View
214
Download
1
Category
Preview:
Citation preview
6th
Chief Audit Executive Conference
Internal Audit – Business Continuity Management (BCM) and Disaster Recovery (DR)
Operational and Risk Management Perspective
10th November 2016 – Track 2
MOORE STEPHENS
BCM and DR in the UAE
BUSINESS CONTINUITY MANAGEMENT – BCM: is a management process that
identifies risk, threats and vulnerabilities that could impact an entity's continued
operations and provides a framework for building organizational resilience and
the capability for an effective response. Source - Disaster Recovery Institute International (DRII)
DISASTER RECOVERY – DR: The strategies and plans for recovering and
restoring the organizations operations, infra-structure and information
technology capabilities after a serious interruption. DR is often considered in the
context of an organisation’s IT and telecommunications recovery. Source -
Business Continuity Institute (BCI)
INTERNATIONAL STANDARD- ISO 22301 specifies the requirements for a
management system to protect against, the impact of disruptive incidents.
MOORE STEPHENS
UAE – Business Continuity Management Standard AE/SCNS/NCEMA
7001:2015 – Supreme Council for National Security. Also, FED RES SCA
No. 7 of 2016 –Corporate Discipline and Governance Standards of Public
Joint-Stock Companies (Article 49 Duties of the Audit Committee)
Do You Support Your Business In Identifying BCM and DR Risks at an Operational Level?
The IIA International Standards for Professional Practice do not specifically state that CAEs should involve their Internal Audit units in BCM and DR work. However, Standard 2100 and 2110 do apply.
Standard 2100: Nature of Work
• The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach.
Standard 2110: Governance
• The internal audit activity must assess and make appropriate recommendations for improving the governance process in its accomplishment of the following objectives:
• Promoting appropriate ethics and values within the organization;
• Ensuring effective organizational performance management and accountability;
• Communicating risk and control information to appropriate areas of the organization; and
• Coordinating the activities of and communicating information among the board, external and internal auditors, and management.
MOORE STEPHENS
Context of BCM and DR at an Operational
Level in the UAE
Over the course of the last 10 years we have witnessed a global recession. The nature and scale of the downturn has never been seen before. Companies such as Lehman Brothers were felled and Iceland was generally considered to be bankrupt. Stock market and international volatility has seen the price of oil drop from over $140 a barrel in 2008, to less than $30 at it’s lowest point. Emergencies, crisis and disasters on this scale create ripples around the world which last for many years and have massive collateral impact on all business sectors. More than ever before operations and risk managers need to be flexible, adaptable and agile in order to stay ahead of the next impending disaster or crisis. Being able to map opportunities based on informed predictions may be a game changer for business. To understand the opportunities Internal Audit needs to know the full extent of your risks in order to enhance and protect your business.
Being ready for anything (e.g. Brexit) is pivotal to success. Incidents such as Samsung’s new phones catching fire can strike at any time.
MOORE STEPHENS
Is Internal Audit Involvement in Reviewing BCM
and DR Risk Really Necessary and Value Adding?
When the Unexpected Happens Will Your Business Be Prepared? How Much of a Role Should Internal Audit Take in Helping The Business Succeed Before and After Disaster Strikes? – Adding Value to Operations and Risk Management is a Fundamental Requirement
Whilst Internal Audit cannot and should not own or directly manage BCM and DR activities, the function is ideally placed to take the lead in providing insight and risk expertise. With that in mind – Do you have plans for contributing to BCM and DR within the Internal Audit Strategy? MOORE STEPHENS
Do Your Senior Managers Understand the
Scale and Potential for Disaster and Crisis?
The increasing scale and frequency of disaster and crisis present a
massive economic consequence for those businesses and people
affected. The rate of climate change and geopolitical upheaval is now
unprecedented.
Scale of the Risk: The Evaluation Report undertaken by the UNDP regarding
‘disaster prevention and recovery’ highlights that in the first 6 months of 2010
160 natural disasters were reported, killing almost 230,000 people and affecting
the lives of 107 million others with a cost of $55 billion in damage.
The above data demonstrates that natural disasters alone create considerable
disruption and economic damage. This coupled with number of manmade
disasters or geopolitical events provides an insight into the level of risk every
operation and risk manager should be considering when assessing the
requirement for the risk management of BCM and Disaster Recovery Planning,
Budgets and Resources.
MOORE STEPHENS
The BCM and DR Jigsaw – Putting the Pieces
Together for a Complete Assurance Picture
A Critical Question for CAEs is: Do Operations and the Risk Management Functions Fully Appreciate the Value of Being Prepared?
