Tag Archives: disaster recovery

BUSINESS CONTINUITY MANAGEMENT & DISASTER RISK REDUCTION (DRR)

Philip Keshiro, DRI Nigeria

The Sendai Framework for DRR 2015 is a great improvement to the Hygo Framework for Action 2005 – 2015: Building Resilience of Nations and Communities to Disasters.

Having gone through the Hygo Framework, I summarized it with a statement ‘Developing countries help your citizens’.

It was generally not ‘punchy’ and clear BECAUSE any time I get in contact with those implementing DRR, the question is “what has Business Continuity got to do with DRR? ”. Hence, the understanding was flawed (my opinion), implementation was without a clear direction, and coordination was very poor.

I have gone through the Sendal DRR 2015-2030, and I am impressed with the detail and technical terms as shown below – as lifted from the document

The Hyogo Framework for Action: lessons learned, gaps identified and future challenges

1. It is urgent and critical to anticipate, plan for and reduce disaster risk in order to more effectively protect persons, communities and countries, their livelihoods, health, cultural heritage, socioeconomic assets and ecosystems, and thus strengthen their resilience.
2. There has to be a broader and a more people-centred preventive approach to disaster risk. Disaster risk reduction practices need to be multi-hazard and multisectoral based, inclusive and accessible in order to be efficient and effective.
There is a need for the public and private sectors and civil society organizations, as well as academia and scientific and research institutions, to work more closely together and to create opportunities for collaboration, and for businesses to integrate disaster risk into their management practices.

It is important to know that my concept of developing countries is basically AFRICA (Nigeria).

Expected outcome and goal

1. To attain the expected outcome, the following goal must be pursued:

Prevent new and reduce existing disaster risk through the implementation of integrated and inclusive economic, structural, legal, social, health, cultural, educational, environmental, technological, political and institutional measures that prevent and reduce hazard exposure and vulnerability to disaster, increase preparedness for response and recovery, and thus strengthen resilience

The pursuance of this goal requires the enhancement of the implementation capacity __and capability of developing countries, in particular the least developed countries, small island developing States, landlocked developing countries and African countries, as well as middle-income countries facing specific challenges, including the mobilization of support through international cooperation for the provision of means of implementation in accordance with their national priorities.

Findings

1. The goals if it has to be pursued, the knowledge base of the custodians of the DRR must be improved. The international community and the United Nations MUST come out with CLEAR statement that gives direction to help the developing countries who may not understand how to get this ‘implementation capacity’. Most developed countries and leaders within DRR do not even have a clear understanding of Risk Management, Continuity Of Operations Plan (COOP), Business Continuity Planning/Management, Crisis Communication. They do not know how this concept can be used as effective tool in reducing disasters.
2. Economic disasters are not even regarded as disasters, because industries are not generally seen as part of the SYSTEM, meaning that there is no direct connection between financial disaster (collapse of one bank) and physical disasters. To us, until you have deaths running into millions, then you have disaster, without mincing word, you will be told that according to the UN definition of a disaster, ‘this is not a disaster’.
3. A need to go down to the basic of what constitute a disaster and what is a ‘disaster chain’.

III. Guiding principles

(b) Disaster risk reduction requires that responsibilities be shared by central Governments and relevant national authorities, sectors and stakeholders, as appropriate to their national circumstances and system of governance;

(e) Disaster risk reduction and management depends on coordination mechanisms within and across sectors and with relevant stakeholders at all levels, and. it requires the full engagement of all State institutions of an executive and legislative nature at national and local levels and a clear articulation of responsibilities across public and private stakeholders, including business and academia, to ensure mutual outreach, partnership, complementarity in roles and accountability and follow-up;

(g) Disaster risk reduction requires a multi-hazard approach and inclusive risk-informed decision-making based on the open exchange and dissemination of disaggregated data, including by sex, age and disability, as well as on the easily accessible, up-to-date, comprehensible, science-based, non-sensitive risk information, complemented by traditional knowledge;

(l) An effective and meaningful global partnership and the further strengthening of international cooperation, including the fulfillment of respective commitments of official development assistance by developed countries, are essential for effective disaster risk management;

Comments

As beautiful as this guiding principles is, it can ONLY be achieve when different agencies and organizations have a level of understanding which is derived from a standard. Only then can there be coordination (on the field). Each of this organization would have acquired some level of capacity development, have a functional plan in place (within their “different” agencies), which would have been exercise (based on this standard) before coming together as one.
Most cases, you find out that confusion and stampede is the order of the day, where you have those wielding executive power without basic disaster management skill. This is an area we need to walk on.

