How large is your organisation: Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large

(500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff)

How distributed is your company? Single site Multinational - less than 50 locations Multinational - 50 or more locations Multinational - 50 or more locations National - 10 or more locations National - 2 to 10 locations National - 2 to 10 locations National - 2 to 10 locations Multinational - 50 or more locations National - 10 or more locations National - 2 to 10 locations National - 10 or more locations Multinational - 50 or more locations National - 10 or more locations Multinational - less than 50 locations National - 2 to 10 locations Multinational - 50 or more locations Single site Multinational - 50 or more locations Multinational - less than 50 locations National - 10 or more locations Single site Single site National - 2 to 10 locations National - 2 to 10 locations National - 10 or more locations National - 10 or more locations Single site National - 10 or more locations Single site National - 10 or more locations Multinational - less than 50 locations Multinational - 50 or more locations National - 10 or more locations Single site National - 10 or more locations Multinational - 50 or more locations National - 2 to 10 locations National - 10 or more locations Multinational - 50 or more locations National - 10 or more locations National - 2 to 10 locations Multinational - 50 or more locations Single site Multinational - 50 or more locations Multinational - 50 or more locations Multinational - less than 50 locations National - 10 or more locations National - 2 to 10 locations National - 2 to 10 locations National - 10 or more locations Multinational - 50 or more locations Multinational - less than 50 locations Multinational - 50 or more locations National - 2 to 10 locations Multinational - 50 or more locations Single site Multinational - 50 or more locations Multinational - less than 50 locations Multinational - less than 50 locations

Small (1 - 99 staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Medium (100 - 499 staff) Medium (100 - 499 staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff)

National - 2 to 10 locations Multinational - 50 or more locations Single site Multinational - less than 50 locations National - 10 or more locations Multinational - 50 or more locations Multinational - 50 or more locations National - 2 to 10 locations Multinational - 50 or more locations National - 2 to 10 locations National - 2 to 10 locations Single site Single site Multinational - 50 or more locations Multinational - 50 or more locations Multinational - less than 50 locations Multinational - less than 50 locations National - 2 to 10 locations National - 10 or more locations National - 10 or more locations Multinational - less than 50 locations Single site Multinational - less than 50 locations Multinational - 50 or more locations National - 10 or more locations National - 10 or more locations National - 2 to 10 locations National - 2 to 10 locations Multinational - 50 or more locations Multinational - 50 or more locations Single site Multinational - 50 or more locations Multinational - less than 50 locations Single site National - 10 or more locations Multinational - 50 or more locations Multinational - less than 50 locations Multinational - less than 50 locations Single site National - 10 or more locations Multinational - less than 50 locations National - 2 to 10 locations National - 10 or more locations Multinational - 50 or more locations Multinational - less than 50 locations Multinational - less than 50 locations Multinational - less than 50 locations Multinational - 50 or more locations Multinational - 50 or more locations Multinational - 50 or more locations National - 10 or more locations National - 2 to 10 locations National - 10 or more locations Multinational - 50 or more locations National - 10 or more locations Multinational - 50 or more locations Single site National - 2 to 10 locations Multinational - less than 50 locations Multinational - less than 50 locations Single site Multinational - less than 50 locations National - 2 to 10 locations

Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Select here Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Medium (100 - 499 staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Large (500+ staff) Small (1 - 99 staff) Large (500+ staff) Large (500+ staff)

Multinational - less than 50 locations Multinational - 50 or more locations Multinational - 50 or more locations National - 10 or more locations Multinational - less than 50 locations Multinational - 50 or more locations National - 2 to 10 locations National - 2 to 10 locations National - 10 or more locations National - 10 or more locations Multinational - 50 or more locations Multinational - less than 50 locations National - 10 or more locations Multinational - 50 or more locations Single site National - 2 to 10 locations Multinational - less than 50 locations Single site Multinational - less than 50 locations Select here National - 2 to 10 locations Multinational - 50 or more locations National - 2 to 10 locations Multinational - 50 or more locations Multinational - 50 or more locations National - 10 or more locations Single site National - 2 to 10 locations Multinational - less than 50 locations Multinational - less than 50 locations Multinational - 50 or more locations National - 2 to 10 locations Multinational - 50 or more locations Multinational - 50 or more locations Multinational - 50 or more locations Multinational - less than 50 locations Multinational - less than 50 locations National - 10 or more locations Multinational - 50 or more locations Single site National - 10 or more locations

What is your main industry sector? What level of manager is responsible How for managing is the BIA the information BIA process? collected? Financial services Banking Transport and logistics Other Financial services Health products & services Public sector Public sector Financial services Public sector Other Financial services Other Financial services Health products & services Health products & services Financial services Public sector Computer software & services Financial services Telecommunications Public sector Financial services Public sector Computer software & services Banking Banking Financial services Financial services Food, drink & tobacco production Financial services Financial services Leisure Insurance Other Manufacturing Transport and logistics Other Other Financial services Transport and logistics Banking Telecommunications Banking Other Financial services Other Other Other Public sector Public sector Financial services Computer software & services Select here Banking Banking Computer software & services Financial services Financial services Energy Middle manager Middle manager Middle manager Senior manager Middle manager Middle manager Middle manager Middle manager Senior manager Middle manager Senior manager Middle manager Non-managerial Senior manager Middle manager Senior manager Select here Senior manager Senior manager Senior manager Junior manager Middle manager Middle manager Non-managerial Middle manager Middle manager Middle manager Middle manager Middle manager Senior manager Non-board director Junior manager Senior manager Junior manager Senior manager Junior manager Non-board director Middle manager Senior manager Middle manager Senior manager Non-managerial Senior manager Senior manager Middle manager Senior manager Middle manager Non-managerial Select here Senior manager Middle manager Middle manager Middle manager Board director Non-managerial Senior manager Senior manager Senior manager Board director Middle manager

