1 career options and the ps-prep program 27 july, 2010
TRANSCRIPT
1
Career Options and theCareer Options and thePS-Prep ProgramPS-Prep Program
27 July, 201027 July, 2010
PS-Prep is Based on the 9/11 ReportPS-Prep is Based on the 9/11 Report
2
3
4
www. iso.org
5
Agenda
Introduce our hosts and sponsors
Meeting logistics
Introduce our panelists
Begin the presentations
Questions from the attendees
7
www. continuitycompliance.org
8
www. NorthRiverSolutions.com
The Architects of Resiliency
9
www. metrix411.com
The Assessment and Information Management Company
10
Use the Instant Message featureto submit questions for discussionby the panelists
3 Follow On Activities3 Follow On Activities
11
1. All questions listed at www.continuitycompliance.org
2. This session has been recorded for playback
3. A Linked In group has been created
12
www. anab.org
Mr. Scott RichterDirectorPlanning & Development
13
www. nqa-usa.com
Mr. Randy PittmanConsultant Relations
14
www. radiancompliance.com
Ms. Lisa DuBrockManaging Partner
CB Auditors & ANAB CB Auditors & ANAB AssessorsAssessors
PS-Prep Webinar / Scott Richter-PS-Prep Webinar / Scott Richter-ANABANAB
27 July 201027 July 2010
ANAB – ANSI-ASQ National Accreditation BoardANAB – ANSI-ASQ National Accreditation Board AR – ANAB Accreditation RuleAR – ANAB Accreditation Rule CB – Certification BodyCB – Certification Body Auditor – An individual who performs an audit to Auditor – An individual who performs an audit to
determine conformance to requirementsdetermine conformance to requirements Assessors – An individual who performs oversight Assessors – An individual who performs oversight
of an auditors performanceof an auditors performance
Acronyms and TermsAcronyms and Terms
ANAB – ANAB – www.anab.org
IRCA – IRCA – www.irca.org
RABQSA – RABQSA – www.rabqsa.com
WebsitesWebsites
Items to be coveredItems to be covered Requirements for CB auditor trainingRequirements for CB auditor training CB Auditor competenciesCB Auditor competencies ANAB Assessor competenciesANAB Assessor competencies SummarySummary
Public Sector Voluntary Public Sector Voluntary Preparedness Certification (PS-Prep)Preparedness Certification (PS-Prep)
ONLY pertains to CB auditors and ANAB assessorsONLY pertains to CB auditors and ANAB assessors
DOES NOT pertain to general auditors or DOES NOT pertain to general auditors or consultantsconsultants
ANAB’s Accreditation Rule places requirement ANAB’s Accreditation Rule places requirement criteria on our accredited CBs, no one else!criteria on our accredited CBs, no one else!
ANAB does not establish requirements for any ANAB does not establish requirements for any entity other than certification bodiesentity other than certification bodies
Requirements for trainingRequirements for training
No courses yet recognizedNo courses yet recognized
Successful completion of “Successful completion of “a training course a training course that that includes an examination of the auditor’s includes an examination of the auditor’s competence (including ASIS SPC.1, BS 25999-2, competence (including ASIS SPC.1, BS 25999-2, and/or NFPA 1600) and/or NFPA 1600) andand Appendix 1 of this Appendix 1 of this Accreditation Rule Accreditation Rule that has been certified that has been certified by a by a recognized national or international training recognized national or international training provider approval body”provider approval body”
CB auditor training requirementsCB auditor training requirements
CB Auditor CB Auditor CompetenciesCompetencies
GeneralGeneralThe CB’s audit team members shall have demonstrated the competence to:The CB’s audit team members shall have demonstrated the competence to: Understand the terminology used within the standards.Understand the terminology used within the standards. Understand the industry in which the audit is occurring and the ability to apply Understand the industry in which the audit is occurring and the ability to apply
that understanding to that industry sector.that understanding to that industry sector. Evaluate the appropriate level of connectivity or relationship of the standard’s Evaluate the appropriate level of connectivity or relationship of the standard’s
requirements to the organization’s culture.requirements to the organization’s culture. Perform management system process auditing and the associated planning, Perform management system process auditing and the associated planning,
implementation, operating, and monitoring process cycle as employed by the implementation, operating, and monitoring process cycle as employed by the organization.organization.
