and integrated approach to risk management. Most are still characterised by a mixture of "layer cake" - with the top and bottom not knowing what each is up to. This mix is then pierced by some "silos" - of excellence maybe, but isolation definitely.

Anyway, if the topic appeals, and you are in Kuala Lumpur 5-6 July this year, and you can cover the fee - it would be great to have you as a participant. Regardless, the themes we will explore are laid out below if you just want to peruse and reflect.

Title: Enterprise-wide Risk Management

A workshop on using the international risk management principles and guidelines (ISO 31000) to achieve enterprise wide risk management outcomes.

Introduction to the scope of the workshop

The risk management space is characterised by having a range of frameworks and guidelines. Many of these risk management frameworks reflect specific industry applications. Sometimes they have been developed to support quite narrow “agenda driven” purposes. Others are a reaction to risk events themselves. However, there are some which reflect a more thoughtful and engaging development. This workshop will consider the strengths of several approaches (such as Enterprise Risk Management, and Business Continuity Management). Further, we will explore how these specific applications can be integrated into a context sensitive application of the International Risk Management Principles and Guidelines to achieve relevant and robust outcomes in support of your entity’s objectives.

Pre-reading

On January 11, 2011 – The Committee of Sponsoring Organizations of the Treadway Commission (COSO) – an organization providing thought leadership and guidance on internal controls, enterprise risk management (ERM), and fraud deterrence – released a new thought paper relating to ERM aimed at providing guidance to help organizations advance along the ERM maturity curve. If participants get an opportunity to pre-read this thought paper, they should find it provides useful background (especially if they are new to this area):

Embracing Enterprise Risk Management: Practical Approaches for Getting Started (20 pages)

Key elements and workshop sessions

1. The maze of Standards, Frameworks, Principles and Guidelines

This session will explore:

· The structure of several specific standards (frameworks, principles, guidelines and standards) – in particular, Enterprise Risk Management COSO; Business Continuity Management BS 25999 and Risk Management ISO 31000.

· How these different “standards” relate to each other.

· How they can be harmonized into a nested framework which is aligned to your needs and context.

Learning outcomes include:

· Knowledge of the structure of Enterprise Risk Management COSO; Business Continuity Management BS 25999 and Risk Management ISO 31000.

· Understanding how these standards relate to each other.

· Awareness of issues when translating standards into context.

2. Gap Assessment

This session will explore:

· Why it is important, as an early activity, to map where you are against where you need to be (in relation to risk management capability).

· Identifying the necessary elements which should be measured.

· What performance criteria for the elements might look like.

· How the gap assessment might be displayed and communicated.

· Developing an easy to use tool suitable for your context.

Learning outcomes include:

· Awareness of the importance of gap assessment.

· Knowledge of the core relationship between necessary elements to be measured and sufficient performance criteria underpinning those elements.

· Knowledge of how gap assessments might be displayed and communicated.

· Knowledge of how to developing an easy to use tool suitable for your context.

3. Decision Making

This session will explore:

· What characterizes good decision making.

· Whether risk management is just good problem solving re-badged.

· Why analytic – deliberative processes are crucial.

· Some tools and techniques for good decision making.

Learning outcomes include:

· Awareness of what characterizes good decision making.

· Knowledge of what differentiates risk management from good problem solving.

· Awareness of why analytic – deliberative processes are crucial.

· Knowledge of some tools and techniques for good decision making.

4. Risk Criteria

This session will explore:

· Developing risk assessment criteria.

· Developing risk treatment selection criteria.

· The criticality of context when developing risk criteria.

Learning outcomes include:

· Understanding a range of issues involved in the development of risk assessment criteria.

· Understanding a range of issues involved in the development of risk treatment selection criteria.

· An awareness of critical, context sensitive factors when developing risk criteria.

5. From Principles to Integrated Implementation

This session will explore:

· Different models for implementing Enterprise-wide Risk Management

· Key issues of stakeholder engagement, marketing and training.

· Drafting an action plan for an Enterprise Risk Management initiative

Learning outcomes include:

· Awareness of the advantages and disadvantages of different models for implementing Enterprise-wide Risk Management

· Understanding the importance of stakeholder engagement, marketing and training.

· Knowledge of drafting an action plan for an Enterprise Risk Management initiative

6. Risk Assessment

This session will explore:

· The process role of risk assessment.

· A range of tools and techniques.

· A particular focus on vulnerability through scenario analysis.

· Some of the pros and cons - and what can we learn from them.