A major risk challenge for Internal Audit to overcome is the perception that BCM and Disaster Recovery activities may be viewed by Operations as a financial and resource COST with very little return. IA has a vital role in helping shift that paradigm.
MOORE STEPHENS
What Senior Stakeholders Need to Know
1. If the business suffers a major incident or is impacted by a disaster
how prepared would all operational departments be to cope with the
situation? Has the risk function focused on the right areas?
2. How resilient would the operation be in the face of a major incident and
would the response to the crisis and subsequent recovery activities be
effective?
MOORE STEPHENS
Where to Start?
Do all operational managers know the full extent of the regulatory
requirements and risk tolerance in your enterprise and how much work and
resource they should direct toward BCM/DR planning and development? (This
should include testing and analysis of scenarios and drills).
Internal Audit’s Role in Assisting Operations - Getting the balance right is
crucial.
• Have IA confirmed Executive Management and Board risk appetite?
• Have IA confirmed the organisations BCM and Disaster Recovery
Strategies and Plans have been developed and are in place –
Remembering that ‘Bias for Optimism’ is not a Strategy;
• A fundamental question for CAEs to ask is, when did the business last
have a CHECK-UP? Having machinery serviced even when everything is
running well is normal. This also applies to BCM;
• Have IA Independently assessed Business Continuity risk exposure?
• Have IA confirmed whether management’s risk assessment is
comprehensive and complete i.e. encompasses ‘Black Swan’ events?
MOORE STEPHENS
Where to Start?
• Have the weakest links been identified in your
BCM and DR chain? Do IA know where the
‘pinch-points’ and bottle-necks are within your
systems and sure they are addressed, to
ensure preparedness is not compromised and
resilience maintained;
• Do IA know your companies suppliers and
their vulnerabilities or disaster resilience.
Make a point of confirming that management
know who provides them with their factors of
production or service delivery throughout the
tiers of supply; and
• Have IA confirmed the ‘Dilbert’ approach to
BCM and DR isn’t the only option for the
business. Up to 40% of businesses affected by
a natural or human-caused disaster never
reopen. (Source: USA Federal Emergency
Management Agency (FEMA) & Insurance Information
Institute)
MOORE STEPHENS
The Global Risks Landscape 2016 – Helping
Operations Navigate the Unpredictable
Top 10 Risks in Terms of Likelihood Top 10 Risks in Terms of Impact
1. Large Scale Involuntary Migration 1. Failure of Climate Change Mitigation Adaptation
2. Extreme Weather Events 2. Weapons of Mass Destruction
3. Failure of Climate Change Mitigation Adaptation
3. Water Crisis
4. Interstate Conflict 4. Large Scale Involuntary Migration
5. Natural Catastrophes 5. Energy Price Shock
6. Failure of National Governance 6. Biodiversity Loss and Ecosystem Collapse
7. Unemployment or Underemployment 7. Fiscal Crises
8. Data Fraud or Theft 8. Spread of Infectious Diseases
9. Water Crisis 9. Asset Bubble
10. Illicit Trade 10. Profound Social Instability
Source: World Economic Forum: Global Risks Perception Survey 2015.
MOORE STEPHENS
BCM and DR – Understanding the Risk Interdependencies
MOORE STEPHENS
Source: World Economic Forum: Global Risks Report 2016.
You’re Only As Strong As Your Weakest Link
Uncertainty around risk in the mid to long term can make it
hard for operational managers to predict which threats to plan
for. New risks emerge continually. Therefore, dynamic risk
management systems need to be in place in order for
businesses to remain prepared and maintain resilience.
“There are known knowns; there are things that we know that
we know. We also know there are known unknowns; that is to
say we know there are some things we do not know. But there
are also unknown unknowns, the ones we don’t know we don’t
know.” Donald Rumsfeld, US Defence Secretary, 2002
By Undertaking independent assessment
and analysis CAEs are in a prime
position to be able to help operational
management in identifying the ‘Unknown
Unknowns’ and critical risks areas.