Evaluate the requirements of the standard or standards being audited by the Evaluate the requirements of the standard or standards being audited by the audit team member and how such requirements should be applied by the audit team member and how such requirements should be applied by the organization.organization.
Evaluate the appropriate level of how the organization fits into an enterprise-wide Evaluate the appropriate level of how the organization fits into an enterprise-wide system if part of a larger entity.system if part of a larger entity.
Understand the purpose of documents specified or referenced by the standard or Understand the purpose of documents specified or referenced by the standard or standards being audited.standards being audited.
Understand the application of documents required by laws and regulations.Understand the application of documents required by laws and regulations. Understand the application of laws and regulations for the organization’s industry Understand the application of laws and regulations for the organization’s industry
sector.sector.
ANAB’s Draft AR, Appendix 1ANAB’s Draft AR, Appendix 1
PlanningPlanningThe CB’s audit team members shall have demonstrated the The CB’s audit team members shall have demonstrated the
competence to:competence to: Evaluate that an organization has an effective process for risk Evaluate that an organization has an effective process for risk
assessment and impact analysis to address man-made, natural, or assessment and impact analysis to address man-made, natural, or technological hazards that have the potential to threaten life, technological hazards that have the potential to threaten life, damage property, or interrupt or disrupt operations in the damage property, or interrupt or disrupt operations in the geographical areas and industry sectors in which the organization geographical areas and industry sectors in which the organization operates.operates.
Understand the internal and external context of the organization.Understand the internal and external context of the organization. Understand the needs of external agencies, customers, and other Understand the needs of external agencies, customers, and other
interested stakeholders with regard to the organization’s system.interested stakeholders with regard to the organization’s system. Understand the impact of the organization’s policy, scope, and Understand the impact of the organization’s policy, scope, and
objectives on its operations and whether or not they have been objectives on its operations and whether or not they have been taken into account during planning stages.taken into account during planning stages.
Understand if the organization’s personnel competency Understand if the organization’s personnel competency requirements are appropriate to the policy, scope, and objectives.requirements are appropriate to the policy, scope, and objectives.
ANAB’s Draft AR, Appendix 1ANAB’s Draft AR, Appendix 1
Implementation/OperationImplementation/OperationThe CB’s audit team members shall have demonstrated the competence The CB’s audit team members shall have demonstrated the competence
to:to: Evaluate that an organization’s risk strategies to adaptively, proactively, and reactively address Evaluate that an organization’s risk strategies to adaptively, proactively, and reactively address
minimization of both the likelihood and consequences of disruptive events are appropriate.minimization of both the likelihood and consequences of disruptive events are appropriate. Understand techniques used to develop and implement the system.Understand techniques used to develop and implement the system. Evaluate the level to which the organization has planned, organized, directed, and managed its Evaluate the level to which the organization has planned, organized, directed, and managed its
system.system. Determine whether strategies are consistent with management policy and stated goals and Determine whether strategies are consistent with management policy and stated goals and
objectives as well as potential risks.objectives as well as potential risks. Determine whether the availability and capability of resources can deal with identified or potential Determine whether the availability and capability of resources can deal with identified or potential
hazards.hazards. Understand the laws and regulations requiring prevention and risk mitigation programs.Understand the laws and regulations requiring prevention and risk mitigation programs. Understand the prevention and risk mitigation strategies for the industry sectors to be audited.Understand the prevention and risk mitigation strategies for the industry sectors to be audited. Determine whether the system includes implemented strategies commensurate with the frequency Determine whether the system includes implemented strategies commensurate with the frequency
of identified hazards and the potential severity of impacts.of identified hazards and the potential severity of impacts.
