The Definitive Handbook of Business Continuity Management

Andrew Hiles

• Publisher: Wiley
• Year: 2010
• Print ISBN: 9780470670149
• eBook ISBN: 9780470710791
• Edition: 3
• Topic: Business
• Subtopic: Business Strategy
• Index: Business

With a pedigree going back over ten years, The Definitive Handbook of Business Continuity Management can rightly claim to be a classic guide to business risk management and contingency planning, with a style that makes it accessible to all business managers. Some of the original underlying principles remain the same – but much has changed. This is reflected in this radically updated third edition, with exciting and helpful new content from new and innovative contributors and new case studies bringing the book right up to the minute.

This book combines over 500 years of experience from leading Business Continuity experts of many countries. It is presented in an easy-to-follow format, explaining in detail the core BC activities incorporated in BS 25999, Business Continuity Guidelines, BS 25777 IT Disaster Recovery and other standards and in the body of knowledge common to the key business continuity institutes.

Contributors from America, Asia Pacific, Europe, China, India and the Middle East provide a truly global perspective, bringing their own insights and approaches to the subject, sharing best practice from the four corners of the world.

We explore and summarize the latest legislation, guidelines and standards impacting BC planning and management and explain their impact.

The structured format, with many revealing case studies, examples and checklists, provides a clear roadmap, simplifying and de-mystifying business continuity processes for those new to its disciplines and providing a benchmark of current best practice for those more experienced practitioners.

This book makes a massive contribution to the knowledge base of BC and risk management. It is essential reading for all business continuity, risk managers and auditors: none should be without it.

Appendix 1
Case Studies

A1 A to A1 U compiled by Peter Barnes,
FBCI and/or Andrew Hiles, FBCI
A1 V to A1 Z, A1 AC, A1 AD and
A1 AE by Andrew Hiles, FBCI
A1 AA Allen Johnson
A1 AB © The BCI Partnership,
Lyndon Bird, FBCI

AN INTRODUCTION TO THE CASE STUDY SECTION

Statistics

How likely is a disaster? Statistics show that one in five businesses suffer a major disruption to their business activity every year. According to Dell, a third of all companies with a Disaster Recovery Plan have had to invoke it.

The UK Chartered Management Institute has published an annual report into Business Continuity in the UK for ten years, providing the most accurate resource available for measuring real change in the take-up of Business Continuity. The CMI has had various publication partners through the decade, with the 2009 report A Decade of Living Dangerously being published in conjunction with the UK Cabinet Office. The report was based on the views of 1012 senior executives from across the public, private and voluntary sectors.

Key findings were:

• Only 52% of the respondents questioned said their organization had plans in place to cope with business disruption. While this figure is worryingly low, it is a 5% increase on the previous year, and the highest score ever recorded by the survey.
• 32% don’t test their continuity plans at all, a figure that remains largely unchanged since 1999 (30%). Just 21% of Boards take responsibility for Business Continuity Management, down 8 points in two years. Employees suggesting Business Continuity is seen as important by their employer has also dropped – by 12 points – in the past year.
• UK managers are most worried about electronic attacks (58%), human disease knocking out the workforce (57%), the impact of severe weather (52%) and destruction of critical infrastructure (50%). However, just 42% of organizations have plans in place to cater for IT loss and only 30% are prepared to cope with enforced absence of staff or severe weather.

A recent BCM survey was conducted for the Chartered Management Institute, Cabinet Office and Continuity Forum. Since the study was last undertaken, in February 2008, it became clear that the major risk feared by UK organizations has been loss of IT (40%) – a finding consistent with the fears expressed over the past decade. Unsurprisingly, given recent conditions, 25% also said their business had suffered due to extreme weather, but today more (44%) are worried about the impact than they were ten years ago (18%). In the current environment, it is also worth noting that 25% have experienced problems due to negative publicity or damage to brand reputation resulting from poor Business Continuity Planning.

Some other relevant statistics from surveys:

• In North America, over 52% of organizations that have a Crisis Communication Plan have invoked their BCP in the last five years. (Disaster Recovery Journal, Winter 2009.)
• A Compass survey found that 58% of companies surveyed have suffered a disaster during the past five years. In terms of causes, 40% were the result of utility or hardware failures, while 25% were caused by deliberate or malicious action, security breach and personnel loss.
• Overall, Compass found that 38% of surveyed companies have had to invoke their BCP.
• 57% of business disasters are IT-related (London Business School).
• 35% of firms suffering a computer disaster lost over £250 000 ($435 000) (survey by PricewaterhouseCoopers).
• 30% of disasters are caused by fraud, malice and misuse.
• 30% are caused by software and hardware failure.
• 20% are caused by fire, flood or tempest.
• Terrorism accounts for 2% to 5% of disaster invocations (SunGard).

