1 / 14

Business Continuity Management: Audit And Financial Imperatives

Business Continuity Management: Audit And Financial Imperatives. Justification of BCM Projects Implementation approach overview - Decision Methodology: The Key Probability, Cost-Benefit, Intuitive Approaches. Justification of BCM Projects: An Example of Steps 1-3.

annis
Télécharger la présentation

Business Continuity Management: Audit And Financial Imperatives

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Business Continuity Management: Audit And Financial Imperatives Justification of BCM ProjectsImplementation approach overview- Decision Methodology: The Key Probability, Cost-Benefit, Intuitive Approaches

  2. Justification of BCM Projects:An Example of Steps 1-3 1. Estimate Losses by length of outage 2. Determine length of outage by backup/ recovery scenario 3. Perform cost/benefit analysis of each feasible scenario 4. Select and sell selected scenario

  3. 1. Estimate Losses by length of outage: Step 1 (Losses) An Electronics Wholesaler

  4. 1. Estimate Losses by length of outage: Step 2 (Recovery)

  5. 2. Determine length of outage by backup/ recovery scenario Recovery analysis for a large bank

  6. 3. Perform cost/benefit analysis of each feasible scenario

  7. Decision Approaches • Probability-based (used in insurance justification) • Analysis-based (used in cost-benefit analysis) • Intuition-based (used by most executives and expert systems) The analysis-based approach based on fiduciary responsibility will be recommended, since the probability approach and the intuition-based approach can lead to catastrophic loss exposures.

  8. Probability-based(used in insurance justification) • Mr. probability Cost of Hot Site Backup $500,000/year (2% of IS budget) Direct Losses over ten days $30,000,000 Probability of loss .01/year Net Direct Loss $300,000/event ROI -40% (Bad Investment)

  9. Another Probability Approach Assume a 30 year life for the Hot Site • Cost of Backup Site over 30 years $15,000,000 • Direct Losses over 10 day period $30,000,000 Probability of 1 loss over 30 years 26% Net Direct Loss $7,800,000 ROI -48% (Bad Investment)

  10. Analysis-based(used in Life-Cycle cost-benefit analysis) • Mr. Application Analyst Direct Impact Loss/Event (10 days) $30,000,000 Delayed Loss of Business/Event $360,000,000 (year to recover ½ sales) Total $ Loss/Event $390,000,000 (½ yearly profit) Probability of Losing our Jobs and Stockholder Suits 100%

  11. Intuition-based(used by most executives and expert systems) Step 1: Define Primary Evaluation Criteria of Key Stakeholders

  12. Step 2: Perform Ranking of Backup Alternatives using Cyert & March Methodology

  13. Recommendation The authors believe that the life-cycle prudent fiduciary approach recommended in this paper, best represents the approach that should be used by industry and government. The probability and intuitive based approaches can be dangerous, since they occasionally leads organizations to take inappropriate risks.

  14. BCM NOTE The fact that two of the three approaches often select the same commercial backup center approach is not unusual. It explains why the Backup Data Center Industry has expanded so rapidly. However, many organizations that require recovery in hours rather than days are moving to the dual data center approach; based on negative evaluations in the Hot Site column. Many organizations that still use information technology for support and accounting applications only, select the Cold Site approach because of the lack of negative elements in that column of their table.

More Related