For (I), This is where DRI International has to form a global partnership with UN to train different nations on the basic knowledge required to anticipate disaster, plan, with the ability to respond, and recover and build better facility that have been damaged or destroyed, using the principles of Business Continuity Planning
.
IV. Priorities for action

1. Taking into account the experience gained through the implementation of the Hyogo Framework for Action, and in pursuance of the expected outcome and goal, there is a need for focused action within and across sectors by States at local, national, regional and global levels in the following four priority areas:
2. Understanding disaster risk;
3. Strengthening disaster risk governance to manage disaster risk;
4. Investing in disaster risk reduction for resilience;
5. Enhancing disaster preparedness for effective response, and to “Build Back Better” in recovery, rehabilitation and reconstruction.

Priority 1. Understanding disaster risk

1. Policies and practices for disaster risk management should be based on an understanding of disaster risk in all its dimensions of vulnerability, capacity, exposure of persons and assets, hazard characteristics and the environment. Such knowledge can be leveraged for the purpose of pre-disaster risk assessment, for prevention and mitigation and for the development and implementation of appropriate preparedness and effective response to disasters
National and local levels
2. To achieve this, it is important to:

(a) Promote the collection, analysis, management and use of relevant data and practical information. Ensure its dissemination, taking into account the needs of different categories of users, as appropriate;

(d) Systematically evaluate, record, share and publicly account for disaster losses and understand the economic, social, health, education, environmental and cultural heritage impacts, as appropriate, in the context of event-specific hazard-exposure and vulnerability information;

(l) Promote the incorporation of disaster risk knowledge, including disaster prevention, mitigation, preparedness, response, recovery and rehabilitation,__ in formal and non-formal education, as well as in civic education at all levels, as well as in professional education and training;

V. Role of stakeholders

1. While States have the overall responsibility for reducing disaster risk, it is a shared responsibility between Governments and relevant stakeholders. In particular, non-state stakeholders play an important role as enablers in providing support to States, in accordance with national policies, laws and regulations, in the implementation of the framework at local, national, regional and global levels. Their commitment, goodwill, knowledge, experience and resources will be required.

(c) Business, professional associations and private sector financial institutions, including financial regulators and accounting bodies, as well as philanthropic foundations, to: integrate disaster risk management, including business continuity, into business models and practices via disaster risk-informed investments, especially in micro, small and medium-sized enterprises; engage in awareness-raising and training for their employees and customers; engage in and support research and innovation as well as technological development for disaster risk management; share and disseminate knowledge, practices and non-sensitive data; and actively participate, as appropriate and under the guidance of the public sector, in the development of normative frameworks and technical standards that incorporate disaster risk management;

(o) Increase business resilience and protection of livelihoods and productive assets throughout the supply chains. Ensure continuity of services and integrate disaster risk management into business models and practices;

(g) Ensure the continuity of operations and planning, including social and economic recovery, and the provision of basic services in the post-disaster phase;

Conclusion

I have tried to highlight areas where developing countries or individuals will find simple and direct instructions as road map.

It is important to state here that based on my personal knowledge and experience, the knowledge of business continuity planning as packaged by DRI International, is the basic knowledge required that can help executives in DRR Management, DRR staff and ALL agencies of government and ministries. Without this knowledge, the African continent will only be moving round in circles without direction, this will be evidence in the following ways;

▪ Lack of understanding of basic terms used in disaster management evidenced during regional and international forums (some officials will ask what is COOP, or Business Continuity Planning – What are these got to do with disaster).

▪ Lack of coordinated response during disasters

▪ Without appropriate plans, proper exercising which should improve plan will not be conducted, if conducted it is used as ‘public show‘ without any aim

▪ Different agencies will be working at cross road, trying to gain popularity from disaster incidents instead of focusing on safety and prevent loss of lives.

