Q1 2015Keeping ContinuitySA

clients informed

In this Issue

Editor’s Note

Testing and exercising yourbusiness continuity plans2 Make 2015 the

year for becomingresilient

4 BCAW 2015

6 Webinars

7 Out of the dark -Survival guide forbusiness duringload-shedding

9 Three key (business conti-nuity) questions that CEOs need to ask

8 How many para-chutes does yourbusiness have?

10 Top 8 risks in thehealthcare indus-try in South Africasays ContinuitySA

11 ContinuitySA Training Dates

All Links are now

Interactive!

1

Clear your diaries for the upcoming Business Continuity Awareness (BCAW) taking place nextweek from the 16th to 20th March 2015.The overall theme for BCAW is “testing and exercising your businesscontinuity plans” and this annual event is facilitated by the BCI and is a key vehicle in raising the awareness of the profession and demon-strating the value effective business continuity management has to organisations of all types and sizes.

ContinuitySA has scheduled in conjunction with BCAW some excitingonline events which you can access on page 4.

Our feature article where Michael Davies covers the year of becoming resilient and shares some guidelineswith companies on maintaining a state of preparedness.

Out of the dark, is a survival guide for business during load-shedding and the article highlights some consid-erations for business.

Leigh-Anne van As, Business Development Manager poses the question what three key business continuityAndrew.Blake@askafrika.co.zaquestions a CEO needs to ask so as to comply with King III.

Our final article highlights the 8 risks in the healthcare industry and that these risks should be factored intoorganisations business continuity plans.

I hope you enjoy the latest ContinuitySA Chronicles. Don’t forget you can interact with us via our websiteand our social networks. Join the discussions and let us have your feedback. The more we interact the morewe can grow to help with all issues related to Risk, Resilience and Recovery.

Wishing you health, wealth and resilience.

Cindy Bodenstein

22

Make 2015 the year forbecoming resilient

As one of the goals for the New Year, companies should takestock of how resilient they are; to take steps to improve their ability to prevent disasters, and to recover should one occur.

“As part of their business continuity management, companies as-sess the risks they face, prioritise them and then put mitigationplans in place. That’s prudent and best practice, and somethingevery board should insist is being done on an ongoing basis,” saysMichael Davies, CEO of ContinuitySA. “In addition, I think that weall understand that the risk climate is becoming increasingly morecomplex, and the chances of a totally unexpected ‘Black Swan’event are becoming more likely, that we think companies alsoneed to see business continuity as a way to build a business that’sresilient by nature, intrinsically prepared to bounce back fromanything. Companies should also become more proactive inavoiding disruptions associated with disasters rather than reactingto them when they occur.”

In fact, Davies argues, this type of approach can help executivesand their boards enhance their oversight of the company, anddischarge their obligation to ensure the company’s long-term sus-tainability.

The formal business continuity plan and management processesshould provide the starting point for setting about building a moreresilient organisation, says Davies.

“Once you have done your best to pinpoint all the risks and putmitigation plans in place, then it’s time to put measures in placeto help ensure you are prepared for the unexpected,” he notes.“Based on ContinuitySA’s own assessment of the risk environmentand our experience with clients, we think the following seven ini-tiatives will enhance organisational resilience.”

Understand the wider context in which your business operates,and build links into the surrounding community. This concept tiesback into King III, which links sustainability to serving the needs ofa wide group of stakeholders. “Being a good corporate citizenand genuinely putting people before money immediately makesyour company more resilient. You hear about trouble early onthrough stakeholder connections, and this provides you with an

3

element of ‘trust capital’ to quickly respond and reduce the im-pact of the issue at hand,” Davies points out.

One wonders if the crisis at Marikana could not have beenaverted, wholly or partially, if the mining companies had adoptedsuch a viewpoint.

Be aware of your dependencies—and reduce them if it is practi-cal to do so. Many businesses fail to acknowledge their key de-pendencies, and thus underestimate the risks they represent. Itmay not be possible to eliminate them for all sorts of reasons, butknowing what they are is vital.