Case Studies: Introduction

It’s never too late to learn from other people’s experience. We were considering dropping some of the older case studies, but feedback from BC user groups and information-sharing groups said the lessons remained valid and the case studies were a valuable aid in teaching and training. While omitting some of the older case studies, we have therefore retained the ‘classics’, updated the newer case studies where necessary, restructured some of the appendices to group similar causes together and included additional case studies to demonstrate the wide range of disaster situations that can be mitigated by effective BCM techniques. More examples of recent disasters are provided in the Introduction to this book.

Natural catastrophes

Table A1.1 identifies the ten most costly world insurance losses from natural catastrophes, from 1980 to 2005. We have not been able to find an update of this. Recent disasters can be found in the Introduction to this book.

Uninsured losses could be up to five times the value of the insured losses. Loss estimates vary widely: Bermuda-based Aspen Insurance Holdings Limited estimated industry insured losses for Hurricane Katrina and the subsequent New Orleans floods to be in the region of $40 billion; Risk Management Solutions, a leading insurance industry analyst, estimated $40–60 billion with total economic losses of $125 billion; Jonathan Rauch, in D.C. Dispatch, raised the figure to $200 billion for direct and indirect economic losses.

Table A1.1—The ten most costly world insurance losses from natural catastrophes, 1980–2005

Source: Swiss Re, sigma, No. 2/2006.

Rank	Date	Country	Event	Insured loss in 2005 $ millions
1	Aug 24, 2005	US, Gulf of Mexico, Bahamas, N Atlantic	Hurricane Katrina (aka Katrine); floods, damage to oil rigs and levees	45 000
2	Aug 23, 1992	US, Bahamas	Hurricane Andrew	22 274
3	Sep 11, 2001	US	Terrorist attacks on WTC, Pentagon, other buildings	20 716
4	Jan 17, 1994	US	Northridge earthquake (magnitude 6.6)	18 450
5	Sep 2, 2004	US, Caribbean	Hurricane Ivan; damage to oil rigs	11 684
6	Sep 20, 2005	Gulf of Mexico, Cuba	Hurricane Rita; floods, damage to oil rigs	10 000
7	Oct 15, 2005	US, Mexico, Jamaica, Haiti et al	Hurricane Wilma; torrential rain and floods	10 000
8	Aug 11, 2004	US, Caribbean	Hurricane Charley	8 272
9	Sep 27, 1991	Japan	Typhoon Mireille/No 19	8 097
10	Jan 25, 1990	France, UK, Belgium, Netherlands et al	Winterstorm Daria	6 864
(1) Property and business interruption losses, excluding life and liability losses (2) Adjusted to 2005 US dollars by Swiss Re Note: Loss data shown here may differ from figures elsewhere for the same event due to differences in the date of publication, the geographical area covered and other criteria used by organizations collecting the data.

The United States sustained 67 weather-related disasters during the 1980–2005 period, in which overall damages and costs reached or exceeded $ 1 billion at the time of the event.

Other sources offer further cases – notably because some of the biggest catastrophes were not insured. The Disaster Center cites several catastrophes not included in the Swiss Re figures. These include the earthquakes around Kobe, Japan, on January 20, 1995, which cost some $131.5 billion and 6433 lives. On April 27, 1991, floods in the Russian Federation cost $60 billion. On December 7, 1988, earthquakes in the Soviet Union caused losses of $20.5 billion.

February 2, 2010 saw floods in the holiday resorts of the Canary Islands that left five dead; cut more than 35% of the electricity supply and 150 000 telephone lines, hampering communications with mainland Spain. Two weeks later, floods recurred. Tenerife was worst hit.

On February 20, 2010, flooding and mudslides on the Portuguese holiday island of Madeira killed some 42 people and destroyed more than 200 homes.

Terrorism

Terrorist bomb attacks have taken place around the world, in most capital cities and softer tourist targets.

In October 2005, 23 people died, including three bombers, in attacks in Jimbaran and Kuta in Bali, Indonesia.

On October 12, 2002, terrorists used a suicide bomber and a car bomb in the nightclub area of the holiday resort of Kuta; 202 people died and a further 209 were injured. Most of the dead were tourists, mainly Australians. A third, smaller bomb attack on the American embassy did relatively little damage.

A total of 2976 people perished in the September 11, 2001 terrorist attacks in New York, Washington and Pennsylvania, excluding the 19 hijackers. Insured losses from the World Trade Center attacks in New York City and the Pentagon are expected to total about $36 billion (in 2005 US dollars), including property, life and liability insurance claims.¹ These barbaric acts are ...

Table of contents

• Cover
• Table of Contents
• About the Editor
• Title
• Copyright
• Dedication
• Contributors
• Foreword
• Preface
• Introduction to the 3rd Edition
• How to Use this Book
• Section One: Achieving and Maintaining Business Continuity: an executive overview
• Section Two: Planning for Business Continuity: a ‘how-to’ guide
• Appendix 1: Case Studies
• Appendix 2: Guidance Notes
• Appendix 3: Professional Associations, Certification Standards and Resources for BCM Practitioners
• Appendix 4: International Perspectives
• Glossary of General Business Continuity Terms
• Index
• End User License Agreement