MOORE STEPHENS
Case Study 1
Business Continuity Management &
Disaster Recovery Success Johnson and Johnson (J&J) -Tylenol Sabotage Crisis Tylenol packages were tampered with and the contents replaced with Cyanide pills
MOORE STEPHENS
Communication; Communication; Communication =
A Recipe for a Winning BCM Strategy
• In the 1980s Cyanide-laced Tylenol
capsules, were placed in a number of
packages and resealed. The perpetrator
then deposited them on the shelves of a
several sales outlets in the Chicago area. A
number of customers who took the
poisoned pills subsequently died;
• Prior to the crisis Tylenol was the most
successful over-the-counter pain relief
product of it’s kind in the United States with
reportedly over one hundred million
users;
MOORE STEPHENS
Communication; Communication ; Communication =
A Recipe for a Winning BCM Strategy
• J&J’s immediate reaction and response was to alert consumers across
the nation, via various media, not to consume any type of Tylenol
product.
• J&J stopped production and advertising of Tylenol and ordered a
publically communicated national withdraw of every capsule. J&J
demonstrated that they were not prepared to take risks with public
safety despite the multi-million dollar cost.
MOORE STEPHENS
Case Study 2
Business Continuity Management and
Disaster Recovery Failure
TEPCO (Tokyo Electric Power), Owner
and Operator of the failed Fukushima
Nuclear Power Plant.
MOORE STEPHENS
What Can We Learn About BCM Planning and Operational
Effectiveness From the Failures at Fukushima
In 2007, TEPCO was forced to shut the Kashiwazaki-Kariwa Nuclear Power Plant
after the Niigata Earthquake. Therefore, the company was familiar with the
impacts and consequences of natural disasters which affect Japan and the
region.
It is reported that between 2008 and 2011 TEPCO made a prediction that
an earthquake and associated tsunami could occur at the Fukushima
Daiichi nuclear plant site. This was based on knowledge of a similar but
earlier event in the region which took place in 1896 and caused massive
destruction.
In March 2011, following the Tōhoku Earthquake and Tsunami, TEPCO’s
power plant at Fukushima Daiichi was the site of one of the world's most
serious nuclear disasters.
MOORE STEPHENS
Cause of the Fukushima BCM and DR Failure
The Fukushima Nuclear Accident Independent Investigation
Commission (NAIIC) report is damning and found that:
• The causes of the accident had been foreseeable i.e. robust
BCM and DR could have prevented the devastation;
• The plant operator, TEPCO, had failed to meet basic safety
requirements;
• The accident was the result of collusion between the
government, the regulators and TEPCO; and
• There was a lack of governance by said parties. Therefore,
the accident was clearly “manmade.”.
The government, the regulators, and TEPCO management,
lacked the preparation and the mind-set to efficiently operate
an emergency response to an accident of this scope. None,
therefore, were effective in preventing or limiting the
consequential damage.
Lessons for Operations and Risk Managers form
Fukushima
Despite management knowing the potential impact of a major
earthquake and associated tsunami on Fukushima’s Nuclear Plant
insufficient was done to protect the site.
Key Lessons:
• Management and the regulator’s failure to learn, respect and apply the
experiences of Three Mile Island and Chernobyl;
• Poor ‘Corporate Culture’ and respect for safety;
• Secrecy, poor communications, a lack of transparency resulted in
suspicion of a cover-up regarding the amount of contamination and
continued levels of radioactive pollution post event;
• Ignoring known safety threats;
• An ineffective regulator not willing to challenge or force compliance;
• Acceptance that it was customary to cover-up small scale accidents;
(CULTURE) and
• Deficiencies in the processes and procedures to react to major
incidents.
MOORE STEPHENS
MOORE STEPHENS
Utilising BCM and DR Operational Assurance To
Prevent Your Business Becoming a Dinosaur
PREVENTION IS BETTER THAN THE CURE
Risk Assess & Analyse
Provide Recs to Resolve
Issues in line with Risk Appetite
Confirm Improvements Implemented
Test and Confirm
Resilience
Follow-up to ensure Upkeep
Do you apply this type of cycle?
MOORE STEPHENS
Harnessing The Power of Predictive Analytics to Support
Operations in Delivering Robust BCM and DR Risk Management
Operational risk assessment and planning assumptions based on speculation or
current/topical threats can be useful. However, given globalisation, the rapid pace of
change in international markets and technology, Moore Stephen’s believe it is
necessary for Internal Audit to be flexible and place more emphasis on ‘Predictive
Analytics’. Utilise data from sources such as EM-DAT (International Disaster Database),
the Global Risk Data Platform, and DesInventar to supplement ‘in-house’ or cross
organisational knowledge.