One key dependency that’s often insufficiently recognised is“technology accountability”. Many businesses across Africa arereliant on head offices in other countries to provide technologyservices and connectivity, and to store data. This means an out-age at the head office can have far-reaching implications; iso-lated countries need be accountable and to know what theycan and should do to recover the operations in these circum-stances.

Another is supply chain dependency. Today’s complex supplychains create multiple dependencies that resonate (and areoften amplified) up and down the supply chain. Simplifying thesupply chain might be something that makes operational senseat a practical level, but also enhances organisational resilienceenormously. Companies should also satisfy themselves that sup-pliers and business partners have adequate business continuitymanagement in place.

Put proper succession planning and retention initiatives in place.To be resilient in times of crisis, organisations are critically depend-ent on the leadership and other key skills they have at their dis-posal. Organisational resilience is dependent on a company’sability to retain these skills, and ensure that it has successionstrategies in place. The crisis that an organisation faces could be

sparked by the unexpected death of its CEO, for example. Whilethe business continuity plan would be helpful in dealing with thecrisis, true resilience would be guaranteed if an understudy hadalready been identified and was being groomed.

Have the right crisis decision-making structures in place. Thecompany’s normal decision-making structures and processes aretypically too slow to cope with a crisis. Davies says companiesshould make sure they have an agreed methodology for makingswift decisions when required, and that it is specified in the com-pany’s crisis management plan and has been well rehearsedahead of time.

Get customer-focused. It sounds obvious, but many companiesare good at their own processes and not at responding to cus-tomer needs and comments. In the Digital Age, in which socialmedia provide a very public and instant platform for comment,being truly customer-focused is becoming vital to resilience. Atthe very least, put mechanisms in place to monitor and, crucially,respond on social media platforms timeously.

Fight against complacency. This is an ongoing battle, but com-placency is fatal to resilience. Classic mistakes are to miss cyclicalevents such as preparing for your industry’s regular strike season.Another is to underestimate the pace or scope of change. Com-petition today is not only fiercer, it’s starting to change businessmodels. Increased M&A activity, such as we are currently seeing,may be an indicator of this type of step change.

Don’t ignore maintenance. Infrastructure that is working well anddoes not fail is essential to a resilient organisation. This coversbuildings, plant and office equipment, vehicles and ICT.

“Resilience is multi-faceted, but these guidelines will help com-panies maintain a state of preparedness, and confer an abilityto respond quickly,” Davies says. “If your organisation is resilient,then the executive team and board have done their jobs.”

4

Business Continuity AwarenessWeek (BCAW2015) is an annualevent which takes place for oneweek in March. This year it is fromthe 16th to 20th March 2015.

The theme for this year is all around testing and exercising business continuity plans.According to a UK study by Databarracks, less than a third of respondents to a survey (29%) stated that they hadtested their business continuity plan during the previous twelve months. “If a plan isn’t reviewed and tested reg-ularly then the only way to find out if it works is when it is put into action and that may be too late.

This year ContinuitySA has a few things in place for our readers. We have put a blog series in place for the weekand will be blogged daily. The daily topics are as follows and these will be loaded daily for you to read.

Monday 16th Why IT disaster recovery is a …. Disaster waiting to happen

Tuesday 17th Taking IT disaster recovery to the next level

Wednesday 18th Cloud or chimera?

Thursday 19th The $64 000-dollar question

Friday 20th No test, no (IT disaster recovery) solution

You can find all the links to our blogs here http://www.continuitysa.com/media/recent-blog/

ContinuitySA Botswana will be discussing Business Continuity Management on Gabz FM, as part of BCAW. The broadcast will take place at 06:50am each morning for 5 to 10 minutes. They will be covering topics like;

• Defining BCM,

• How to implement BCM,

• Recovery solutions,

• BCM testing and exercising and

• Why Business Continuity.

You can tune in here http://www.gabzfm.com/listen-live.