It is important that we all take the management of disaster as a profession, and create an appetite for more knowledge in disaster management.

DRR/Safety Institutes, Federal Government, State Governments and Local Governments MUST strive to have the knowledge of Business Continuity Planning principles which is an appropriate tool for Disaster Risk Reduction and a MUST.

May I ask, are you certified?

Kindly contact us on the following; 08054561141, 08125377462, or onaskme@dri-nigeria.org for further inquiries.

Please see www.drii.org, www.dri-nigeria.org

Yours sincerely,

PHILIP KESHIRO ABCP, CISSP, CISA, COBIT 5, AIMIS, ACIA, AISPON, MBA
PROGRAM DIRECTOR

DRI Course Content

BCM - Year 2015 Schedule

1

New THRIVE! Middle East Edition Out Now

DRI is excited to present a special edition of its online magazine, THRIVE! This issue offers readers a first-hand look at the rising business continuity trends in the Middle East and the work of DRI-certified professionals in the region.

As a result of recent business continuity forums held in Abu Dhabi and Qatar, our growing community of certified professionals requested a DRI publication targeted to resiliency matters in the Middle East – matters that are universally relevant to BC pros around the world.

In this issue you’ll find:
• An interview with Mohammed Al Jenaibi, CBCP
• A guide to dealing with your vendors’ BCM planning
• A spotlight on DRI Istanbul’s first-ever Business Continuity Forum,
• And more!
Click here to read the issue, and catch up on previous issues of THRIVE! In our archives.

 

The Xceed Experience: Implementing the Plan

Khaled Embaby, Mahmoud Marzouk, Waleed Yasser, and Mohamed Al Awwa

The role of the business continuity management team at Xceed is to identify potential external and internal risks to the organization and set prevention and recovery plans. This role is not exclusive to planning, but rather it extends to include the management of staff and other resources with the objective of helping the organization to stay in business in the event of a disaster.

In light of the concerns of multiple political forces in Egypt about the possibility of the former president’s son coming to power, Xceed’s BCM Team considered the political unrest in Egypt as a potential risk, so they activated their plan. One precautionary measure was to follow opposition forces through various news sources and social platforms on the Internet.

There was increased social media activity as a result of the extreme dissatisfaction with the outcome of the parliamentary elections. Rumors began to spread that there would be widespread demonstrations.

Events at Xceed proceeded as follows:

January 24: The BCM team took control from the emergency operations center (EOC) at Xceed’s two sites in Egypt, Smart Village and Maadi Call Center Park, to monitor all activities that might affect the normal business flow.

January 25: The Egyptian Youth Coalition announced protests across Egypt. Xceed’s BCM action plans were immediately put in place with special consideration given to the possibility of an imposed countrywide curfew. Such a curfew would pose a major threat to the company’s ability to operate.

January 27: The Egyptian government cut off the Internet throughout the entire country including the corporate links. The resulting impairment to business function caused a dramatic impact on 30 percent of our business.

January 28: Demonstrators declared January 28 as Anger Day in reaction to the violent action taken by police forces to control the persistent and widening demonstrations. It was no misnomer. Egypt witnessed severe and violent confrontations between police forces and protestors. Around 5:00 p.m. the president announced that the Egyptian army would take over the security management of the country. As anticipated, a curfew was imposed from 6:00 p.m. until 8:00 a.m. daily.

The challenge at Xceed began. At the time the curfew was imposed, 880 employees were present at the Smart Village and Maadi Call Center Park sites. It was impossible to send them home because security conditions on the roads were alarming. It was considered much safer to stay at the office. We took immediate action to accommodate those 880 employees by serving hot meals and creating sleeping areas for them. At the same time, we let all the employees call their families to inform them that they were in a safe place and would spend the night on company premises. Additionally, we decided to let employees with small children choose whether or not to come in, as we expected to face the curfew situation during
the Anger Day. Fortunately, all the employees with small children decided not to come in on this day. Accordingly with the work force management team in cooperation with the operations team scheduled only those with no small children for work.

January 29: Egypt reached the red level of security. Police forces withdrew from their positions, prisoners escaped from prisons, looters were on the streets and chaos was everywhere. Xceed’s BCM team made the decision to work with the minimum number of employees required to run operations for our critical business service, which is the Ambulance 123 Hotline. Running only the one service meant accommodating 100 employees for a potentially infinite number of days.