Questionnaire Face to face (Workshops) Questionnaires and interviews with managers and staff; no one is left out. Electronic survey Excel-based BIA questionnaire for roll-up into a database email questionnaires By questionnaire and follow up meetings By questionnaire and follow up meetings Each Business area completes Annual BIA (Standard Form) (or updates existing BIA Via one to one interviews with senior management. Interviews following a questionaire By conducting workshops, meetings, & answering questionnaires. Via interview for initial BIA. Via 1-1 meetings with business area managers / contacts Meet with subject matter experts from each discipline a business process depends on Interviews only interview, questionnnaire Questionnaire's for each department as well as interactive workshops designed to ide By Questionnaires depending on the regional practises or industry practises. No comm Templates and guidence notes. Meeting if required, examples given. Follow-up works Interviews and survey questionnaire Survey and follow up questions for clarification purposes electronically via email. Questionnaire Interviews and questionaires By Questionnaires followed by interviews. By Questionnaires followed by interviews. Questionnaire Manual excel spread sheets. Consultant-led workshop and follow-up interviews By face to face interview of Directors substantiated by data and one on one sessions Questionnaire Via a series of face-to-face departmental workshops Survey and follow up interviews Via Questionaire with client. Across functional boundaries within the client's organiza via paper form through snail mail or completed over the phone Face to face structured interview using standard questionnaire and templates. Hard c By way of questionnaires and interviews. by interview with key managers Interview Checklist & template by the line manager ^Personnal interview Via a series of interviews and predefined questionaires. The BIA is conducted from tw Workshops, Interviews, questionnaires Manually MS Word based template Interviews It is not. Via workshops and interviews with key personnel from wach department survey Interviews and discovery meetings. workshops & self assessment surveys(dependant on criticality of dept to business) Through the users Survey templates. Questionnaire, generated and filled in MS-Access dbase, in personnal, individual mee Unitwise data on BIA is collated for each business / functional stream users a supplied with an information ID asset form, then a BIA template. They are give integrated as part of the BRP six monthly review with an overall prioritisation exercise Meetings and workshops with each line of business BIA information is collected in conjunction with information being collected to meet Sa

Computer software & services Financial services Banking Aerospace & defence Other Manufacturing Other Insurance Financial services Banking Other Other Other Financial services Manufacturing Financial services Financial services Computer software & services Construction Financial services Insurance Computer software & services Computer software & services Financial services Utilities Financial services Other Other Health products & services Financial services Other Financial services Health products & services Insurance Retailing Financial services Telecommunications Health products & services Public sector Financial services Other Health products & services Public sector Public sector Financial services Financial services Computer software & services Financial services Insurance Financial services Other Transport and logistics Other Financial services Financial services Transport and logistics Financial services Computer software & services Leisure Financial services Financial services Computer software & services Utilities

Senior manager Non-board director Select here Senior manager Middle manager Senior manager Non-board director Senior manager Senior manager Non-board director Middle manager Senior manager Junior manager Middle manager Middle manager Middle manager Non-managerial Senior manager Junior manager Middle manager Junior manager Senior manager Non-board director Non-board director Senior manager Middle manager Senior manager Non-managerial Non-board director Senior manager Senior manager Senior manager Middle manager Middle manager Middle manager Middle manager Non-board director Middle manager Non-managerial Senior manager Non-managerial Senior manager Senior manager Middle manager Senior manager Middle manager Middle manager Middle manager Middle manager Middle manager Senior manager Board director Senior manager Non-managerial Non-managerial Senior manager Non-managerial Senior manager Middle manager Middle manager Senior manager Junior manager Middle manager

Department heads at meetings Interviews with all senior staff following formal process. We are in the planning stage of our BIA. We intend to circulate a survey, and do follow Through combination of brainstorming and interview sessions. Using checklists and questionnaires by the BCP Coordinator Through project plans and interviews Up to local BC managers Interview style primarily. Via paper survey: Brief questionnaire to gather (1) impact data and (2) recovery requirements under 4 he Through an interview process Face-to-Face interview of senior managers, conducted by experienced B/C profession surveys By interviews with business team, template form completion, financial department rev questionnaire Interview, e-mail, departmental meetings, questionnaire: Form was designed and sent to all different business units to fill out and followed up w

Interviews with operational managers By questionnaires sent annually to all department managers MS Word Document - to work with our planning software By using Questionaries Interviews with business line leads and staff Through enterprise level Business Resumption Services Specialist Consultancy appointed to conduct initial BIA and produce reports, maintaine interviews and questionnaires Strohl Systems BIA Tool By interview.