As part of this line up there are three webinars which will be hosted on BrightTalk and are covered on the next two pages. Be sure to register not to miss out on these exciting and informative topics.

ContinuitySA also have posters which you can download and put up as part of your awareness.

>>Click on the small poster icons left to access all three posters.<<

16th to 20th March 2015

6

Our second webinar for Business Continuity Awareness Week is brought to you byPete Frielinghaus, Senior BCM Advisor for ContinuitySA

Date & time: Friday 20 March 2015 1:00 – 2:-00pm GMTTitle: Testing From out of your comfort zone into your confidence zone

Overview: This webinar is based on actual experiences gained in conducting BCM tests under varying conditionsand environments, including ICT as well as Business and Incident Management testing across a number of indus-trial sectors.

We will be discussing the lessons learnt from some of the following topics relating to recent tests:• The challenges of Testing in Africa• Relocation testing, announced and unannounced• Barriers to effective relocation• Environmental, political and geographic obstacles• Expectations and Cynicism• Social media• Component testing, integrating both technical and business challenges• The Crisis Management Simulation• Real time Scenario based testing – pros and cons• Lessons, a snapshot

Click on the link to register online https://www.brighttalk.com/webcast/1476/144869

Our first webinar is brought to you by Tracey Linnell, General Manager: Advisory Services for ContinuitySA

Date & time: Monday 16 March 2015 1:00 – 2:-00pm GMTTitle: Exercising Analogy: Why owning a pair of trainers does not mean you are fit (and how this applies to BCM)Overview:• I purchased my trainers from a sports consultant (I have a BCM plan from a consultant – now what?)• My trainers have gathered dust (My BCP is covered in dust and coffee stains)• Dusting off the trainers and setting goals (Is my plan fit for purpose and what outcome am I wanting toachieve from the exercise?)

• It’s a long road, with hills and valleys and even a pothole or two (Exercising maturity and challenges alongthe way)

• Committed to fit! (Exercising your BCP is a journey in maturity)

Click on the link to register online https://www.brighttalk.com/webcast/1476/144905.

Webinars

7

“We know that load-shedding is going to occur and, in order toput mitigation strategies in place, we first need to understandwhat the implications are,” says Michael Davies, CEO of Continu-itySA. “What are the issues that businesses should be looking at?Now is a good time to update your business continuity plans inorder to assess the impact of load-shedding on your business andweigh up what your risk appetite is.”

Davies says that because electricity is now so integral to modernsociety, load-shedding creates a complex and interdependentset of risks over and above the task of just keeping the business’slights on. These risks need to be understood within the context ofeach business's strategic plan: Some of the considerations are:

Impact on employees. Regular and extended outages will disturbfamily life in all sorts of ways, from spoiled food and appliancesthat don’t work to transport difficulties and the care of childrenand elderly relatives. Employers need to understand the impactand be empathetic towards the challenges employees may faceduring this time.

Impact on vital services. Extended power outages are likely to af-fect water supplies periodically and also telecommunications.Businesses can solve the water issue relatively easily by installingtheir own gravity-fed tanks that act as an emergency store re-plenished by the municipal water supply. More serious, however,extended power outages could be more than battery backups

Survival guide forbusinesses duringload-shedding

O u t o f t h e D a r k :

As Africa’s premier integrator of business continuity services, Continu-itySA’s team spends a lot of time identifying risks and how to mitigatethem. One risk that has become very real for South African businesses isload-shedding. An unstable power supply with the potential of extendedperiods of power outages over the next several years creates a range ofrisks that have to be integrated into current business plans.

Our third webinar is brought to you by: Miles Murray, GM: Sales and MichaelBrown, Account Manager

Date & time: Monday 16 March 2015 2:30 – 3:30 pm GMTTitle: Burning platformsOverview: Do we need a burning platform to institute change?In a business you need to create options and limit dependencies, businesses need to constantly look forwardscanning the future environment for new products and new way so doing business all the while protecting theircurrent market space and ability to deliver on stakeholder value.

Many times a business can see the looming problem but management procrastinate, due to their mistakenperception that it is not urgent!