Relying on the previously implemented plans with new daily inputs, and with the support of members of different teams—such as administration, facility management, physical security, and IT support—continuous action was in place to keep the business running and our employees safe. For the following six days, 100 employees were accommodated at Xceed around the clock. For the next three days, 250 employees were accommodated and then over a period of twelve days, we gradually increased the number of employees present until we successfully returned to normal operations.

The BCM team managed to recover business operations successfully in the face of political unrest and despite unforeseen challenges as a result of our precautionary plans. The timing and the size of the political unrest was unexpected as the anticipated political unrest was expected to take place later in the year and at a much smaller magnitude. The chaos that resulted from the reported escape of prisoners and the widespread looting were expected and caused a major physical security threat to employees and the community. Finally, the scheduled internet outage was unexpected, but Xceed’s BCM Team managed to counteract this challenge with only a 30 percent impact on business operations.

 

Xceed is a global provider of quality, multi-lingual Business Process Outsourcing (BPO) services. Xceed has two sites within Egypt, with its headquarters located in Cairo’s technology park, The Smart Village. Xceed has an additional contact center, geographically
and culturally proximate to Europe, at Morocco’s technology park, CasaNearshore Park.

The Outage and The Impact

Waleed Hammad

Despite the extensive efforts that the Egyptian government made in the past years to develop and promote the adoption of technologies, the shutdown of communications services for a full day and the Internet for the first five days during the Egyptian revolution had a great economic impact on most services nationwide. The Organization for Economic Co-operation and Development (OECD) estimated at least $90 million USD in losses in the telecommunication sector alone during the five days of the internet shutdown. This amount refers to lost revenues due to blocked telecommunications and Internet services; averaging $18 million USD per day.

Egypt has other sectors that depend on Internet and communications, including tourism and banking. Although it is difficult to conclusively determine the losses in the tourism sector, the banking sector suffered huge losses. All online banking and e-commerce services went down, ATM machines were almost non-functioning, and credit card payment facilities at local stores and
markets were totally suspended.

The IT outsourcing firms in Egypt are a good litmus test of the state of business continuity management in the region. The IT outsourcing business line grossed $1 billion USD in revenues in 2010 (or around $3 million USD per working day). Most IT outsourcing companies were affected in two different ways: medium-sized call centers, mainly representing non-governmental and/or non-critical domestic services, went totally offline. Other critical operation call centers were fully operational, such as ambulance and fire service and
military services. What follows is a comparison between two different crisis response approaches of two big names in the IT outsourcing field, each with two different geographical locations.

Serving national vital operations, Company A decided to continue operating from its headquarters and main branch by keeping employees literally living onsite, with food and sleeping
facilities in place. As the company is located at Egypt’s prime Communication and Information Technology Cluster and Business Park, the area was totally secured and governed by the military forces during the days of the revolution.

As for Company B, a giant international company, the company headquarters was equipped with a backup satellite Internet connection to serve its international overseas customers during crisis. However, the company decided to shift its main operations to other branches in different countries. The business continuity plan stated that key employees should be ready to travel to other countries should the headquarters becomes inaccessible. The plan was updated to include the addition that key employees should be ready to travel to other countries at any moment if communication went down for a certain period of time.

In brief, the long-term impact of the Internet and communications shutdown on Egypt’s economy is hard to assess. However, this incident reminded business owners why proper business continuity
management is a crucial driver in this region for both international and local business entities. Additionally, it urged the Egyptian government to form a committee to prepare an Egyptian business continuity standard, which is considered to be a step forward in increasing the BCM awareness in Egypt and within the region.

 

References:
Egyptian Cabinet- Information and Decision Support Centre
OECD—Organization for Economic Co-operation and Development

 

Waleed Hammad is the President of DRI MENA, he is also the Co-founder & Managing Director of PROXC Consulting (a leading business continuity management company in the Middle East). He has more than 12 years experience, delivering consultancy
and training to professionals in the Middle East in the areas of business continuity management, risk management, and project
management. He also is a member of the committee responsible of preparing the Egyptian BCM Standard.