Via software and then follow up calls if necessary. Survey of staff Retained an external consultant Interview templates Survey information is gathered during structured workshops using a detailed questionnaire Template Access Data base survey questions linked to MSWord documentation. Strohl Systems' BIA Pro; interviews, questionnaires Individual interviews with key managers and staff in all areas. Via questionnaire completed in 1-1 meetings with business area managers questionnaire, interviews, and queries to product information database Electronic survey distributed to all departments and interviews conducted with each pa Using proforma and question forms Regionally (11 regions) Template completed by business managers with BC responsibility Through questionairres directed at Process, System and minimum resourcing levels. interview and workshops BIA workbook Currently via templates in MS Word Computerised model, done in one-on-one sessions with business units Use of Sthroll software and individual interviews Specifically assigned tasks to senior managers BIA software from Strohl Systems Using BIA questionnaire software. Manually By teams reporting to divisional heads. Surveys, Research, Statistics Unknown Survey (template) to all department heads with a follow-up with IT and with the depar Questionnaire plus interview Scenario analysis - critical systems, people, effect on business - volumes, cashflow, fu At meetings By Deaprtments and locations

Other Financial services Insurance Financial services Energy Public sector Financial services Financial services Public sector Public sector Other Other Other Other Other Banking Energy Insurance Banking Select here Insurance Financial services Other Banking Financial services Health products & services Financial services Telecommunications Banking Manufacturing Telecommunications Banking Financial services Other Other Financial services Computer software & services Financial services Manufacturing Financial services Financial services

Non-board director Senior manager Senior manager Senior manager Middle manager Middle manager Select here Non-managerial Senior manager Middle manager Senior manager Board director Middle manager Non-managerial Non-board director Senior manager Middle manager Middle manager Middle manager Select here Junior manager Senior manager Junior manager Board director Non-board director Non-managerial Middle manager Non-managerial Junior manager Middle manager Senior manager Board director Senior manager Middle manager Senior manager Senior manager Middle manager Middle manager Senior manager Middle manager Junior manager

Formalised Questionnaire Through many sources: Formal survey and inventory of critical systems, facilities and services

divisional interviews Interviews with Managers + Workshops Agency Risk Register We conduct discovery meetings understand the dependencies and RTOs of the servic The BIA form is distributed to each Directorate. Copies are distributed within the Dire Desk study of background material - porcess flows, quality procedures, annual report Via a survey form and on-site risk assessment conducted by our internal risk manage Each business head is responsible for completing a standard template using Microsof Usually via questionnaire designed by myself, to identify critical functions and busines Structured Risk Assessment Model *Standard template in Business Recovery Plans By identifying business processes first and then by meeting business process owners survey document that is filled in by each business area. Through briefing and filling in BIA questionnaires Business areas' leaders complete online survey & regularly update quarterly. Through discussion and sign off Through a survey Criticality, financials, staffing, processes, alternate processes, risk assessments, etc Survey Interviews using standard format and fed into Excel spreadsheet

Questionnaire Meetings scheduled with the managers of critical functional units Using a pre-format At individual business unit level by department, using a document template, co-ordinated centrally by dedicated staff m Word documents completed, agreed by senior managers and sent to a central BCM te Tool enabled, face-to-face interviews, inferecne Business process analysis is undertaken, using simple diagramming tools, to validate Interview, paper and electronic Questionnaire Written Survey with followup interview. Annual update during business unit DR Plan r BIA questionnaire is distributed for completion prior to a review meeting. Completed q the Plan owner approaches the Business Unit to get their input, the Tech area is appr Individual meeting with business unit co-ordinators. Templates provided for them to co

Does your BIA cover every Does business your BIA division cover and every process? How business often do division you conduct andHow process? a BIA? is the More BIA information info Is the BIA processed information once used it has solely been bycollected? the business continu Yes Yes No Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes No No Yes Yes No Yes No Yes No Yes Yes Yes Yes Yes No Yes No Yes Yes Yes Yes No Yes Yes No Yes Yes Yes Yes Yes No Yes Yes No Yes Yes Yes Yes No Yes Yes No Yes Yes Yes No