ANAB’s AR, Appendix 1ANAB’s AR, Appendix 1
Monitoring and EvaluationMonitoring and EvaluationThe CB’s audit team members shall have demonstrated the competence to:The CB’s audit team members shall have demonstrated the competence to: Review training, drill, and exercise records to determine whether the monitoring Review training, drill, and exercise records to determine whether the monitoring
program has achieved program goals and objectives and required capabilities program has achieved program goals and objectives and required capabilities have been established.have been established.
Comprehend whether or not the monitoring and evaluation activities are Comprehend whether or not the monitoring and evaluation activities are appropriate for the organization and the industry sector in which it operates.appropriate for the organization and the industry sector in which it operates.
ReviewReviewThe CB’s audit team members shall have demonstrated the competence to:The CB’s audit team members shall have demonstrated the competence to: Comprehend whether the review, preventive and corrective action, and continual Comprehend whether the review, preventive and corrective action, and continual
improvement activities are commensurate with the organization’s goals and improvement activities are commensurate with the organization’s goals and objectives.objectives.
Comprehend whether review activities are commensurate with the geographical Comprehend whether review activities are commensurate with the geographical location and industry sector in which the organization operated.location and industry sector in which the organization operated.
ANAB’s Draft AR, Appendix 1ANAB’s Draft AR, Appendix 1
Somewhat limitedSomewhat limited Listing of 60+ CBs currently accredited at Listing of 60+ CBs currently accredited at
www.anab.org / certification bodies / directory/ certification bodies / directory ANAB’s accredited CBs are located globallyANAB’s accredited CBs are located globally Expect 8-10 of these CBs to apply for Expect 8-10 of these CBs to apply for
accreditation in the near termaccreditation in the near term As many as 15-25 may eventually applyAs many as 15-25 may eventually apply
Opportunity for employment at CBOpportunity for employment at CB
ANAB AssessorsANAB Assessors
Extremely limited if any!!Extremely limited if any!! High level of third party conformity High level of third party conformity
assessment experienceassessment experience Thorough expert working knowledge of Thorough expert working knowledge of
ISO/IEC 17021ISO/IEC 17021 Crème de la crème Crème de la crème Only contract with 25 assessors to perform Only contract with 25 assessors to perform
over 800 audits per yearover 800 audits per year
Employment opportunities at ANABEmployment opportunities at ANAB
SummarySummary
Where are we all going?Where are we all going?
Third-Party Third-Party PS-PREP AuditorsPS-PREP Auditors
NQA, USANQA, USA
Randy PittmanRandy [email protected]
(800)649-5289(800)649-5289
Third-Party Certification ModelThird-Party Certification Model
Accredited Certification Bodies (CB’s)Accredited Certification Bodies (CB’s) Standards/Requirements for AuditorsStandards/Requirements for Auditors
CB runs Sales & General CB runs Sales & General AdministrationAdministration Assigns audits to auditorsAssigns audits to auditors
Auditor responsible for auditingAuditor responsible for auditing
Auditor ResponsibilitiesAuditor Responsibilities
Audit Responsibilities:Audit Responsibilities: Audit Planning Audit Planning
Technical & LogisticalTechnical & Logistical Conduct AuditConduct Audit Document Report/Submit to CBDocument Report/Submit to CB
CB-specific formsCB-specific forms Recommend Certification statusRecommend Certification status Review CAR’s/Submit to CBReview CAR’s/Submit to CB Audit Admin (expenses, etc.)Audit Admin (expenses, etc.)