• Utilise statistical techniques from predictive modelling to assess the
probability or likelihood of future disaster or crisis events to help the
business target BCM and DR resources and plans;
• Seek to exploit patterns found in your companies or sector’s transactional or
historic data to identify risks and seek ways to mitigate likelihood and impact
of potential emergency events;
• Develop predictive scores based on assumptions and scenarios which can
help inform or influence operations visualise BCM and DR events holistically;
• Leverage actuarial know-how to add real value and methodical analysis to the
BCM and DR process; and
• Work with operations and risk specialists to optimise the effectiveness and
credibility of predictive analytics – Collaborative approach.
MOORE STEPHENS
BCM/DR and Internal Audit’s Position
Three Lines of Defence Model – Making it Work to Improve Operational and Risk Management Preparedness for a Crisis or Emergency Event
MOORE STEPHENS
Support Management to Enhance and Protect the
Business: Effective Governance and Risk Management
Utilise the five COSO Categories to help management balance cost and
benefit when undertaking Business Continuity and Disaster Recovery
planning. Support operations by independently assessing risk and
developing BCM/DR Risk Assurance Matrix. Look to ‘Predictive Analytics’ to
assess the category, potential and possible severity of future emergencies
and disasters. CAEs are uniquely placed to provide advice and
support to help develop the risk picture of the
enterprise. By producing a BCM and DR Risk
Assurance Matrix, Internal Audit can make sure they
are aligned to the right issues. A BCM/DR assurance
matrix can then be used to prioritise assurance
resources and activities. Knowing those events which
will have a critical impact on the business provides a
head start in a crisis or disaster. Thinking forward and
understanding interdependencies can be vital in
maintaining value, brand image and reputation when
the unexpected happens.
MOORE STEPHENS
Business Continuity Management – Maintaining Brand
Equity CAEs Advocating the ‘Right Thing To Do’
The build quality of
our all-in-one
computers has been
compromised and
the newly launched
Sonic range are
catching fire after
they have been
running for over 5
hours.
What should we do?
Do what is right.
Stop production, recall
all affected sonic lines
and publish an
emergency message
to all users to stop
using their computers.
Speak to the PR team
before getting Legal
counsel involved.
MANAGEMENT INTERNAL AUDIT
MOORE STEPHENS
Where can CAEs Add Value?
Helping operations and risk managers succeed by
advising on - Targets and Performance Indicators
for each phase of the Business Continuity and
Disaster Risk Cycle:
• Avoidance and Deterrence – IA can look at ways
the business can avoid certain risks;
• Mitigation – IA can contribute to Risk
Management by applying insight and cumulative
knowledge to the development of preventative
measures;
• Reaction – IA can assist by confirming that
emergency response and crisis management
plans are in place, tested and work;
• Remedy and Recovery – IA can assess the
feasibility and reliance which can be placed on
Disaster Recovery Plans;
• Business as Usual – IA can help by confirming
that restoration and normalisation of business
activities and services have been effectively
assessed, resourced and planned.
MOORE STEPHENS
Managing the Ripples from a Disaster or Crisis Incident.
The Importance of Internal Audit Involvement
Ensuring Internal Audit involvement and insight is applied to BCM and DR
to enhance and protect at an operational level can help:
• Lessen or minimise the effect of an incident on operations;
• Evaluate disaster preparedness, as well as provide an objective base for
vulnerability assessment and contribute to operational priority setting.
• Operations are facilitated to recover from a disaster or crisis more
rapidly than if no IA BCM assurance or advice were in place;
• Operations potentially gain a competitive advantage;
• Reduce reputational impacts and damage to brand image through the
application of IA advice and experience;
• Obtain a better understanding of the operation. Also, the extent of
interdependent risks which can culminate during an incident;
• Reduce the cost of the insurance burden by being able to demonstrate
sound systems of BCM and DR through independent IA assurance;
• Apply informed risk management principles to lessen your
organisation’s end to end vulnerability to certain disaster or crisis
related risks – Risk Assurance Matrix;
• Periodic independent resilience assessments confirm the state of
preparedness and ability to continue operations in the face of a
disaster;
MOORE STEPHENS
Managing the Ripples from a Disaster or Crisis Incident
The Importance of Internal Audit Involvement
Ensuring Internal Audit involvement and insight is applied to BCM and DR
at an operational level can help:
• Dispel the myth that insurance will protect operations. In respect of risk
management, insurance can cushion a blow but is not a substitute for
well thought out BCM and Disaster Recovery Planning;
• Make sure managers and operational staff really do know what to do in
an emergency or crisis. Also, raise general awareness and tackle
complacency;
• Ensure that management understand that Business Continuity is much
more that Disaster Recovery – Keeping the business going during a
disaster is vital if you want to be in a position to undertake recovery
action once the threat or emergency has passed;
• Establish and maintain a focus on the Clarification of Management
Roles;
• Establish a reasoned allocation of the portfolio of critical risks across
the business to spread dependency and ensure responsibility does not
rest with a limited nucleus of mangers; and
• Ensure that a Crisis/Disaster approach is in place that identifies inter-
dependencies between risks, systems, different parts of the business,
regions, suppliers etc. and is sufficiently flexible to adapt to changing
risks.