1 time Spreadsheet for sorting No purposes then written report Min 3 yearly Centrally collated by Yes BCP Manager and transferred to BC Plan In process of doing this BC plan has complete annual Planner review develops (Updates as necesssary.) required annually by corporate Software policy program No Are doing our first one. Will Stillbe developing an annual that... process No at present, from here weon. will be rolling up into Access database which Headquarters only - cost considerations 1-2 years spreadsheet Yes First one recently completed, By hand, plan every used2 to years produce No report and tables. First one recently completed, By hand, plan every used2 to years produce No report and tables. Standards are Annual or upon Reviewed significant directly Change with Nothe (within business the Business areas, challenged or to existing and Solutions summarised e.g,by Work Operati Are Only one conducted to my Report knowledge. presented to Yes the Board and other key managers. once now, then every 2 years Manually through dicsussion Yes and consensus. is currently being done, last Entered time was in afor database Y2K. Yes Next andone results will/Should are endorsed be done byin business 2 years units senior managem Annually Trying to obtain a tool Yes otherwise in a home grown database Once with updates on a rolling Used basis as input - 3 into per year recovery No strategy, determining priorities for recovery, linking to b Wide and diverse businessOnce means in not the all lifetime are amenable of a business Form to /same paperwork process. process. filing No Disparity and limited in business circulation. maturity across lines and aquired subsid IT with a business focus only once By the BC manager Yes only and placed into a report for senior management. as regularly as possible analysed against theNo recovery plan This process was carried out about 2 years ago No but there was incufficient responses from the service areas NO ,as a fair answer , let's say Not that enough the most , mostly business a theData start critical is ofsomtimes large area's projects with put realtions No into (as spreadsheets part towards of the sales customers with cycles) ratings are ...but formules covered. afterwards , consolidations ..hard to judge by c 12-18 months, or when significant Currentlybusiness analysedprocess manually, No changes translated into a BCP plan. Critical processes / functions Annually only Collated and summarised No in a report. Every 12 months or whenever All information significantis change analysed Yes occurs by the within BCM the and organisation. formatted into a report that is available The original BIA looked at all annually divisions and all processes. Master However, copies of periodic all plans Yesupdates are maintained address the centrally. identified critical functions and asks i Have only just completed Responses our first oneare ever. retained No in an access database used for reporting and analysis. Bi-annual or when major strategic Analyzed shift by BC is announced officer Yes annually manually Yes annually manually Yes 1 time Spreadsheet for sorting No purposes then written report IT focus based on applicaiton Every risktwo driven years into the business. Various views of the No data, with executive summary reporting. This is the first Manual inspection, analysis Yes and presentation Only large revenue producing Based sectors on risk andanalysis legal the data ones It is used with to legal substantiate obligations No business are reviewed. process revision and to modify business continu BU has to document specific Attopics the project as financial, initiation regulatory, and Information whenpartners, major is changes summarised clients, Yes are revenue occurring and prsentation (ROI) to Sr management for approval This is the first Consolidated into management Yes summaries for board approval Annually Analyzed by continuity Yes planner and results reported to the business Identifies all services and/or About products one on peraquarter. per LOB or We departmental develop an basis. executive Yes Identifies summary all applications with detailed supporting analysis and the assessments services and/or to prod sho covers payroll and human resources. has been done Decided twice on in payroll the collated past because 5 manually years. of concern and Yes presented about paying to execuive employees management. if the data center was unusable. After each organisational Paper change interview which alters documents No the functionality/responsibility transferred to BC database of a department for storage. or BIA after data a reloca is pro Every 3 years or whenever It a is major analyzed changes based occurs Yes on our such in-house as a merger BIA methodology or realignment. key processes annually manual review No yearly Analyse, prioritization, Yes requirements identification On significant change within Line the manager business uses andit No annually to populate as a his check. BCP. BCPC decision to view all, with Min. less yearly, stress but continuous on non-critical MS-Access organisationnal processes database, and change department No customised make it to really to devellop generate ongoing. and recovery document handbook, scenarii.as well as requ See above. BIAs are reviewed, rather BIA than Reports conducted, are produced annually. No using Microsoft Word with input from Excel. every 2 years excel sheets, matrix,Yes ... Each division decides on its once own per five years Cumulated mannually Yes At the minimum annually, Once or whenever completed there it is isYes signed a material off by change the preparer, in the business then approved function by the the business Once every two years Final report with recommnedations No is written Still in the process of integrating Never all of the business N\A No once a year Analyzed, refined and Yes summarzed by Business Continuity Coordinator and then re 6 mths spreadsheet Yes Every change in administration, BIA Professional about every from 4 Yes -8Strohl years. Systems Every 2 years analysis work done then Yes presentation written IT division only once a year through report findings No Every change to any part We of the use environment. SunGard's PreCovery The Yes BIA is software. only completed for that change d business group. Annually, and a monthly short Automated checklist reports to highlight are Yes dispatched change in toprocesses, funtionnal dept staff,such or oder as critical IT, Logistic... information Non critical functions - mainly BIAnonbusiness is done Annually, functions but BIA reviewed do not collated carry half-yearly. forms out a the BIA No basis of deciding mission critical activities and helps in prio Once a year or if there are significant changesNo 6 monthly database No At least annually, but more Manually often after structural No changes Any function that is deemed Done critical in because conjunction of SOA with SOA (i.e. We are processes requirements developing considered (annually). workflows No material between to the Internal financial Audit statements) (SOA) andis BCP alsoto deemed facilitiate crit t

Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes No No No Yes Yes No Yes Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes No Yes No Yes Yes Yes Yes No No Yes No No Yes Yes Yes No Yes

Generally once but every time built a into system our process or application No to change or business all related process documentation is added and or changed, integrate ainformatio short BIA Annually or more often if major It is not changes processed, occur itNo is referenced. We are planning to conductWe an are all units using BIA BIA toProfessional establish No a baseline. 3.1 from Strohl This will Additionally, be refreshed this every information two to will three beyears. used by The project/process BIA process is te b Annual review, with amendment Information as required, is managed or No whenever by ownership a change of impact has been with made plans drawn to process up covering etc., the a Only those deemed critical Currently and moderate developing (basedoriginal on recovery Yesone. window and the type of impact - Financial, National Interest, Legal Obligat When new systems are launched LDRPS and once a year No New process, no history Up to local BC managers Yes Annually Entered into system No through BIA software. Reports ran and analzed then presente Annually Database No Annually Reports are prepared No using Microsoft Word and Word's Mailmerge to draw informa one time Yes As approved & required by Every Board-level 6 months, B/C programme plus asap Interpretation for sponsor ne systems/business of results No by functions interviewer (qualified B/C), followed by peer-group prese annually carefully Yes This would be to cumbersome, Annually, it is irrelevant or more at often thisiflevel It there is analyzed because are significant for any completness risk No changes. outside of world both risk anhilation types and would processes not affect existing all critical in the busine plan only pre-identified critical applications every 5 yrs spread sheet No Areas that impact revenue generating Whenever there activities, are significant or client It is services used changes as reference are to 6the business-critical Yes priority. to create We orwill areas modify look or recovery at processes. the others environments later when and time recovery permits. pro Currently doing the first subsidiary Only when and t6here then using are changes that The asDisaster a that template affect Recovery the to do CRITICAL Yes the Management otherfunctions subsidiaries Team of the does company a post analysis. Yes Those with a high IT reliance Only once so far Diagramatically Yes Annually Through an MS Access Yesdatabase Annually Excel No Every 2-3 years Manually Yes BIA has been completed for yearly my site database No Annually By utilizing our RevoNo system In some areas of the business Introducing BIA is still company in process wide, Documented reviewed annually and circulated No or in cases to senior of major managers business and change. directors Company wide Risk An annually Yes annually electronically through NoStrohl Systems BIA Tool once a year Manuel by consultent No

