Investing in Business Continuity Management

1. Investing in Business Continuity Management ISSA 2003 Rick Cudworth International Service Line Leader for Business Continuity Management KPMG LLP

2. Agenda • What has changed? • Why should I invest? • How do I determine priorities? • What are my options? • How do I maintain my investment? • What is my return on investment?

3. What has changed? • September 11, world-wide terrorism, anti-globalisation • Increased regulatory pressure • Corporate governance • High dependence on information availability • Customers expectations • Employees livelihoods

4. Why should I invest? • Market • Brand value • Market share • Position • Customer loyalty • Cross-selling • Agility • Innovation • Reputation • Shareholders • Employees • Customers • Regulators • Financial markets Business Continuity protects reputation and shareholder value • Costs • Customer turnover • Productivity • Backlogs • Recovery costs • Lost data • Litigation • Compensation • Results • Revenue growth • Cash flow • Share price • Competitive advantage

5. How much should I invest? Best Resiliencein place Good Recovery facilities Basic Plans and procedures Cost of Recovery Solution DonothingBest endeavours Time to Recover

6. How do I determine my priorities? Mission Critical Better 24 hour recovery Best <2 hour recovery Payment and settlement Portfolio VaR ATMs Trading Daily management information Market risk management Exchange Positions Slower Faster Minimal >5 day recovery Basic 3-5 day recovery Accounts payable Manage Compliance Project tracking Manage tax Non-Mission Critical

7. How do I determine my priorities? (continued) • Capabilities to recover first • Next wave of capabilities to recover • What capabilities need not be recovered 100 80 • Regular mid-office/ back-office functions in place • Commence entrepreneurial trading (at reduced trade volume) 60 % of business recovered 40 • Close manage and control positions • Key decision parameters are likely to be: • Cost (upfront and ongoing) • Time to implement • Flexibility 20 0 4 hours Week 1 Week 2 Month 1 Month 3 Day 1 Day 2 Day 3 2 hours

8. How do I determine my priorities? (continued) • React: • Manage: • Transform: • Is it sufficient to react to a disaster? • Is ensuring the availability of operations sufficient ? • Should business continuity capabilities be providedacross the extended enterprise? React Manage Transform Value Recoverability Availability Competitiveness Information assets Competitive position Physical assets Risk Facilities/ processes Extended enterprise Impact Customer satisfaction Customer All stakeholders Focus Event Downtimetolerance Days Zero downtime Hours/ Minutes

9. What are my options? Hot , Warm , Cold ? Determine recovery strategies that are right for your business People • Promote continuity culture • Invest in training and awareness • Reduce reliance on key individuals • Demonstrate leadership, commitment and clarity of thought in business continuity Technology • Invest appropriately • Choose scaleable solutions • Embed business continuity within the SDLC Facilities • Flexible and scaleable • Share costs • Split-sites • In-house or Outsource (Syndicated or dedicated)

10. How do I maintain my investment? Provisioning with maintenance and governance • Process driven • Efficient • Cost effective • Long term value Cost effectiveness of BCM programme Provisioning with maintenance but without effective governance • Project driven • Inefficient • Expensive • Short term value Provisioning without effective maintenance and governance Time

11. How do I maintain my investment? – The Testing Element Testing • Emergency Response • Crisis Management • Command Centre • Call Tree • Desktop Walkthroughs • Simulation Exercise • Live Test ! Types of Test Risk Profile Reward • Ensures the organisation has developed viable business continuity arrangements that work. • Ensures the business continuity arrangements meet the needs of the business. • Ensures the organisation has identified and trained personnel for their business continuity roles and responsibilities. • Low Risk • Low Risk • Low Risk • Low Risk • Low Risk • Medium Risk • High Risk

12. How do I maintain my investment? – The Cultural Element • Practice managing the incident • Managing the immediate problems from capability loss • Practice recovering the business • Recovery/ restoration of all critical activities • Restoration of all data • Embed BCM within Change Management and Operational Risk Making BCM a part of everyday normal business operations – managing risk so that I am always there for my customers and stakeholders.

13. What is the return on my investment? • A Business Continuity programme can help drive: • Effective risk management • Lower cost of data management • Contained insurance costs • Lower economic cost of capital • A recoverable, resilient and robust operational structure will result in improved shareholder value and company performance.

14. British Bankers Association Guide to Business Continuity Management The Guide contains: • Forward by Sir Howard Davis • Step by step approach • Real life examples • Addresses difficult challenges The BBA guide provides some helpful tips to delivering a successful Business Continuity programme