Click on the link to register online https://www.brighttalk.com/webcast/1476/149223

Webinars

8

O u t o f t h e D a r k : Continued

at some telecommunications sub-stations can cope with, leadingto interruptions in communications. Davies cautions thatthe impact of load-shedding on ICT disaster recov-ery should also not be ignored.

Impact on the supply chain. Power outagesin other areas will not only affect your em-ployees’ ability to get to work, but also theoperations of suppliers and clients. Today’sbusinesses generally employ just-in-time inventory order systems and, in addition,supply chains are both long and complex—companies must definitely understand theimpact that load-shedding has on its suppli-ers’ ability to meet their commitments, andwhat any defaults will have on its operations.

“We would recommend that companies ensurethey have visibility of suppliers’ business continuityplans,” Davies says. “Traffic congestion due topower outages will also affect deliveries and theproductivity of mobile teams within the organisa-tion and its suppliers.”

Impact on security. Most access control and build-ing management systems rely on power to con-tinue functioning so alternative power plans mustinclude security and access control to avoid the busi-ness becoming a soft target during load-shedding.

Impact on society. One might argue that coping with load-shed-ding could create a kind of nation-building based on the feelingthat “We’re all in this together”. More likely, particularly as the crisisdrags on and on, is that existing social tensions will be exacer-bated. “I have already observed an increase in incidents of roadrage when non-functioning traffic lights cause persistent gridlock,and other forms of aggressive behaviour might also increase,”

says Davies. “I also think that wildcat strikes and episodes of op-portunistic looting could be sparked by load-shedding, particu-

larly when businesses start to lose jobs as they must surelydo.”

Once these inter-connecting risks are well under-stood and integrated in the business continuityplan, companies can put the appropriatebackup power plans in place. Davies concludeswith some guidelines relating to these measures:

Uninterruptible power supplies (UPSs). Make surethat UPSs are correctly sized for the job they have

to do and that they cater for potential extendedpower outages. Furthermore, consider what critical

systems will get priority and what may be turned offwithout negatively impacting the business.

Generators. Most companies will rely to a great extent ongenerators. They need to be maintained and tested prop-

erly, something that is hard to control if they are owned bythe landlord. Like UPSs, they need to be correctly speci-fied—a cheap household generator is not going to copewith frequent and prolonged use. Diesel stocks also needto be managed: Diesel cannot be stored indefinitely, and

the possibility that diesel will be hard to obtain during a pro-longed blackout also has to be faced.

Alternative Power Sources. Businesses will start employingother methods of powering systems such a solar power to reducethe impact of load-shedding. Can you imagine if all the trafficlights were solar powered and the resultant positive effect on traf-fic during power outages!

“We don’t have an option—we all have to understand what thispower crisis means for our individual businesses and take the ap-propriate action,” says Davies. “Reviewing your business continuityplan is a good way to start.”

9

Van As argues that CEOs need to be able to answer ‘yes’ to threekey questions:

• Do you know which products and services offered by yourcompany are vital to ensuring its strategic objectives can bemet?

• Is your organisational structure aligned to the company’sstrategic objectives?

• Do you know exactly which resources (including human re-sources) are required for the company to achieve its strategicobjectives?

“Companies typically offer a multiplicity of products and services,but CEOs and their immediate teams need to understand whichones are absolutely vital to the company’s ability to meet itsstrategic targets. They also need to understand exactly which re-sources are essential to delivering those products and services,”she explains. “Once they have the answers, CEOs and their teamscan allocate investment and attention appropriately, and opti-mise the company’s operations.”

Because companies often lose sight of what their core businessactually is, they can find out too late that even a small disruptionto a vital process can cause a major disruption to clients. Oncelost, market share can be hard to regain—if at all.

“In the same vein, while every part of the business is important,not every part has the same time-sensitivity. Do CEOs properly un-derstand the role each process plays in delivering the strategy;and how quickly, and in which sequence, each one has to be re-stored in the event of a disruption?” Van As asks.