Learning outcomes include:

· An awareness of the core role of risk assessment processes.

· An awareness of a range of tools and techniques.

· Knowledge of why it is crucial to focus on vulnerability through scenario analysis.

· Knowledge of lessons learnt from inappropriate risk assessments.

7. Business Resilience

This session will explore:

· Leveraging the top three to five foreseeable extreme event scenarios.

· The advantages of moving away from a focus on extreme events and hazard to a focus on the vulnerability of the things we depend upon.

· The application of a scalable tool aligned with a best practice Business Continuity Standard (BS 25999).

Learning outcomes include:

· Understanding the value of leveraging the top three to five foreseeable extreme event scenarios.

· Understanding the advantages of moving away from a focus on extreme events and hazard to a focus on the vulnerability of the things we depend upon.

· Understanding how to apply a scalable tool aligned with a best practice Business Continuity Standard (BS 25999).

8. Continuous Improvement

This session will explore:

· How to improve corporate capabilities on an ongoing basis by training and exercising

· The key role of well designed desktop exercises before any extreme event

· The key role of sensitively facilitated organization debriefs after any extreme event.

Learning outcomes include:

· Awareness of the importance of improving corporate capabilities on an ongoing basis by training and exercising.

· Understanding how to manage a well designed desktop exercises before any extreme event.

· Understanding how to manage a sensitively facilitated organization debrief after any extreme event.

A Workshop Brochure is available for download here (8MB pdf).

After an emergency - a seven point self assessment

2011-04-14T17:58:00.000+09:30

This diagnostic tool will enable you to identify areas of strength and weakness in processes, capabilities and skills. The results from carrying out the assessment will also help in planning and implementing process capability improvements and systematically focus on areas of weakness.

Format of the self assessment
The self assessment consists of worksheets within a free MS Excel workbook.

Scoring - The relevant matters to take into account in considering the quality of management exercised center around seven key performance tests.

Sections cover performance in the following areas:

Seven Key Performance Elements

1. Detection
To what degree were early warning systems in place? To what degree were they effective?

2. Interpretation
To what degree were systems and methods which "mapped" answers to the question "what does this mean?" (This might have involved sophisticated geographic information systems, or meetings with hard copy map overlays). To what degree were these methods effective?

3. Planning to Communicate
To what degree had you premised the range of stakeholders who needed to be listened to, and communicated with? This reflection should consider how you planned for those who were likely to be at risk and how you planned with those who had a responsibility to support the management of the risks.

4. Communicating - with those at risk
To what degree was your communication to and with people at risk effective? To what extent did it elicit "appropriate protective behaviour"?

5. Communicating - with those managing the risks
To what degree was your communication with people with a responsibility to support the management of the risks effective?

6. Roles and Responsibilities
To what degree did plans contain a method by which they were invoked, up-to-date contact and mobilization details for any relevant agencies, organizations and resources that might be required to support the response. (For example, did they contain guidelines regarding which individuals have the authority to invoke the plan and under what circumstances; and contain identified lines of communications, roles and responsibilities, key tasks and reference information.)

7. Organisation
To what degree was a method for the organisation of a broader (i.e. beyond your own organisation) collaborative management system in place? (Such a system would allow stakeholders from across the community to establish agreed and prioritized objectives in terms of the critical activities to be undertaken, the timescales in which they are to be undertaken and measures of success in terms of outcomes to be achieved.)

Performance levels are attributed: N - not at all, P - partial, L - largely, and F - fully

Focused information supports sharp decision making

2011-03-28T15:36:00.001+10:30

Good CEOs know that when it comes to the relationship between information and decision making, more is not better.

This is in contrast to the real politik reflected in the wry humour of "The Smokescreen" (in Yes Prime Minister, by Jonathan Lynn and Anthony Jay, page 188). In the world of politics, perception is key. So decision making is dangerous - and to be avoided wherever possible. To this end, the passage from "The Smokescreen" notes:

"There are eleven stages in a decision making process -

Informal discussions
Formal proposals
Preliminary study
Discussion document
In-depth study
Revised proposal
Policy
Strategy
Implementation plan circulated
Revised implementation plan
Cabinet authorisation"

The pasage goes on to note that any public servant should be able to ensure that if a policy is unwelcome, stage 11 will not be reached until the next election. Unfortunately this approach is seen too often - I guess that is why the television series was so popular with politicians.

In the real world, decisions have to be made - often quickly - and frequently under conditions of uncertainty.

