BIA – moving from Assessment to Analysis via Automation

1. BIA – moving from Assessment to Analysis via Automation Jason Scott-Taggart Global Head of BCM Technology, Barclays Capital March 2006

2. About Barclays • Barclays has been involved in banking for over 300 years. • Operates in over 60 countries with more than 120,000 permanent employees. • For the year ended 31st December 2005, the group achieved a pre-tax profit of £5,280 million, up fifteen per cent on 2004. • In November 2005, Financial News magazine awarded Barclays Capital ‘European Investment Bank of the Year’ in its annual Awards for Excellence.

3. Business Impact Assessment … • Is the way to gather the firm’s resumption/recovery requirements. • Gives one of the most comprehensive overviews of an organisation. • Empowers you with an in-depth understanding of what is important to the business. • BIA is your friend, your sword and your shield!

4. Initial strategy justified by BIA • Best in Class (disaster, what disaster?) • Greater Investment in a combination of recovery facilities and • resilience technologies • Rapid recovery capability, with no to minimal downtime High Target Profile • Adequate (take a hit and recover) • Investment in a combination of recovery facilities and • documented plans and procedures • Some degradation of service, greater recovery capability Cost • Basic • Limited, if any, investment in recovery facilities • Reliance on documented plans, procedures • Minimal • No investment • Dependent on ‘best endeavours’ on the day Low Time to Recover Slow (days – week) Fast (intra-day)

5. BIA at Barclays • Relationship Managers create partnership. • Has to be a business as usual activity to be ingrained and relevant. • BCM are not experts in the business areas and the actual impact of interruption. • Level of detail appropriate to them, not defined by BCM.

6. BIA at Barclays cont. • Relationship Managers selected for business skills. • Ask business people business questions and ask IT people IT questions. • The key to engaging people is to make it easy whilst also making benefit obvious. • Need senior management buy in to make this happen. Need senior BCM “co-ordinators”.

7. How did we automate • Out with Word and free form templates. In with “whizzy”, easy to use frontend and database backend. • Don’t reinvent the wheel. No retype and live updating. • Can drive data quality improvements. • Living documents not annual review. • Automated online sign off so not chasing bits of paper.

8. Business Resumption Planning • BRP is a checklist, a high level prompt. • Produce resumption plan by commenting next to each critical task and add resumption only ones. • Critical tasks flow through to lines in the BRP.

9. Business Resumption Plan Slide Content Removed

10. Tool’s Evolution - Spreadsheet

11. Tool’s Evolution - Database

12. Tool’s Evolution - Web

13. Obvious benefits • Compact and multi format resumption plans. • Relevant plans and contact details – only a day old. • BRP just output from BIA – combining the process not a separate exercise. • Easy to report live on compliance of sign off. • Reporting for governance and/or senior management.

14. Instant Feedback • Database contains statement of achievable 3 x R’s, as declared by System Owners: • Recovery Time Objective • Recovery Point Objective • Revised Operating Level • Compared with task level required 3 x R’s gives instant RAG reporting. • System outage -> business unit affected -> tasks at risk -> potential impact to firm REAL TIME. • Testing therefore vital to ensure accurate declaration: • Crisis Management • Invocation • WAR • Individual Applications

15. Other benefits • Data changes, simple turn handle for new reports. • Automated call notification – no more pretty PowerPoint org charts. • Transparent reporting helps with senior management engagement. • Seat Planner for WAR sites.

16. Seat Planner

17. From Assessment to Analysis … Assessment • What do you do that is critical? • What is the impact if you cannot do it? • What tools/applications do you need to do it? • Who do you depend on? Analysis • Compare and contrast data in unique ways. • High level reporting to senior management of gaps and risks. • Prioritise by risk and impact. • Further analysis by geography and function for example.

18. Locations BusinessUnits Business Tasks Systems People Support/Ownership Relationships/dependencies Relational Data Model

19. Analysis Reporting … Variables, Properties or Criteria Risk Modelling by … Business Function Number of Tasks Impact Scores Environmentals Size / Scale Technological Complexity Headcount Dependencies Location Business Units Systems

20. Draw backs • Complexity of data makes back up less straight forward. • Need business skills to collate data. • Need technical skills to store and link data. • Front loaded effort. • Can reveal unexpected gaps in capability. • Resumption descriptions can be light.

21. Anyone can do this • Have to be a multinational bank with team of developers? • Started as Excel -> Access -> SQL. • Table entry of tasks – relational. • Need not be dashboards on web pages, can be simple query to Excel and mail merges in Word.

22. In summary • Keep it simple and keep it relational. • Use authoritative sources of data. • Trust your subject matter experts. • Emphasise DR should not be a separate consideration. • Remember - the BIA is your friend, your sword and your shield!