CEOs also need to understand the company’s risk profile—somefirms are more at risk than others. Factors here might be a high re-liance on unionised labour, dependency on a single supplier, oreven the location of the business.

Those companies that don’t have the answers, or that are notconfident of their correctness—and this is likely to be the case ina majority—can find/ validate the necessary information from thebusiness continuity management process.

“As part of putting a business continuity management plan inplace, an initial strategic business impact analysis (BIA) should beundertaken. This helps leaders to understand very quickly the spe-cific risks the company faces. The business impact analysis also in-cludes a subsequent detailed analysis of how the variouscomponents of the organisation interact with each other, andtheir relative importance. It is even likely to identify and quantifythe costs linked to failures, including lost profits.

This kind of detailed understanding of how the company actuallyworks, and the relative impact of the failure of each of its com-ponents, is not just useful in planning for disaster. It also providesvital information that can be used to improve the company’s nor-mal operations and to give the CEO a three-dimensional view ofhow the company works.

Van As says that savvy CEOs can also use the business continuityplan to seize market share when a competitor is suffering a dis-ruption, or even to offer production facilities to competitors if suchan approach accords with the overall strategy.

“In short, the business continuity plan is more than insuranceagainst disaster—it can play a key role in building, and commu-nicating, a sounder picture of what’s important to a company’slong-term success, and help leaders formulate and implementstrategy much more effectively,” Van As concludes. “It can alsohelp CEOs understand the industry context in which they are operating much better.”

Three key (businesscontinuity) questionsthat CEOs need toaskMany CEOs tend to see business continuity managementpurely within the context of complying with King III andother governance codes. But, says Leigh-Anne van As,Business Development Manager at ContinuitySA, CEOsalso need to see how business continuity managementcan help them answer three key strategic questions.

10

“Health care companies need to pay special attention to busi-ness continuity as their businesses deal directly with human life,”Smit explains. “However, ContinuitySA’s experience in both thepublic and private health care sectors shows that certain risks areparticularly acute in South Africa—and that many of them areoverlooked. This may be because many of them are not directlyrelated to the company’s core business, but could have a hugepotential impact on it.”

ContinuitySA believes that the following 8 risks particularly affectthe South African health care sector, and should be factored intoorganisations’ business continuity planning schedules.

Outdated buildings and infrastructure. This risk is particularly highin the public sector as many buildings are leased, and landlordsdo not undertake proper maintenance. In addition, many publichealth facilities are in old buildings in which wiring can be faulty,or in which sprinkler systems are not installed due to heritage reg-ulations. Working in such conditions can negatively affect staffmorale and pose a threat to the safety of both staff and patients.

Over-reliance on third-party suppliers. For budget reasons, a lotof specialised equipment is leased and is often outdated. This inturn, places the organisation at the mercy of suppliers and serviceorganisations; because maintenance engineers, or replacementequipment in the event of a breakdown, are scarce, importantmedical tests or procedures can be delayed. Another supplychain vulnerability is the industry’s heavy reliance on drivers andcouriers for the transport of specimens to medical facilities—unionactivity can thus impact heavily.

In addition, the public health sector is bedevilled by slow procure-ment processes.

Power interruption. Power outages are set to increase in fre-quency and severity for the foreseeable future, a definite risk fororganisations dealing with life-and-death issues. Too many health-care organisations have generators with limited diesel supply, andwith uncertain maintenance and testing schedules. “A crisis orpower outage is the wrong time to find out your alternative powersource is inoperative or can only sustain you for a short period oftime,” Smit notes.

Poor IT infrastructure and disaster recovery. All businesses are de-pendent on IT, but none more than medical laboratories or re-search facilities. Another problem is that business critical andclient-sensitive data is frequently stored on unsecured laptops.

Despite their high reliance on IT, health care companies often donot have adequate IT disaster recovery plans in place, and testingis not performed regularly to ensure both data and systems canbe restored within specified time limits.

