The Value-Driver Approach to Business Continuity A Cost-Effective Variation Tamara Nolan, Senior Associate

1. The Value-Driver Approach to Business Continuity A Cost-Effective Variation Tamara Nolan, Senior Associate New York, NY March 18, 2009

2. A cost-effective, swift way to build business continuity management capability begins with embracing leadership’s view of critical value drivers Traditional BCM Approach Value Driver Approach • Adopts a bottom-up, comprehensive perspective to evaluate functions and processes • Systematically examines all of the organization’s business processes and then determines criticality • “Cold” data gathering involves multiple meetings to get the answers • Often a complex “one size fits all” methodology that does not easily incorporate dynamic changes to the business environment • Scenario-based planning • Can exhaust program resources by lasting 8- to 12-months • Adopts a top-down, strategic perspective to evaluate sources of value and generate buy-in • Examines only those business processes that leadership sees as critical to: • Revenue/Operations • Brand • Reputation • Hypothesis-driven data gathering with limited demands on executive time • Customizable and flexible approach based on organization’s specific value chain • Effects-based planning • Generates savings in development costs based on 8- to 12-weeks timeline

3. Indirect Impact Recent experience demonstrates that complex risks and massive impacts have heightened the need for resilient businesses Business Consequences • Deteriorating operating performance • Decreased revenue due to loss of customers • Reliability issues • Lack of visibility • Slow recovery • Brand/Reputation damage • Lack of contingency planning • Increased costs (e.g. over-time payments to reduce backlog or penalty payments to customers) • Legal exposure • Declining confidence of citizens and public officials • Adverse employee relations AdverseMedia Exposure Tightened Credit Markets Facility Disruption Financial Crisis Direct Impact Distribution channels Network Intrusion Natural Disasters Terrorist Attacks Inability to Pay Suppliers Pandemic Intellectual Property Theft Large Employee Absence Public Infrastructure Disruption Change in Customer Demand Equipment Damage

4. With the adverse effects that poor planning can have, robust BCM capabilities make sound business sense • Poor planning can lead to a wide range of problems, from human casualties deemed the result of management negligence to loss of market share due to unsafe products • Strong planning, on the other hand, is a vital standard of strong corporate governance because it has • Major immediate impact on shareholder value • Long term impact on reputation/brand and therefore market share

5. However, BCM managers continue to have challenges building the business case for needed plans and capabilities … • Although BCM is a cornerstone of well-structured risk management programs, many companies struggle to initiate, develop, and maintain needed capability • Typically, this is not because of a lack of interest but a lack of resources, training, and buy-in from senior leadership • In today’s cost-constrained business environment, BCM leaders must take a take an actionable approach to protecting value drivers • The customary bottom-up BIA requires an intensive and time-consuming effort to identify the functions and processes that are truly critical … as cost pressures and the need to demonstrate immediate results demand a new way of thinking about BCM Planning

6. Our value driver approach to BCM guides BCM capability development from initiation through exercise and maintenance Business Analysis BCM Strategy Development BCM Plan Development BCM Plan Exercise BCM Program Maintenance • Keep it all aligned with the changing business • Document the BCM plans • Outline proactive initiatives the business can take to improve its resilience and to mitigate identified risks • Identify critical products, services, functions and work locations • Identify key dependencies and resources • Identify key risks • Set recovery objectives • Develop strategies to address risks for critical business functions & managed resources • Identify initiatives / actions to effect strategies • Validate strategies through a workshop • Conduct tabletop exercise to validate plan content • Validate interdependencies • Keep it all aligned with the changing business • Conduct annual plan reviews / updates • Develop options to de-risk the business through changes in three dimensions—process, operating model, or geographic dispersion • Identify a set of mitigation strategies

7. Business Analysis Our approach employs proprietary techniques to help BCM leaders quickly gain traction and sustainable momentum by … Illustrative High-Level Value Chain The value chain allows us to get to the answer quicker by: • Identifying and prioritizing value drivers • Identifying and mapping critical interdependencies • Identifying and prioritizing vulnerabilities and gaps Distribution Design Sales Production Production Commercial Administration/ Traffic Operations Operations (Logistics and Support) Engineering (Logistics and Support) Shared Services (Legal, IT) Shared Services (Legal, IT) … focusing resources on protecting the organization’s value drivers

8. BCM Strategy Development The approach then examines each value driver based on the impact of a risk, not the cause Causes There are infinite disruption scenarios, but effective planning requires looking at potential operational impacts Natural Disasters Effects Pandemic Unable to access building Injury or death Impacts Loss of key supplies Financial Crisis Loss of Power Utility Outage Source: BCG Analysis

9. BCM Plan Development The insights gained from the Value Driver Approach are then incorporated into strategies and aggregated into BCM plans Analysis and BCM Strategies Analysis and BCM Strategies Critical services and functions 4 Critical services and functions 4 Dependencies and resources 4 Dependencies and resources 4 Key risks 4 Key risks 4 Recovery objectives 4 Recovery objectives 4 Business Continuity Management Strategies to address risk 4 Strategies to address risk 4 Mitigation initiatives 4 Initiatives/actions to effect 4 strategies Options to de-risk business 4 - Options to de - risk business 4 Strategies that drive change 4 Strategies that drive change 4 INTERNAL USE ONLY INTERNAL USE ONLY INTERNAL USE ONLY STRICTLY CONFIDENTIAL STRICTLY CONFIDENTIAL CONFIDENTIAL

10. BCM Plan Exercise The tabletop exercise is a key next step to validate plan content • The tabletop exercise is a discussion-based exercise based on a simulation of actual disruptions • Because plans are often developed in silos, tabletop exercises allow you to examine or validate interdependencies • They allow for the free exchange of ideas and provide participants an opportunity to identify conflicts or areas of confusion within plans, and examine plans and procedures in a simulated, low-stress environment • They also help to reinforce corporate memory In today’s cost-constrained environment, a tabletop exercise is also a low-cost way to energize the BCM program, identify areas of focus, and drive leadership awareness

11. BCM Program Maintenance The final step is developing a program maintenance strategy to ensure that the BCM capability remains current in a dynamic operating environment • Provides a roadmap for maintaining a viable BCM capability • Outlines exercising, maintaining, enhancing, and managing BCM capability • Identifies and documents BCM Program objectives, resource requirements, specific actions, and timelines BS 25999-1:2006 & BS 25999-2:2007

12. In summary, the Value Driver Approach offers reduced project costs, increased development speed, and demonstrated results • By quickly identifying the vulnerabilities associated with the value drivers and outlining disruption strategies to minimize losses, BCM leaders can focus on protecting the business • The value-driver approach includes the following key features: • Maintaining a focus on key functions and processes that drive value • Engaging senior leadership upfront to promote the BCM program • Establishing a greater degree of buy-in at functional levels of the organization • Promoting program efficiency throughout the BCM life cycle • Generating tangible savings in overall development and maintenance costs • However, the value driver approach’s true value proposition is the ability to leverage leadership’s experience and insight to quickly identify the important business resilience issues along with potential solutions