Yearly+ Manually and teh BCP Yes is updated accordingly. Every 2 years Cmpiled onto spreadsheet Yes and analysed & reported. Done once Collated by external Yes consultant Business Applications decided Once at the VP Level Information extracted Yes from the interview templates through reports. Once every 5 to 7 years: Furnished to senior management Yes for review and recommendation every five years, or when there questionnaires are significant are excel No changes spreadsheets to processes which or technology allow for "number crunching" Annually Impact ratings are used Yesto identify critical business functions for recovery Either on an anual basis or Measured when implementing against other No new units directions in the company or strategic for process. synergies and dependent operatio We are conducting one this We year try to after verify 10 and years. No reach We a plan level on of revisiting granularity at least through annually interviews from with heredepartmen on. Every three years. Analyzed for RTO, critical No resources, dependencies, etc. Follow up with all areas t Initially with revisions requested collated every to determine 3 months No critical business functions, input into recovery strategy, deter yearly reviewed by two-three Yes people and product information placed in prioritization matr This is the first, hoping to Survey update Software it ever other and year. No Manually. every three years computer Yes Once, in 2000. Even then Regionally, using a shell/boilerplate first. Next Yes it'smodel. packaged and sent to headquarters. Covers all divisions but is not Every process-driven 2-3 years Reviewed by central No BC team who suggest changes made to BC plans Initial (all encompassing) solution Basically will feeds be implemented into the No timescales towards forthe recovery end of (What 3rd quarter. size cake Following and how this, it review splits !! Tends to be HQ focused every two years manually Yes Once every 3 years, or sooner BIA workbook following forms a ' trigger' No the list event of requirements that are then used to develop the reco BIA is conducted for those min operations/ 12 monthly processes or morethat frequently This are is sufficently aif somewhat there material are No significant ambiguous to the relevant organisation question! changes The info in is either processed the external manually or most opposed likel Yearly, or as business purpose, On computer. structure Analysed or management No and forwarded changes to business unit for further discussions an 1st was this year Use Sthroll software Yes of analysis, results shared with management Annually Report to board of directors No Annual BIA software from Strohl No System Every area completes a BIA At unless least once it is clearly a year, non-critical. or whenever Again, software there has does been No this. significant change. Corporate office only Every 2 years Reviewed and compaired Yes to the business continuity plan. Annually Input into database, No then used by BI tools Bank-wide any and all impacts Annually assessed as one. Worst-Case Written Word document No summarizes, makes conclusions and recommendations. Unknown Unknown Unknown No Yearly Combined and broken Yes out by softwear needs, applications, document needs, etc. Infrequently. Manually, spreadsheets Yes used for graphical presentation. Scenario development occurs Presented probably to Systems 2-3 times No Security a year Group - forum of Senior Managers drawn across th Just the critical areas, IT, Security, Once a year Engineering, HR The manager puts itYes all together Bi-annually Assimilated by Disaster No REcovery Coordinator

Yes Every 6 Months team meetings, Disaster Recovery Yes tests, feedback etc. Interview with key managers Yes by BC Analyst Yes Annually No Yes No Yes Yes Yes Yes No Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes No Yes No Yes Yes No No Yes No Yes Yes Yes Yes Yes Yes Yes

Reviewed by Business Yes Continuity Team - Results classified - Confirmed by Board We conduct them on The a yearly data basis. is reviewed Or when for to a prcedure ensure all changes the appropriate (changepieces manage a 2 yearly with annualCompiled review to into identify standard if significant format change within BCP has made previous BIA Risk factors assessed No by senior management. BIA survey data tabulated and anal

Yes reviewed 6 monthly cross checked against Noprevious bia, agreed amendments with each division and sh Key business funtions Annually: Report and speadsheet Yesto Business Units and Management As often as the manager reviews Centrally performance monitored within No against the his Business business Continuity plan but Division at least quarterly After every administrationWe change. use excel Either and every BIA Yes 4 Professional or 8 years. to help in the analysis and create the grapical annually Since the same form No is used at all levels, the data is summarized by Diectorate a 6-monthly or on material change analysed from a spreadsheet No or Access database Critical functions only -- theAnnually. core activities that we must Reviewed performby to LC remain Ops Yes licensed Managerin and all 50 collated states to and riskto areas. meet the Then needs examined of our against policyho BIA are completed formally The oninformation an annual cycle. is collated No Having by the said Business that where Continuity there is Management major changes Function in the organi and f In every company with which Cerified I work against any No known lists of business-critical activities and rstatutory / regula Annually & whenever significant Prioritised changes for consideration occur No by senior management/board using defined criteria Once every two years in theory. It is used to develop No an improvement roadmap and business continuity plans. Only the critical areas are covered. Every other Determine year or a by major processes We change use Strohls that in the must BIA business. be Professional Yes maintained in the event of an incident. Do it once Analyze across functional No areas, acess RTOs and MORs, develop recovery strate