It is under these circumstances that information which is focused on the decision makers' needs is critical. The decision maker may need to know all that is available to him or her. However it is more likely that they will appreciate a focused set of information tailored to their needs. At EPCB we address this requirement with a framework of information based on best practice business continuity standards, with which we then support clients to tailor to their context.

Excerpt from the Table used to Tailor Reports

The approach can be seen at "Tailored Reporting to meet your needs".

Innovative responses mitigate disaster impact (Christchurch 2011)

2011-02-25T13:55:00.002+10:30

Christchurch impact indicator - dust rising from collapses after quake.

As the response moves to recognise the breadth of impact across the city, its infrastructure and its people, New Zealanders are applying several innovative "emergent resources" to mitigate the impact of this disaster.
Key issues are around "lifelines" - the networks that supply and link us to meet our core needs (from power, and water to communication).

The need to communicate is the glue that binds the efforts and three illustrations are apt:
1. Telecom NZ has 60 electricity generators and five portable mobile phone towers to keep the phone network up.
2. Google has set up an online finding service:

3. Online auction site Trade Me, set up a service linking people needing accommodation and assistance with those willing to offer it.

In this scenario of devestation, one hopes that these and other emergent, innovative approaches will be enough to see Christchurch get up and running.

Obvious and Necessary - modern risk management.

2011-02-01T11:00:00.001+10:30

I came across an interesting article by Leon Gettler today titled "Risk management in the era of unpredictability" (page 6, in the Opinion and Analysis Business Section of The Age newspaper, 1 Feb 2011).

Interesting not only because it reflected a position dear to my heart, - but interesting because it was a lead article specialising in what I thought was "a given". Can it still be that modern companies and organisations HAVE NOT adopted a flexible approach to risk management? What are they thinking? The solution is necessary - and it is not difficult.

In terms of the necessity of the solution Gettler wrote:
"The conventional risk-management approach lists possible events and determines the probability of their occurring based on experience. You measure the costs and benefits of specific risk-protection measures and implement these measures for each risk. The problem is that it assumes risks are local and routine and fails to take into account the impact they may have on different organisations and states. It does not factor in the impact of the growing number of unlikely but potentially devastating events. It is an outdated approach that robs organisations of their agility. Clearly, these sorts of events are impossible to predict. So, how should organisations respond? It is a subject that should be reviewed by boards regularly. Companies should have scenario-mapping teams that report to the board and work with suppliers and customers to identify potential threats. Twenty-first century risk management is not about predicting the future. It is about systems and relationships that create an organisation agile enough to respond when disaster strikes. (my emphasis) As it will."

In terms of the solution being "straightforward", if an organisation asks the fifteen questions in the diagram below, they will have the necessary and sufficient profile - of both their vulnerability and their needs.

"One Off" disaster levies reflect poor policy.

2011-01-21T11:35:00.001+10:30

This morning, Australians woke to page one headlines "PM Flags one-off flood tax".
This raises questions beyond those driven by party politics. It raises issues around how we, as a community, operate strategically. To what degree we operate sustainably.

Inundated floodplain development, Queensland, 2011

As a community, (in this case the "shared association" is as a nation) our constitution clearly nests the responsibility for the protection of life and property with State governments. Founded as a colony, we have a legacy of ports and hinterlands which have competed to attract development. A key discount lever used to attract development in the past has been "discounting". Sometimes with cheap flat land served with transport infrastructure and subsidised migrant labor. Sometimes with "light" requirements around standards. This has been so from flood plains to industrial zones. The outcome has been "hazard havens" where some States have imposed risks on citizens more severly than other States. Further, the benefits from such ventures do not generally go to those living near to the risky sites.

All of this is contextual to the challenges of the future.
Now - at a national level - we need to agree approaches to some fundamental questions.
By what country wide, consistently applied criteria will we address risks?

A systematic risk management framework

The risk management record of this national government has been characterised by a series of policy failures (from pink batts to school funding). Central to all of these failures has been the inability to bring the right questions to the table. The current knee jerk looks like the trend is embedded in their culture. One off fixes applied indiscriminately and an ignorance of insurance are indications of a government struggling to develop and apply a comprehensive and integrated approach. Unless a systematic and thoughtful approach is undertaken, we are likely to see further grounds for challenging the integrity of the current government.