MOORE STEPHENS
Are you applying an AGILE Approach to Respond to Operational
and Management Requirements for BCM and Disaster Recovery
Insights?
Assurance Make sure the Board, Audit and Risk Committee and Stakeholders requirement for BCM and DR ASSURANCE is understood and addressed within the IA Strategy and Annual Plan. Highlight any gaps or areas that will not be covered. Use Outsourcing and Co-sourcing to obtain the right mix of assurance skills or to supplement internal resources.
Good Governance
Apply the COSO model to the business in order to ensure that BCM and DR governance and transparency issues are addressed within the operational and risk management BCM and DR Strategy and Plans. Develop a BCM/DR Risk Assurance Matrix to support managements analysis and help protect against future adverse events.
Independence Apply the three lines of defence model and work with the business on an BCM and DR Assurance Map. Making sure that the Internal Audit function maintains Independence. Undertake Independent Horizon scanning to make sure the business has sufficient coping capacity and can be adaptive.
Looking Forward Tap into Predictive Analytics and Actuarial Professional capabilities. Utilise the human capital of the business (Utilise secondment of BCM and DR Specialists into Internal Audit) Innovate to help enhance and protect business capacity and resilience to protect the business.
Educate
Seek to be part of the BCM and DR testing and check-up process and promulgate lessons learned. Utilise Internal Audit’s advisory capability to highlight the Upside of being prepared. Make sure the business budgets for disaster and tackle complacency . The cost of failure can mean the end of the business.
MOORE STEPHENS
Perceptions of Significant Risk
The next slide is duplicated in the hand-outs already on your tables. Please highlight the top 3 threats you consider most likely to affect the UAE or your operations in the short to medium term (i.e. 18 months to 3 years). Please feel free to add any additional risks you consider relevant which may not be captured on the hand-out.
MOORE STEPHENS
MOORE STEPHENS
Discussion and Questions?
Points to Ponder
1. Do your operational managers actively maintain a BCM
Plan and DR Plan? Are BCM and DR risks on their radar
and the Board’s agenda?
2. How much involvement does your Internal Audit function
have within the organisations BCM processes and DR
activities? Is it sufficient to meet the Professional
Standards or regional regulatory requirements?
3. How do you measure resilience within your business?
4. Could you develop and use a BCM/DR Risk Matrix and
Predictive Analytics with your risk teams or operational
managers?
MOORE STEPHENS
Contact Us
Robert Noye-Allen Partner – Governance, risk and assurance
(GRA)
E robert.noye-allen@moorestephens.com
T +44 (0)20 7334 9191
www.moorestephens.co.uk
Anthony Blenkey Director for UAE and Qatar
(GRA)
E anthony.blenkey@moorestephens.com
T +44 (0)20 7334 9191
www.moorestephens.co.uk
Amin Musa Associate Director – Middle East Sales
E amin.musa@moorestephens.com
T +44 (0) 2076511161
M +44 (0) 7741248072
www.moorestephens.co.uk
Scott Garnett Senior Manager – Governance, risk and assurance
(GRA)
E anthony.blenkey@moorestephens.com
T +44 (0)20 7334 9191
www.moorestephens.co.uk
MOORE STEPHENS
Key References
• International Institute of Internal Audit – (www.theiia.com)
• Chartered Institute of Internal Audit (UK) – (iia.org.uk )
• Institute of Risk Management - (www.theirm.org)
• Business Continuity Institute (BCI) – (www.thebci.org)
• Disaster Recovery Institute (www.drii.org)
• USA Federal Emergency Management Agency (FEMA) – (www.fema.gov)
• Insurance Information Institute – (www.iii.org)
• The World Economic Forum – (www.weforum.org)
• The Organisation for Economic Cooperation and Development (OECD) – (www.oecd.org)
• Evaluation Report - UNDP (United Nations Development Programme – (www.undp.org)
• COSO – Committee of Sponsoring Organisations of Treadway Commission – (www.coso.org)
Recommended