1. Integrating Resiliency as a Strategic Priority: Seven Guiding Principles to Bring Your Program to the Next Level

2. Our Aim To share Seven Guiding Principles that can help you make your business continuity and emergency management programs a strategic priority.

4. The Audience - Who the Principles apply to

5. The Principles - Presenting the 7 Guiding Principles

7. Gaps between BCM/EM programs and strategic goals of the organisation

8. Often focus is on compliance vs. competitive advantage

9. BCM and EM practitioners struggle to obtain senior management and/or middle management support

10. Business Continuity and Emergency Management is not adequately leveraged within organisations

11. BCM and EM viewed as a cost centre not a value driver13

12. What does it all mean… Continuity is not a strategic priority

14. Can mitigate significant strategic and operational risk

15. Encompasses people, processes, and technology

16. Is required for any organization offering continuous or a high level of customer service

17. Is about maintaining a competitive advantage before, during, and after a major eventNote: These are strategic business and community issues

19. Emergency Management Professionals and Staff

20. Executives and Senior Management

22. The Seven Principles (continued) #5 Emphasize the strategic aspects and value proposition of your program – how it protects people, reputation, cash flow, customer service #6 Customize and “size to fit” – Apply best practices but tailor your program to fit the structure, culture, and budget of your organization #7 Focus on people, process, technology and brand protection throughout response and recovery 13

23. # 1 Integrate Your Program Integrate your program and link it with enterprise risk and/or other business programs

24. CRISIS MGMT. ERP Integrate Your Overview Emergency Response Plan and Program Crisis Management BCP DRP IT Disaster Recovery Plan and Program Business Continuity Plan and Program

26. Integration does not necessarily mean organizational redesign

27. Risk Management is a logical link but select what works best in your organizationIntegrated Program Business Business Crisis Crisis Business Business Disaster Disaster Enterprise Risk Enterprise Risk Continuity Continuity Integrated Program Management Management Continuity Continuity Recovery Recovery Management Management Planning Planning EVENT EVENT People People Risk Assessment Risk Assessment Recovery Recovery RM Optimization RM Optimization Resources Resources Infrastructure Infrastructure Risk Monitoring Risk Monitoring Response Response Continuity Continuity Procedures Procedures Applications Data Recovery Applications Data Recovery & Coordination & Coordination Management Management Risk Response Risk Response Process Process Crisis Crisis Disaster Disaster Emergency Emergency Technical Technical Location & Location & Communication Communication Business Business Interim Business Interim Business Post-Event Pre - Pre-Event

28. Integrated Resilience Functions Example from our professional services firm

29. # 2 Engage Key Stakeholders Identify, engage and manage key stakeholders

30. # 3 Understand the Business Operations Conduct frequent and comprehensive analysis and risk assessments to fully understand business operations and cost of not building resiliency

31. Understand Your Business Program Implementation Training Threat, Vulnerability, Risk Assessment Benchmarking Elements of a Resilient Program Response & Recovery Business Impact Analysis Program Maintenance Plan Development Recovery Plan Testing Strategy Planning

32. Recovery Plan Testing Strategy Planning Understand Your Business An effective continuity program begins with understanding the business Program Implementation Training Threat, Vulnerability, Risk Assessment Benchmarking Elements of a Resilient Program Response & Recovery Business Impact Analysis Program Maintenance Plan Development

34. Response and Recovery

35. Focus on People

36. Value Creation

37. CommunicationProgram Implementation Training Threat, Vulnerability, Risk Assessment Benchmarking Elements of a Resilient Program Response & Recovery Business Impact Analysis Program Maintenance Plan Development Recovery Strategy Planning ScenarioTesting

38. # 4 Support Needs of Senior Management Identify and support the needs of senior management

40. Resolve uncertainty and variances from expectations

41. A process to identify opportunities

42. Maximize opportunity for success and good performance

43. Employ the entire organization in the business resilience process

44. Align organizational objectives

45. Enhance stakeholder confidence through the execution of their plansNote: These are all value drivers a business continuity and emergency management programs can influence 13

46. # 5 Understand and Emphasize Your Value Proposition Emphasize the strategic aspects and value proposition of your program

48. Protect personnel

49. Protect assets

50. Protect and improve reputation

51. Enhanced customer service

52. Ensure high quality and efficient processes

54. Business interruption

55. Loss of key client/key supplier

56. Loss of reputation

57. Legal liabilities

58. Injury to people

59. Environmental damage

60. Regulatory scrutiny

61. Loss of customer service

62. Going out of businessBlackout 2003 Labour Disruption Pandemic Border Shutdown

63. # 6 Customize and “Size to Fit” Apply best practices but tailor your program to fit the structure, culture and budget of your organization

65. Not every organization needs the expensive strategy option; advancements in teleworking and a sound BIA will allow for a more cost-effective and creative (i.e. In house) recovery

66. You need to understand the culture and the tolerance

67. You can’t do this in your office or straight from paper

69. TACTICAL OPERATIONAL STRATEGIC …Throughout Response and Recovery We must consider a business resilience program based on business response and business recovery

70. TACTICAL OPERATIONAL STRATEGIC …Throughout Response and Recovery We must consider business response and business recovery Immediate internal emergency response plans TACTICAL Business Response STRATEGIC

71. TACTICAL OPERATIONAL STRATEGIC …Throughout Response and Recovery We must consider business response and business recovery Immediate internal emergency response plans Business Response Externalcustomer-focused response/recovery plans Business Recovery

72. TACTICAL OPERATIONAL STRATEGIC …Throughout Response and Recovery We must consider businessresponse and businessrecovery Immediate internalemergency responseplans Business Response Externalcustomer-focused response/recovery plans OPERATIONAL Business Resilience Business Recovery Risk plans linked to Strategy and Performance Management

74. Identify threats, understand vulnerabilities & assess risks

75. Incident Response

76. Act Decisively

77. Employee assistance programs

79. Identify critical suppliers

80. Vendor and sourcing alternatives

81. Streamlining processes for minimum disruption

83. Review key business objectives to ensure relevancy

84. Focus on value-creation & Innovation – customers, products, services

85. Project volumes and set priorities

87. Thank You Cliff Trollope, CBCP, CAS416-515-3851cliff.trollope@mnp.ca ShandaChronowich, CBCP416-515-3820shanda.chronowich@mnp.ca “When the tide goes out, we find out who’s been swimming without a bathing suit” – Warren Buffett, July ‘07