New Business Continuity Standard for Australia's financial sector

2011-01-04T07:04:00.001+10:30

The Private Sector is increasingly held accountable for quality risk management. In many cases this takes the form of mandated performance standards. The Australian Prudential Regulation Authority has recently released the draft of their proposed Business Continuity Management Standard. The proposed standard aligns with international best practices. It makes Boards accountable for very specific Business Continuity Management capabilities - summarised in Clause 21 - to include (at a minimum):
1. Business Continuity Management Policy;
2. Business Impact Analysis including Risk Assessment;
3. Recovery Objectives and Strategies;
4. Business Continuity Plan including Crisis Management and Recovery; and
5. Programs for Review and Testing of the Business Continuity Plan; and Training and Awareness of staff in relation to Business Continuity Management.

APRA's draft Business Continuity Management Standard (PDF)

In any Risk Management venture "Establishing Context" is crucial

2010-12-13T18:59:00.010+10:30

There is a tendency for people to want to rush to the exciting stuff. To get their hands dirty with extreme event scenarios and risk assessments. That is a mistake.

It is important to pack your bags for the long trip - to lean your ladder up against the right wall - to start with an awareness of issues which might ambush "the end in mind". These phrases apply to any systematic risk management process - where an initial emphasis should be on scoping context. If not, believe me, it will unravel later.

So with many "burn and learn" examples over many years, may I suggest the following three key considerations:

1. Develop a project plan to establish the risk management context which includes:

a. the aims and objectives for the establishment of context;

b. a matrix of stakeholders against their roles and responsibilities; and

c. a budgeted and scheduled plan for anticipated research and consultation.

2. Profile the entity for which “context” is being established (e.g. the structure of the organisation; or the demographics of a community) by mapping key networks including:

a. relationships between people and organisations to identify and evaluate existing networks; and

b. other network relationships that do not exist, but which might add value should they be developed and established through negotiation, consultation and marketing strategies to gain trust cooperation and support.

3. Apply strategies to seek and obtain stakeholders’ co-operation and ownership of the risk management context including:

a. establish and coordinate open communication structures among the networks mapped;

b. consult with stakeholders to map their issues and needs across the following aspects or “spaces” - social, legal, technical, political, environmental, and financial; and

Establishing risk appetite early is fundamental

c. identify criteria and thresholds for “acceptable risk” across the aspects or “spaces” identified with stakeholders; and document the level of agreement and divergence between stakeholders regarding risk criteria to be applied. Two sets of criteria should be addressed. Risk assessment criteria – that is, “what do we care about - and how much do we care”; and what are agreed risk treatment selection criteria to be applied.

Disaster Funds: Lessons & Guidance on the Management & Distribution of Disaster Funds

2010-11-26T10:39:00.001+10:30

Please find reproduced below, in full, an email from Dr. John Twigg

Disaster Action - a great organisation - has just released what looks like a really useful new publication:

"Controversy surrounds many disaster funds, even decades after they were launched. Little guidance is available to those who take on the responsibility of managing and distributing funds in accordance with the wishes of the donors. Disaster Funds: Lessons & Guidance on the Management & Distribution of Disaster Funds, published by Disaster Action with support from the DCMS and the British Red Cross, fills that gap. It is an essential resource for emergency planners, fund trustees, administrators and managers."

Download from www.disasteraction.org.uk the ninety four page PDF and the five page nutshell pamphlet PDF

Return to EPCB's website - Risk Management

Post disaster shelter and sustainability

2010-11-02T07:44:00.001+10:30

Professor David Sanderson, Director, Centre for Development and Emergency Practice (CENDEP) at the School of the Built Environment, Oxford Brookes University has announced that as a follow-up to the ELRHA funded shelter conference held at CENDEP in September in association with CARE UK, the final report, presentations and podcasts awesome sessions are now available online at http://bit.ly/cSRhQs

The conference examined what role shelter should have in disaster relief and development while critically reflecting on its implementation at local and international levels. It was agreed, that while technological shelter solutions are important, good shelter practice always puts people first. This may mean reassessing practitioners' roles and responsibilities to include ways to work more successfully with affected people in a process, rather than focusing on providing an end product.

Simple things can put you at risk.

2010-08-16T10:03:00.001+09:30

It is early days in the investigation of the fire which destroyed the Liverpool Council offices over the weekend but some interesting things are immediately apparent.

"The fire has thrown one of Sydney's biggest and busiest councils into turmoil, losing its website, meeting place and important items including strategic plans, engineering documents and development applications." (Ref Daily Telegraph, 16 Aug 2010)

News Clip Video of the Liverpool Council Fire, 14 Aug 2010.