Quarterly Cross-referenced against Yes busihness critical processes and company goals as set b As per the security policy which is once in year. No every 18 mos Reviewed by BCP team No for content and realism Yes Annually or more if necessary Manually and automaticly No Many surveys pending At deployment of new applications. entered into a spreadsheet No Annually, or when new projects Into standard initiate spreadsheet, Yes then transferred into BCP plans No Bi annual Cross analysis No At least once evry 3 years,Using but there predetermined are someYes specific scoringbusiness analysis there activities are that a number could of trigger set factors one sooner, used to such de Essential Functions only *those 12 monthly with a highimpact to BAU Report & Presentation Yes to Senior Management currently business critical only annually processed manaully,No presented in document format Annually but updated for changes Entered into on aspreadsheets quartely No basis and analysed - used by IT to prepare DR testing and co Only Mission Critical functionality Not often enough Tool enabled and manually Yes To be decided as part of the Looking change at tools management to hold Yesthe controls. informationand support the change management. full annually. project impact excel on a / access demand basis No so far only once, when weBCP started... coordinator a year analyses ago Yes and tabulates Annual update to original MS report. Accexss, Revised MS as Excell, necessary No MS Word in Life Cycle development process. depends on criticality of function. Used to ensure Tier 1 and business 2No - every continuity 12 -18 months. recovery strategy Tier 3 and for4that - every function 2 years. is appropriat 2x a year it is placed into a spreadsheet Yes Update every three months. Spreadsheets updated. Yes

Is the BIA information used What solely are by thethe main business difficulties Are continuity you that planning you team? experience to More make info when Are anyyou changes conducting planning to your to BIAs? make BIA procedure any changes in the to your future? BIA procedure in the future? M

IT uses application/system information recovery times accuracy, to determine especially Yes backup financial strategy data and recovery include times BIA questionnaire in change management/implementation process to keep User participation No Timely return of information; Yes making certain everyone Questionnaires understands questions. will be completed in presence of planner to assure everyone REAL used by variety of other departments Time commitment requiredNo from participants. Our Internal Audit people use Obtaining it whenpeople's look at Risk timeManagement and Yes walking the line between Not too high-level sure yet - experience and too granular will drive a focus this. I suspect future BIA iterations will include questionnaires not returned Yes or returned with unusable Automation information.- software Report issued for risk management Getting the and information general guidance from Noa lardge to management. no. of functions. Report issued for risk management Getting the and information general guidance from Noa lardge to management. no. of functions. Good summary source of information Each Business which Area strengthens is unique Yes Business and formContinuity is generic Plans enough Ever (re. to evolving Critical capture process Functions, specific as impacts Recovery the business and Phases Critical areas and Functions areFTE learning, etc) and and so requirements are used we, for we QA for are and that conti Op b Unrealistic timeframe for recovery Yes of systems. Failure to have back up systems in place. None so far. No Difficult to decide what lvelYes & type of information is required. Streamline Timeas consuming. possible Not always well perceived by buisness units In the course of the analysis No you tend to uncover glaring operational deficiencies which people try to hide then they become resistant to Information also used by ITLack to link of business business recovery impact information requirements Yes relating for systems, to impact links Possibly by cost. and data Lack always to ofdisaster appreciaition revising recovery and of implementing incident strategy, requirements processes good practice and vs normal procedures as appropriate operating torequir busin It is used to determine disaster Availability recovery of people objectives with for correct Yes technical credentials infrastructure and time including Global to allocate. acceptance but not limited and tocompliance. IT. separating IT and business Yes processes. Interviews and surveys. Encompass more business functions into overall plans also by any other relevant parties time and - ie resources operational risk No By each of the service areas 2 years who have ago problems taken partwere in the Yes found workshops with a poor etc. response If any of the areas BIA of questionnaire's improvement and can a be lack identified of understanding from this current about process what it wanted. once it has Now No , normaly this data is used It is by very management difficult to get , security exact Yes impact , auditdata certainly financial-figures Yes , workgroups ...impact to (re-)evaluate is very much the depending curretn practise on the industry will look ,at the it. moment The BIA of is mo occ The business will use the results Consistency and well of information, as IT Yes different levels of activity, Will number be looking of BIA's at to gathering analyse information electronically IS use for prioritising critical Obtaining systems.time/ Faciltiies resource use for from No understanding business areas work to space complete needs the for survey. recovery The knowledge level of team Yes members and leaders inIrelation will be conducting to the full impacts awareness to their sessions reputations prior to and requesting customers the should impact a information denial of th poor quality information provided Yes by some departments Greater and poor participation quality of by information internal audit on cross-departmental and senior management. processes. It has been used to help other Defining projects the learn functions about and other Yes processes areas ofwith the respondents business. Questions who are used will be torevised, thinkingadded, about tasks dropped. and We activities. will also vary the frequency in whic Territorial managers No Getting it completed in a timely Yes manner. Looking for more automated methods and benchmarks Getting it completed in a timely Yes manner. Looking for more automated methods and benchmarks IT uses application/system information recovery times accuracy, to determine especially Yes backup financial strategy data and recovery include times BIA questionnaire in change management/implementation process to keep End of life for legacy systems, timeidentifiy and money critical applicaitons Yes requiring additional logical Acquire security an automated restraints, system re-archiecture. into a database verses manual colleciton Getting contributors to commit No time; difficulty in quantifying financial consequences of disruption with any precision To substantiate current risk Lack mitigation of duedecisions diligence on the Yes part of the less sr.management I will stay or sometimes away as much the as reverse I can (i.e. fromVP requesting finally get BIA their info. BIA via done filling but forms can'tpreferr get bo Obtain acurate informationYes Simplify the questions Consistency of response across No multiple business functions Business is not willing to take the take to complete the information for the survey Interviewing the right people No with the right information in a timely manner. getting support from executive No management to intiate the BIA. It is also used by the IT department First timeto round, establish general what ignorance Yes arrangements of BC. are Reluctance needed for We due data have tostorage/backup lack historically of time available covered and disaster (i.e. buildings, their recovery boss systems does strategy and not hand people e.g. which out but BCP systems because KPIs), are of lack our mirr o i Having the resources to work No with available. for process improvement availability of key managers No Lack of enthousiasm of interviewed No persons See 8. Line manager engagementYes and understanding. Piloting the process over the next few months - this should lead to modifications in A card of credit card size) with Nobody's phone (Mngmt) numbers willing of key to Yes people validate/define is distributed options, to all ponderation. Directors More andand more Audit key formal are BCP not regular staff, prepared/formed more reporting, handy through than to estimate thescorcard, internal the adequatness phone and check book, list. they of BC are Plan us Responsibility for creating and Time managing - There's Business never enough. Continuity No Prioritisation Plans is placed - everbody on specific weightsdepartmental there responses managers to convey withapparant consultancy criticality support of their from own the Risk areas & and BCP fun Te resources availability, No Getting senior management Yes attention Awareness and convincing Can be time consuming. Can No be challenging if assigned to someone without good high level operational experience. Booking the actual meetings No(matching interviewee-interviewer don't know schedules) , first timeConvincing it is done. interviewees of the confidentiality of the gathered Not used If such an activity would exist, No I think that acceptance by Management would be the toughest objective to overcome. User involvement; ambiguous Yesand sometime erroneous process information; of collecting outdated information policies and under procedures review. Other key resources will be influen getting answers No Delay in varifying accuracyNo of the information. We just recently changed our process. lack of time and resources No due to BAU It is used for head of divisions lackand of cooperating senior managements and understanding No perusal. Getting business people toNo complete the surveys in a reasonable time period. Answer like : - its someone else responsibilities... Scenario-based BIA data is Consistency also used for in approach building up and No alternate ability to business see larger plans picture Butgets we are missed constantly out due engaging to the vast to find sizea of robust the target methodology group All so used by our BS7799 None team No Make it webbased process interdependencieswas used difficult by many to get management team leaders Yes support to take areas. a firm ITwide dependencies view ongoing of risk extensively improvements and priorities, used to hence by make ITour management. the move gathered to andata entity more leveldynamic product & process priorit Used as part of the annual Change Enterprise of management Information Risk and Yes Assessment BC champions, which change is presented management Restructure to theof board generally the mechanism with possible survey approach using a web site and There are numerous initiatives Time that -- or take lack place thereof. within Business the Yes organization units are that extremely rely onbusy Although an understanding and unwilling I cannot foretell to of take what what time is most the out critical changes for anything to might thethat organization. be, smacks I can almost of We BCP. often guarantee This get iscalls why thats f