Another critical IT dependency for health care is bandwidth, par-ticularly when it comes to remote facilities.

Inadequate security of critical paper documentation. The flipsideof the health care sector’s IT risks is the fact that its continued highdependence on paper documentation such as highly confiden-tial patient records, also creates vulnerability.

Storage of documentation in digital formats is considered to beleading practice. ContinuitySA recommends the implementationof an electronic document management system to ensure com-pliance with the Protection of Personal Information Act, or thebuilding of a fit-for-purpose document storage facility with ade-quate redundancy.

Skills shortages. Specialist human resources are a feature of thehealth care industry but they are in short supply. An organisationcan find itself reliant on certain individuals who cannot easily bereplaced. Exacerbating factors include high attrition rates in thesector owing to low morale, and lengthy recruitment processes.

Crime. While all South African businesses face high risk from crim-inal activity, health care companies have a higher risk becausegoods/samples/specimens are often stolen from research and /or storage facilities because they form critical evidence impend-ing court cases.

The loss of years of research findings, or the theft of patient infor-mation during a robbery also constitutes a risk as the findings areoften irreplaceable and patient information can be highly sensi-tive in nature.

Inadequate buffer stocks. Industry standards stipulate that healthcare facilities must carry at least 30 days’ worth of buffer stocks.Complicating factors for health care providers to adhere to theseregulations include the limited shelf life of some products, and alack of funds to build and manage stockpiles.

Top 8 risks in the healthcareindustry in South Africa saysContinuitySA

Health care companies and facilities in South Africa carry many risks similar to thosefaced by their global peers, as well as those faced by local organisations in other sec-tors. Combined, these risks create a distinctive risk profile for companies in this sector,says, Lynette Smit, a Business Continuity advisor at ContinuitySA.

The one-day course, the ICT Continuity Training is tar-geted at IT and Business Continuity Management (BCM) profes-sionals responsible for the continued uptime of IT services withintheir organisations.

Key elements of the ICT Continuity Course include:

• The link between BCM and ICT Continuity Management;

• The evolution of ICT Continuity;

• The latest concepts and trends in ICT Continuity;

• Conducting an Infrastructure Impact Analysis;

• Formulating and implementing cost effective ICT Continuitystrategies to meet business requirements;

• Security management in ICT Continuity;

• Testing the ICT Continuity framework; and

• A Continuity-as-a-Service case study.

Attendees will not simply be bombarded with theory, but will be taught skills proven in the real world by active BCM practi-tioners with MBCI (Member of the Business Continuity Institute)certifications.

The course is based on the Good Practice Guidelines of the BCIand complies with the new ISO22301 standard to ensure it is onpar with international best practices.

The 5 day Complete Continuity® Practitioners Programme is designed to equip Business Continuity prac-titioners within any organisation in all aspects of implementing,managing and maintaining an effective Business Continuityframework in their respective environments.

The course is based on the Business Continuity Institute’s GoodPractice guidelines and ISO22301 international standard.

Key elements of the 5 day Complete Continuity® PractitionersProgramme include:

• Introduction and Origins of BCM• Trends and Observations• Standards and Compliance• Elements of the BCM Lifecycle• BCM policy and Programme Management• Embedding BCM in the Organisations culture• Understanding the organisation

- Business Impact Analysis- Continuity Requirements Analysis- Risk Assessment

• Determining BC Strategy- Selecting strategies and tactical responses- Consolidating Resource levels

• Developing and Implementing a BC response• Exercising, Maintaining and Reviewing• Measuring BC Maturity

Make the ReactionRoutine

Africa’s largest Business Continuity service provider, ContinuitySA, has enhanced its Complete Continuity Training Academy

To register or to find out more please contact the training department on 011 554 8000 or email us on training@continuitysa.co.za or simply register online

via www.continuitysa.co.za

11

ICT Continuity Training Programme (1 Day Training)

20 May 2015 – Cape Town

Complete Continuity Practitioner Programme(5 Day Training)

11 – 15 May – Cape Town25 – 29 May – Johannesburg