Becoming a 3Becoming a 3rdrd Party Auditor Party Auditor
Code of Conduct, Traits, Code of Conduct, Traits, CompetenciesCompetencies
Practical ExperiencePractical Experience Business Continuity ManagementBusiness Continuity Management Management Systems AuditingManagement Systems Auditing
Standards TrainingStandards Training Competence confirmationCompetence confirmation
Code of ConductCode of Conduct
EthicalEthical FairFair Due DiligenceDue Diligence IndependenceIndependence Evidence-Based DecisionsEvidence-Based Decisions
Based on ISO 19011Based on ISO 19011
Traits / SkillsTraits / Skills EthicalEthical Open-minded Open-minded DiplomaticDiplomatic ObservantObservant PerceptivePerceptive Detail-OrientedDetail-Oriented
VersatileVersatile TenaciousTenacious DecisiveDecisive Self-reliantSelf-reliant CommunicationCommunication
VerbalVerbal WrittenWritten
CompetenciesCompetencies
Audit principles and techniquesAudit principles and techniques Management system understandingManagement system understanding Organizational situation applicabilityOrganizational situation applicability Applicable regulations and other Applicable regulations and other
requirements requirements BCM related methods and techniquesBCM related methods and techniques
Including Risk ManagementIncluding Risk Management Critical Infrastructure & Key ResourcesCritical Infrastructure & Key Resources
See DHS.gov; search ‘CIKR’See DHS.gov; search ‘CIKR’
Standards TrainingStandards Training
Recognized/Certified PS-PREP Recognized/Certified PS-PREP CourseCourse Encompassing:Encompassing:
BS 25999BS 25999 ASIS SPC-1ASIS SPC-1 NFPA 1600NFPA 1600
BUYER BEWARE: Recognized PS-BUYER BEWARE: Recognized PS-PREP Course DO NOT exist yet…PREP Course DO NOT exist yet…
Competency ExaminationCompetency Examination
Standards Tri-FectaStandards Tri-Fecta
Sorting out the matrix:Sorting out the matrix: PS-PREP: PS-PREP: ProgramProgram umbrella umbrella
Built on 3 distinct Built on 3 distinct standardsstandards Consider each standard separately in Consider each standard separately in
competency needs analysis, audit, etc.competency needs analysis, audit, etc.
Can be qualified for one or all standardsCan be qualified for one or all standards ““All” will be most marketable qualificationAll” will be most marketable qualification
Connecting with a CBConnecting with a CB
ANAB listing of PS-PREP Accredited ANAB listing of PS-PREP Accredited CB’sCB’s
Documentation to have:Documentation to have: CV (w/ BCM), Training Cert, Audit LogCV (w/ BCM), Training Cert, Audit Log
Contract vs. Full TimeContract vs. Full Time
Working with a CBWorking with a CB
ContractorContractor Likely can work for several CB’sLikely can work for several CB’s Can maintain BCM consulting practiceCan maintain BCM consulting practice
MANAGE CONFLICTS OF INTERESTMANAGE CONFLICTS OF INTEREST 3-6 months in advance scheduling3-6 months in advance scheduling Travel expectedTravel expected Certification maintenanceCertification maintenance
Working with a CBWorking with a CB
Full TimeFull Time Work for one CB onlyWork for one CB only No BCM consulting allowedNo BCM consulting allowed May have other tasks in ramp-up periodMay have other tasks in ramp-up period
Other Audits, Sales, Internal OpsOther Audits, Sales, Internal Ops Utilization 16-18 Audit days/monthUtilization 16-18 Audit days/month 1 - 6 month advance schedule1 - 6 month advance schedule Travel ExpectedTravel Expected
44
Career OpportunitiesCareer Opportunities
Follow-up on Third Party AuditingFollow-up on Third Party Auditing Other OpportunitiesOther Opportunities
Internal AuditorInternal Auditor Compliance or Second Party AuditorCompliance or Second Party Auditor Internal SMEInternal SME External ConsultantExternal Consultant
45
Traits / SkillsTraits / Skills
EthicalEthical Open-minded Open-minded DiplomaticDiplomatic ObservantObservant PerceptivePerceptive Detail-OrientedDetail-Oriented
VersatileVersatile TenaciousTenacious DecisiveDecisive Self-reliantSelf-reliant CommunicationCommunication
VerbalVerbal WrittenWritten
46
47
CompetenciesCompetencies
Audit principles and techniquesAudit principles and techniques