the information is used to help Timemanagement and resurcesunderstand for a thorough No where job. and what the system or application fits into our business (priorities, and importance). Audit, technology and reporting Finding the time, keeping the Yes process updated and relevent Intranet collected Resource constraints are the Nobiggest hard spot I have hit yet. We have worked hard to bring the senior management group along, but they are still concerned with It is open for all to see. This Mind ensures set and functions culture. which Fire fighting service Yes is the perceived whole business as exciting, As gain the being visibility process pro of active matures impacts is perceived the which BIA although will as be boring. amended picked up to by suit one the area needs may of have the business a greate Learning curve of BCP coordinator, Yes and getting feedback To address from Business ALL functions/services Unit reps. cooperation from others outside No of the Business Continuity team Time allocation, lack of experienced Yes personnel. As this is new to us it will inevitably be updated and changed. Disaster Recovery Team Scheduling the meeting. No everyone is so busy and this is usually met with great resistance. All deparments review and Defining use the data Criticality for their own Yes needs Automate the process The information is used to feed Getting into across the Business the importance Continuity No of calculating Strategy formulation RTOs based andon to impact providedata justification as opposed for recommended to selecting RTOs continuity based solutions. on instinct. The Gathering Board use to Consistency of the users understanding No and presenting their business proceses Where critical systems identified/confirmed, Need to ensure responses formal review No are realistic with Risk in Management terms of LOSS It's initiated. taken of contribution awhile, but to organisation, we think we've rather now than got the simply business valuegroups of steady-state to understand operatio th No Information Security is nowIdentifying looking at anyone the bia, with finance a knowledge Yes is using itof in actual some instances, impactsImprove and asbeing is sr. BIA able management templates, to measure increase ot make them BIA to decisions atemplate reasonable on options, new degree projects/opportunities. improve of accuarcy use instructions, and relevan m drp team also size of questionnaire No Getting timely response from Nopeople who are already very busy with daily production activities and new projects. 1. Managers not completing Yes the documents on time, 2. 1.Some Reformating managers the find form it 2. difficult Additional to differentiate questions between to be added CRITICAL & NON-CRITI No Fixing appointments No Encouraging managers to complete No the questionnaire. Managers interpreting the questions differently. Managers over/under estimatin It's used for move planningIdentifying (major move all of is the in progress), departments Nobackup strategy, succession planning for key staff People withou time to fulfillYes a questionarie or get time for Notan sure interview, yet, although People we without are seeking Business new process paths and knowledge, ways to get Board staff ofand Directors manag a Business process information Scheduling is used to orient new employees Yes to how the business Improve fits together. the ability to quantify RTO and add ability to measure cost impact using d The Office of Protective Services Impacting also the uses business the info, to Yes enhance Life Safety programs It is in a constant state of incremental improvement, based on industry best practic Used for System continuityGetting planning the also. involvement and No commitment of key areas of the business and identifying the key areas. Getting buy in by senior managem delay in answer: No To prioritize business processes mindset, and standardization the associatedNo IT By the hwole oragnisation To get the information about Yes - what is comming up in the A better future interview with the senior management

