Operational Risk Management

a business continuity plan starting with a risk analysis, business impact analysis, and alignment of critical

Kaye, David is a leading author, lecturer, examiner and workshop leader on Risk Management and business continuity subjects. Professor Kaye guides a diverse range of companies, and public sector organizations on risk related issues around the world. He is an FCII, FBCI, MIRM, FRSA and chartered insurer. Julia Graham is a former Board member of the Business Continuity Institute, the Chartered Insurance Institute and Chair of the British Standards

Continuity of Operations (COOP) is an effort within individual executive departments and agencies to ensure that Primary Mission Essential Functions continue to be performed during a wide range of emergencies, including localized acts of nature, accidents and technological or attack-related emergencies. To have an effective COOP, an organization must plan and mitigate all aspects of those functions for any type of situation which might cause a disruption of operations. The COOP must also align with the organizations goals in order to continue efficiency. With proper planning and mitigation, an organization can continue operations of their Mission Essential Functions (MEF). The first course of

Good Business Continuity Planning starts with being proactive. That means taking concrete steps to plan for an incident much before it actually strikes. There is no one single approach that fits for all types of incidents as no two emergencies are identical. Much of business continuity planning varies based on the size of the company, company’s line of business, and the locations of the company, customers and suppliers.

The business continuity & disaster recovery is written into the policy to ensure each department knows and has a plan in case of an unexpected event such as a fire, vandalism, and natural disaster that would disrupt normal business. This part of the plan also states that data administrators are the ones responsible to implement procedures for critical backup of data and how long the recovery time would be which is set by the data stewards and other stockholders.

There will be a disaster plan in place for such things as floods, storms, of equipment failure. All customer information will be backed up and on a secure network and system with password protected group policies.

Risk refers to a likelihood, probability, a chance that a loss may occur in a given organization. Most of the times, there is a high risk when there is vulnerability. In this case, vulnerability refers to a weakness that the organization has. Risk assessment refers to the process of identification of potential hazards and proper analysis of the expected losses if those hazards occur (Homeland Security, n.d.). Risk assessment as a way of profiling risk according to impact to the organization. Some organizations have business impact analysis exercises geared towards determination of potential hazards based risk assessment approaches. Organizations’ risk differ depending on the size and the type of business they are doing. The disparity in organizations’ risk call for different adaptation of risk assessment approaches. Even with the disparities of the businesses, proper risk management not only ranks the risks according to the seriousness but also identifies the best methods to control risks in an organization.

There is a multitude of reasons for an organization to have a business continuity plan in place. The incident does not really matter whether it is natural or manmade disaster/incident but if an incident occurs, it can have a disastrous effect causing the company operation to become unstable and having the inability to contain or control its impact can halt the business routine (Vacca, 2013).

An important aspect I want to review is the disaster recovery plan. This plan is different from business continuity but some features do overlap. A disaster recovery plan prepares the business to recover their IT systems and assets after a disaster. Beginning with Wilma Stone, Margie Nelson, and Gary Thomas as management they need to meet with their IT department heads and perform a risk assessment to identify IT equipment and services that are critical to business operations. Identifying these critical components will give an initial point to recovery. As these are essential to business operations, the chosen IT systems should be priority in prevention, response, and during recovery. Charts and documents will help organize this and inform staff on the involved areas.

The Business Continuity plan in Phase 1 is developed to introduce recovery overview information in four parts:

It's goal is to minimize the effects of a disaster or disruption. It means taking the necessary steps to ensure that the resources, personnel, and business processes are able to resume operation in a timely manner. This is different from continuity planning, which provides methods and procedures for dealing with longer-term outages and disasters.

In this day and age, a business continuity plan is essential to an organizations risk management. A large organization like Sunshine Machine Works understand that time is critical when it comes to natural disasters or man made interruptions to their network systems. When a system is offline for excessive amounts of time, could mean a loss to the organization. That’s why having an effective business continuity plan is vital to keeping operations for being disturbed during a time of crisis whether it is an attack or natural disaster that could potentially affect Sunshine Machine Works operations, data and networks.

* Operational Risk: It includes all the major and minor processes taking place in the company. It included: trained Human Resources, strong IT Infrastructure, management and repair of equipments. The risk involved has low

Contingency planners are now asserting that contingency planning is a value-added component that can be a competitive advantage in the marketplace as well a means of helping organizations save money. Processes that are deeply analyzed in terms of continuity will usually be more secure, and new ways of working may emerge to help streamline operations. Contingency planning can be useful when forging alliances with external organizations or during acquisition phases. Contingency planning should be part of an organization’s quality cycle as well. “Business continuity and disaster recovery have gained somewhat in the eyes of top corporate management since the start of the 1990s. As the industry has slowly evolved from what could almost have been called a ‘black art’ to something starting to resemble a disciplined science, basic business principles have begun to become increasingly relevant” (Rothstein, 2003, p. 1).

One well accepted description of risk management is the following: risk management is a systematic approach to setting the best course of action under uncertainty by identifying, assessing, understanding, acting on and communicating risk issues. In order to apply risk management effectively, it is vital that a risk management culture be developed. The risk management culture supports the overall vision, mission and objectives of an organization. Limits and boundaries are established and communicated concerning what are acceptable risk practices and outcomes. Since risk management is directed at uncertainty related to future events and outcomes, it is