Management system understandingManagement system understanding
Organizational situation applicabilityOrganizational situation applicability
Applicable regulations and other Applicable regulations and other requirementsrequirements
BCM related methods and techniquesBCM related methods and techniques Including Risk ManagementIncluding Risk Management
Critical Infrastructure & Key ResourcesCritical Infrastructure & Key Resources See DHS.gov; search ‘CIKR’See DHS.gov; search ‘CIKR’
48
Two- and Three-Digit Standard Industrial Classification (SIC) Code Table Two- and Three-Digit Standard Industrial Classification (SIC) Code Table
01 AGRICULTURAL PRODUCTION-CROPS 01 AGRICULTURAL PRODUCTION-CROPS 12 COAL MINING 12 COAL MINING 20 FOOD AND KINDRED PRODUCTS 20 FOOD AND KINDRED PRODUCTS
011 Cash Grains 011 Cash Grains 122 Bituminous Coal and Lignite Mining 122 Bituminous Coal and Lignite Mining 201 Meat Products 201 Meat Products
013 Field Crops, Except Cash Grains 013 Field Crops, Except Cash Grains 123 Anthracite Mining 123 Anthracite Mining 202 Dairy Products 202 Dairy Products
016 Vegetables and Melons 016 Vegetables and Melons 124 Coal Mining Services 124 Coal Mining Services 203 Preserved Fruits and Vegetables 203 Preserved Fruits and Vegetables
017 Fruits and Tree Nuts 017 Fruits and Tree Nuts 204 Grain Mill Products 204 Grain Mill Products
018 Horticultural Specialties 018 Horticultural Specialties 13 OIL AND GAS EXTRACTION 13 OIL AND GAS EXTRACTION 205 Bakery Products 205 Bakery Products
019 General Farms, Primarily Crop 019 General Farms, Primarily Crop 131 Crude Petroleum and Natural Gas 131 Crude Petroleum and Natural Gas 206 Sugar and Confectionery Products 206 Sugar and Confectionery Products
02 AGRICULTURAL PRODUCTION-LIVESTOCK 02 AGRICULTURAL PRODUCTION-LIVESTOCK 138 Oil and Gas Field Services 138 Oil and Gas Field Services 207 Fats and Oils 207 Fats and Oils
Understand the vertical of the company you are auditing
49
50
Internal AuditInternal Audit
You might be an Auditor if... You might be an Auditor if... you have no idea that GAP is you have no idea that GAP is also a clothing storealso a clothing store
A Management System Internal A Management System Internal Auditor is not a financial or Auditor is not a financial or operational auditor, but could operational auditor, but could be if they receive the proper be if they receive the proper training training
Required within the SPC.1 and Required within the SPC.1 and BS 25999 standard, but only BS 25999 standard, but only touched upon in NFPA touched upon in NFPA 1600:20101600:2010
51
Compliance or Second Party AuditorCompliance or Second Party Auditor
Not involved with a Certifying Not involved with a Certifying BodyBody
Commonly used in a supply chainCommonly used in a supply chain
Usually hired by the ‘Prime Usually hired by the ‘Prime Supplier’ or ManufacturerSupplier’ or Manufacturer
May be hired by individual ‘subs’ May be hired by individual ‘subs’ in the supply chainin the supply chain
52
Internal SMEInternal SME Management System SMEManagement System SME
PS-Prep SMEPS-Prep SME
Standard Specific SMEStandard Specific SME
Discipline Specific SMEDiscipline Specific SME Emergency ManagementEmergency Management Business Continuity ManagementBusiness Continuity Management Resiliency Resiliency
53
ConsultantConsultant
Types of Consulting Types of Consulting ServicesServices
Management SystemsManagement Systems ImplementationImplementation Audit ServicesAudit Services Training Training Awareness CampaignsAwareness Campaigns
It’s Your TurnIt’s Your Turn
Thank You!
Final WordsOur Hosts Our Sponsor
57
Upcoming Webinars
• Understanding Management Systems• Business Impact Analysis: Techniques and Methods• Human Resiliency: the Next Challenge• Does the Tail Wag the Dog: Supply Chain Resiliency• PS-Prep: Explained!• How to Talk to Your CEO About BCP• A Detailed Look at BS25999• A Detailed Look at NFPA 1600• A Detailed Look at SPC.1• Getting an ROI From Your BCP• Benchmarking Business Resiliency • How to Prepare for a PS-Prep Audit• International Opportunities for BC Professionals
What else would you suggest?