There is a continuity plan in place - however it seems to have been underpinned by some interesting decisions.

First, backing up customer paperwork. In this case, the loss of development applications from the end of last week. A simple process analysis would place a "scan and file off site" step at the beginning of the process. This reflects respect for what the client is submitting - the backup process is not just about the assessment by the planning department. Or is it? So a question about "how and what" were they thinking arises.

Second, the commentary from the YouTube news video reports the building had no sprinklers. This means either the business continuity plan has not been nested within the organisations risk management arrangements or it has been nested and a cost benefit assessment advised not to install sprinkler systems. Which of these is so will be confirmed by the coroner.

Third, a key principles of managing a crisis is "communicate, communicate, communicate". In the modern world, best practice demands a "go to" webpage - even if it only tells customers what is available and what is not available. A default url to switch to is as important as a backup customer service centre line. Unfortunately this is not being provided (as of 11.00am Monday 16 Aug 2010)

Three Standards adopted to meet North America’s private sector “business continuity” requirements.

2010-07-14T13:21:00.009+09:30

For the Private Sector Preparedness (PS-Prep) Program, the U.S. Department of Homeland Security has adopted the:

1. ASIS SPC.1-2009 American National Standard for Organizational Resilience;

2. BS 25999-2 the British Business Continuity Standard; and

3. NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs.

This adoption may be partly political – by placating a range of stakeholders. Nevertheless, there is merit in each Standard – and “cherry picking” the best practices by adopting a “crosswalk” methodology (where you compare like with like and integrate a high leverage position) is worth considering.

All three standards share a “quality process” based approach aligned with the diagram below (from ASIS SPC.1-2009)

The explanatory material in each Standard is particularly useful.

These resources and links to their free versions are below:

1. The ANSI/ASIS SPC.1-2009 Standard, titled “Organizational Resilience: Security, Preparedness and Continuity Management Systems—Requirements with Guidance

for Use,” (66 pages) provides a holistic approach to cost-effectively improve any organization’s resilience and preparedness performance.

It is available from

http://www.asisonline.org/guidelines/ASIS_SPC.1-2009_Item_No._1842.pdf

2. The British Standards Institution’s BS 25999-2:2007 “Business continuity management. Specification” specifies requirements for establishing, implementing, operating, monitoring, reviewing, exercising, maintaining and improving a documented Business Continuity Management System (BCMS) within the context of managing an organization’s overall business risks.

Resources are available from

http://www.talkingbusinesscontinuity.com/useful-documentation/free-resources.aspx

3. The US National Fire Protection Association (NFPA) “NFPA 1600” Standard on Disaster/Emergency Management and Business Continuity Programs (2007) (57 pages) has been widely accepted by North American-based organizations.

NFPA 1600 sets out to ‘provide disaster and emergency management and business continuity programs, the criteria to assess current programs or to develop, implement, and maintain aspects for prevention, mitigation, preparation, response, and recovery from emergencies.’

It is available from

http://www.nfpa.org/assets/files/PDF/CodesStandards/1600-2007.pdf

Criticism of Crisis Management - just shows poor style

2010-06-18T15:30:00.000+09:30

In a classic illustration of "how to lose credibility" by both big noting yourself and being rude to someone doing as well as can be reasonably expected under the circumstances, Rudy Giuliani has a breakfast TV shot at President Obama over the oil spill crisis.

Visit msnbc.com for breaking news, world news, and news about the economy

If you can't measure it - you can't manage it.

2010-06-15T16:21:00.025+09:30

This is an old management adage. Indeed it was Galileo Galilei (1564 - 1642) who is attributed with having said "measure what can be measured - and make measurable what cannot be measured".

In business, measure those activities or results that are important to successfully achieving your organisation's goals. Key Performance Indicators, also known as KPI or Key Success Indicators (KSI), help an organisation define and measure progress toward its goals.

Below is a set of Key Performance Indicators for Business Continuity Planning derived from the British Business Continuity Standard - BS 25999. They have been set into our free Excel spreadsheet tool and are offered for you to take a self assessment and reflect on the resilience of your business.

Element 1 Agreed, Owned, Accessible.
Indicator Be agreed by top management and understood by those who will put the plan into effect; Be owned by a named person(s) who is responsible for the plan’s review, update and approval; Be accessible to those with responsibilities defined within them.

Element 2 Up-To-Date.

Indicator Be reviewed at planned intervals, and when significant changes occur to the organization or its activities; Be under version control with formal change notification and distribution records.

