Business Crisis and Continuity Management (BCCM)

Class Session 8

8 - 1

8 - 2

Hazard Risk Management

Adapted from Emergency Management Australia, 2002. Emergency Risk Management

Establish the Context

(1)

Organizational/

Community

Stakeholders

Objectives

Identify the Hazards

(2)

Hazards Identification

(4)

Compare Hazard Risks

Rank Hazards by Risk

Analyze the Risks from

each Hazard

Decompose Risks into

components

Categorize Risk

Components

Group & Prioritize the

Risks

(6)

Group into like Categories

Rank by Priority

Consider Interventions

Sort the Hazards by

Risk Magnitude

Communicate and Consult

Monitor and Review

1 2 3 4 5 6

Assess the Hazard Risk

Probability

Impact/ Consequences

What are the organization’s/community’s strategic goals and objectives and considering those goals and objectives:

a. What is the scope of our hazards risk management effort? b. What is an acceptable level of risk? c. Who determines what an acceptable level of risk is? d. Can risk be managed? e. What are the interventions (controls/countermeasures) available to manage risk? f. What combination of risk management interventions controls/countermeasures) make sense in terms of non-risk specific considerations (economic, social, political, legal)?

8- 3

Stakeholders

Stakeholders are defined as key people, groups of people, or

institutions that may significantly influence the success of the

process.

8 - 4

Stakeholder Analysis

1. Identify people, groups, and institutions that will influence your HRM process. 2. Develop strategies to build the most effective support possible for the process and reduce any obstacles to successful implementation of an effective BCCM program for the university.

8 - 5

“Hazard - an event or physical condition that has the potential to cause fatalities, injuries,

property damage, infrastructure damage, agricultural loss, damage to the environment,

interruption of business, or other types of harm or loss” (FEMA, Multi Hazard

Identification and Risk Assessment, 1997, p. xxi

8 - 6

77

8 - 8

“Risk communication is a process, the success of which is measured by the extent that it, first, improves or increases the base of information that decision makers use, be they government

officials, industry managers, or individual citizens, and second, satisfies those involved that they are adequately informed within the

limits of available knowledge.”

National Research Council – Improving Risk Communication (1989)

8 - 9

“No company has enough budget or manpower to implement the perfect business continuity plan — even if such a thing exists. Thus the real issue facing companies today is how to achieve maximum possible risk reduction with the minimum possible investment in resources.”

Fortune Magazine (11-18-2002)

8 - 10

“By leveraging information obtained during the planning process, opportunities can be found to concurrently streamline operations, reduce risk and cost overtime.”

SIA STP conference May 20, 2003 Presentations.

8 - 11

Benefits of Conducting a BIA• Ensuring the safety of personnel, customers, and the public.• Increasing asset protection.• Decreasing potential exposure to incidents, accidents, emergencies, and

disasters.• Reducing disruption (maintaining continuity) to normal business

operations.• Minimizing potential economic loss.• Ensuring organizational stability.• Ensuring orderly and effective response, recovery, and restoration

following disasters.• Reducing reliance on key personnel.• Reducing legal liability.• Complying with legal, statutory, and regulatory requirements.• Minimizing insurance premiums.

Wold . Some Techniques for Business Impact Analysis

8 - 12

Planning Team• Upper management. • Line management.• Labor.• Engineering and maintenance.• Safety, health, and environmental affairs. • Public information officer.• Security. • Community relations. • Sales and marketing. • Legal. • Finance and purchasing.• To the above could be added other stakeholders

FEMA - The Emergency Management Guide for Business and Industry

8 - 13

Business Impact

• Revenue streams both in and out of the business.• Product creation and delivery.• Customer service.• The business’s reputation as reflected in stakeholders’

confidence.• The business’s strategic plans as reflected in ongoing

research and development efforts. • Legal liability.

Wold . Some Techniques for Business Impact Analysis

8 - 14

Determinants of Business Criticality

• Employee safety, security, and morale.• Regulatory and legal requirements.• Public image/goodwill.• Stakeholders’ (particularly investors) confidence.• Competitors’ ability to capture market share.• Relationships with other organizations – dependencies,

agreements, etc.• What the business’ leadership considers critical.

Wold . Some Techniques for Business Impact Analysis

8 - 15