by Mr. Venkataram Arabolu, Managing Director, BSI Management Systems India In Association with PetroFed

1. Business Continuity Management for Oil, Gas & Petrochemical Industries by Mr. Venkataram Arabolu, Managing Director, BSI Management Systems India In Association with PetroFed September 16, 2008, New Delhi

2. About BSI Group • Founded in 1901, Royal Charter Company • Clients in over 120 countries, BSI India Commenced operations in year 2000 and has over 3500 customers. • Independent assessment (third party & second party), certifications and training of management systems • Product testing Labs & services • The development of Management systems Standards such as BS 5750 (later became ISO 9001) • Integrated Management System software

3. What is Business Continuity Management ? Definition Holistic managementprocess that identifies potential threatsto an organization and the impacts to business operations that those threats, if realized, might cause, and which provides a frameworkfor building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities

4. A turning point-but not the least

5. Disruptions that we are familiar with

6. Heart of U.S. Oil and Gas Industries Shut Down as Storm Approached About 23 percent of the nation's oil refining capacity lies along the Texas coast

7. Hurricane IKE, Path, September 14th 2008

8. Spread of Oil & Gas facilities covering Texas, Louisiana, Mississippi & Alabama Oil & natural gas production has been shut (US major Oil refineries with capacity of 5 MMBBL which is about 30% of US capacity in the effected area) Staff has been evacuated from 452 production platforms (63.0%) and 81 rigs (66.9%) 4.5 Million people with power outage,no water, no power and no gasoline. Shallow water facilities that currently act as a hub Deepwater facilities that currently act as a hub Future deepwater facilities Pipelines

9. Disruptions in India • Private Petroleum companies Shut retail outlets • Oil spills threaten Gujarat marine park, • Refinery fire & Explosion leading to shutdowns, affecting supplies & profitability etc • Spurt in LPG imports due to unit interruption BHN 5 BHN 5 after the fire

10. Global Threats in Oil and Gas Industry

13. Emerging threats…. Terrorism Outsourcing Learned helplessness Resource nationalism obsolescence Pandemics IT Security Acquisition unexpected event Corporate Culture Unreliable supply Regulation deregulation Global warming

14. Marsh Report 2008

15. Revisit - Business Continuity Management Definition Holistic managementprocess that identifies potential threatsto an organization and the impacts to business operations that those threats, if realized, might cause, and which provides a frameworkfor building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities

16. Reality • Nearly 1 in 5 businesses suffer disruption every year Source BCI

17. What do you think is currently the weakest link in your Business continuity strategy, planning and recovery efforts?

18. 18 18 BS 25999 • BS 25999-1:2006 • Code of practice for business continuity management • Published 28 November 2006 • BS 25999-2:2007 • Specifications • Published 20 Nov. 2007

19. What a BCMS achieves

20. Embedding BCM in the organization's culture Understanding the Organization Exercising, maintaining and reviewing Determining BCM strategy BCM program Management Developing and implementing BCM response Business Continuity Lifecycle

21. Continual improvement of the Business Continuity Management System Interested Parties Interested Parties Plan Establish Act Do Maintain and improve Implement and operate Business Continuity requirements and expectations Check Managed Business Continuity Monitor and review Plan–Do–Check–Act (PDCA) Cycle

22. Why BCMS ? • Minimize business disruptions • Quickly recover to normal business operations • Protect an organization’s value and reputation • To meet • shareholder commitments • national / legislative requirements • legal, regulatory and contractual commitments • moral and social responsibilities • Demonstrate “best practice”. • Reduce insurance liabilities.

23. Sample Organizational Risk Culture Board Seeks strategic dialogue about risk but must rely on intuition Lacks the knowledge & risk vocabulary to engage in dialogue with management Has narrow & siloed view of risk, often focusing on compliance Understands the risks but has little influence on decision making CEO CRO CFO Business Unit Business Unit Business Unit Treasurer's office Uses sophisticated risk management tools, but only for short term risk Lacks the sophistication to understand, much less measure, their own risks Source HBR Sept 08

25. Logical steps

26. Risk matrix Critical Less critical

27. Risk Impact versus control IMPACT FACTOR VS STRENGTH OF CONTROL FOR ACTIVITIES Vulnerability impact factor Strength of Controls Priority focus should be on the aspects with high risk and those with the largest gap between risk and control

28. BCM – the way forward 1. Top level commitment 2. Initiate the Management Process 8. Test, Exercise and Maintain the Plan 7. Developing and Implementing the Plan 3. Identify the Threats and Risks 6. Develop Strategies 4. Manage the Risks as part of Risk Management 5. Business Impact Analysis (BIA)

29. Where BCM is going? • No longer just a fashion accessory, BCM is now an integral part of managing the business • Integrated across all business functions; no longer seen as an IT speciality • Now being accepted as a strategic business imperative • Progress towards independent auditable processes • BS25999-2 • Broader based agreement on what is best practice in the form of the a new standard, BS 25999-1

30. Thanks End of Presentation