Element 3 Aligned with other arrangements.

Indicator Be aligned with other contingency arrangements external to the organization

Element 4 Purpose and Scope.
Indicator Contain defined purpose and scope

Element 5 Roles and Responsibilities

Indicator Contain defined roles and responsibilities for people and teams having authority during and following an incident

Element 6 Invocation and Communication

Indicator Contain a method by which each plan is invoked, meeting locations with alternatives, up-to-date contact and mobilization details for any relevant agencies, organizations and resources that might be required to support the response; Contain guidelines and criteria regarding which individuals have the authority to invoke the plan and under what circumstances; Contain identified lines of communications, roles and responsibilities, key tasks and reference information

Element 7 Prioritized Critical Activities

Indicator Contain prioritized objectives in terms of the critical activities to be recovered, the timescales in which they are to be recovered and the recovery levels needed for each critical activity

Element 8 Procedures, Tasks and Resources.

Indicator Contain details of the consequences of a business disruption and the processes and procedures to enable continuity and recovery of critical activities.Contain details of actions and tasks that need to be performed; nominated person(s) to manage the tasks, and details of the resources (and their availability) required at different points in time.

Element 9 Assumptions

Indicator Contains details of the planning assumptions - including out of scope issues.

Element 10 Risk Management

Indicator Contain details to manage the immediate consequences of a business disruption giving due regard to the welfare of individuals; strategic and tactical options; especially considerations regarding prevention of further loss or unavailability of critical activities.

Element 11 Record Keeping

Indicator Contain a method for the recording of vital information about the incident, actions taken and decisions made.

Element 12 Stakeholder Information

Indicator Contain a reference to the essential contact details for all key stakeholders.

Element 13 Communication Protocols

Indicator Contain details on how and under what circumstances the organization will communicate with staff and their relatives, key stakeholders and emergency contacts.

Element 14 Media Management

Indicator Contain details on the organization’s media response following an incident, including: the incident communications strategy; preferred interface with the media; guideline or template for drafting a statement for the media; and appropriate spokespeople.

Element 15 Stand Down

Indicator Contain a process for standing down once the incident is over.

When you enter your attributed level of capability (or score) against these fifteen criteria, it is displayed on a single graph.

Finally - the oil spill is recognised as the ultimate Babushka doll.

2010-06-09T12:34:00.003+09:30

After fifty days of failure we see a new pattern of questions emerging. The risk is being correctly recognised as a function of many factors – a complexity of things which are linked, interrelated or nested. And like peeling back onion layers, the exploration of “root cause” needs to be thoughtful and systematic. An important thread to explore is the evolution of how we, as a society, have chosen to meet our basic needs. This mapping process is illustrated in the diagram below.

(Ref: Figure 6 in "Risk Profiling in Disaster Management Methodology" by John Salter)

A key question is “what is the output from such an enquiry in terms of outcomes?” Outcomes are about social structures, arrangements and agreements. And the outputs from a systematic assessment of the current oil spill fiasco should challenge the very core of our social and economic structures. Issues of wealth, power and status are always difficult to address. In any society no one wants to “give theirs up”. In the end, we will all have to face a collective dilema – and ultimately one which is a challenge of will. Will we be up to it?

In the risk space, how important is management over marketing? Fundamentally important.

2010-06-07T11:38:00.006+09:30

Too often we "rush to products". In a marketing dominated era the pressure is understandable. But it needs to be resisted.

When we are serious about our purchases we know we should buy what we need. This calls up quality decision making based on some sensible criteria.

In the risk management space it is about continuous improvement - even if - or especially if your baseline is zero. When starting a fitness program, you start be assessing where you are now. You then set some goals about where you want - or need to be.

In the risk management space, assessment should also be done in a framework which reflects best practices and context. The unfortunate management term used is "Maturity Models" - which include a series of descriptions of business performance for discrete risk management elements. The optimum level of maturity is recognised as being the level that delivers the organisation’s strategic objectives most effectively and efficiently, which does not necessarily mean the “top” level ( F: fully applied).

So a prudent first step is to assess the gap between where you are now - and where you should be. However unlike the fitness assessment which may well require a medical assessment from a specialist, such as a Doctor, it is not necessary to have your capability assessment done by a specialist (or consultant). You know your business inside out - all you need is to reflect on it within an appropriate framework.

Our free maturity model provides a systematic framework for benchmarking in a business continuity best practice context. It will help you to deliver business benefits in incremental steps - in key areas.

Click here - take three minutes - take stock now