People do not understand the No questions. The questions don't suit all departments - they need to be tailored for some groups. 1. Ensuring coverage of allYes processes/procedures. 2. Convincing Changing from senior procedure/process management as basis to theto usefulness business outputs of the process basis Management committmentNo to the process - lack of priority makes it difficult to get committed time in a busy environment. Lack of formali Business RepresentativesYes Participation Automate to a planning tool Cooperation of the parties No being queried. shared with other groups in ItIT can forbe planning difficultpurposes getting the No etc. data back in a timely manner. Also, in some cases it can be difficult getting a group to work at the correct le Perception of which functions Yesare critical to recovery of Process the business under review as a Six sigma project. By Risk manager to evaluate Lack insurance of will torequirments, perform the task. by Yes the Lack board of to industry determine rquirements. ifDepends the organization Lack on the of responsibility regulatory is prudently environment. managing (liability). risk The and question exposure. is irrelevant if the plan doc Equipment on which critical the applications link between runapplications need to Yes be accounted and on which for in hardware the DR they plan. We plan run, on applications keeping itor mainly processes in house deemed without critical use of early consultants, on magically andbecome to maintain les Used by IT to establish response Staff availability procedures/times/SLA's. for interviews No and Busienss follow up. areas Management use to evaluate very, impact very slow of changes to make decisions. in their business processes and to negotiate service USed also by IT to review and Difficult confirm to quantify they can costs restore if Yes business the system lost and required Unsure data in at the present timeframe but always required looking by the to business improve. May gather from BCI Forum much of the information isYes subjective moving toward greater reliance on information in product database rather than on It will be used by Senior management to justify budget No and spending for updating DR Plans. Apathy, obstruction, fear No Follow-up and follow through. Yes Press for an annual internal regional review and rehearsals. Used bu business areas toGetting update business BC plans resource No involved! It is proving to be of great use Lack inof focusing true business business understanding units No on what as they to what actually theydo doand andas why such they feeding do it. Following into development September requirements the 11th, there on areas is also such a misconception as managem costing impacts Yes reduce subjectivity increase precision Support functions use the information Documenting to develop financial the impacts. recovery No Obtaining solution. technical details. It is also used by/ in partnership The 2with key the difficulties relevant are technology 1) Yes Time 2) teams Constaints, i.e. IT and Organisational Telephony Process to to change be ensure aligned and that with changes thenew relevant in corporate the technology external standards environment recovery and the solutions overallsupport process and to be ar As explained above Expertise in business units Yes in understanding the BIA and Going its impact over to the BCI's new Best Practices, implementing it enterprise-wide, awa Sr Mgt time, lack of preceived Yesneed by those lower in the Willorganization conduct it at lower levels withing the organization By auditors and Board for corporate no real difficulty governance No Business planning Key people completing the No survey It can end up being used inThe things software like SLA we negotiations. use is tooYes standard / general. It misses Wea are lot hoping of the nuiances we will be ofallowed variousto. areas. Something like an interview process would b Getting the proper people to No commit the time for the interview. Departmental heads given Response access. times, Weightings Noto different levels of management's answers. Risk Management team also. Corporate wide cooperation Yes and timely feedback Allow it to cover business units individually Unknown I have not seen a BIA conducted Yes yet. Unknown Getting back all the documentation No from the departments. Including all key people in the analysis. obtaining requests that are reasonab Heavy on resources & time Yes consuming Need to run more frequently. *Possibly review automation/tools. *Would like to de Can be referred to as part of Quantifying normal business impacts: risk management No cosiderations. Employees do not think it is No important for the company Also by Network Infrastructure Time Team, Frame Operations in receiving Team information No and Data from Operations Departments Team

Ensuring Business Managers No review without predjudice to previous results No Disaster Recovery Team, each Buy in individual from all area's. business It is unit an No to after help thought develop forthere mostplanning area's and or procedures most people etc. do not understand the importance No Available to managers to support Collecting business cost data divisions No BCP Executive Committee There disperses are no BIA significant to line and "difficulties" staff No amnagers in thethroughout process. The the company usual challenges for assessment of collaboration of withinon their such sphere a large of responsibility scale exist, ofand course. against BIAthe is

No getting people to set aside Yes time INSTRUCTING DIVISIONS TO INCLUDE BIA IN 6 MONTHLY REVIEWS ON WO Everything, but mainly collecting Yes data, analysing data,BIA financial review impacts, in November keeping 2003 up with changes High impact risks are referred Assessments to Board level need toto ensure be continuaaly Yes controls and challenged contingency as they action More can sophisticated is be deemed more subjective satisfactory use of software than objective to guide and analyse the data Getting the necessary funding No for the recovery strategies. We have just modified to this methodology because we were having trouble gettin It is used by the Information My Technology priorities to Group capture to determine the No data and hardware/software/application information are not always an systems operational backup/recovery/support manager's priorities as to complete well as tothe determine forms. recovery pri Business and departmental Availability strategy, ICTarchitecture for interview; pressure Yes and infrastructure to short-cut planning or skip BIA Increasingly and investment BIA case is being viewed as part of the strategic business process - see a Lack of management involvement No in the process. See above. The BIA are the Apathy critical - reluctance starting documents to takeYes responsibilitywhich drive the dont recovery see it as Not strategy part specifically of in their terms role. about of Considerable work the area, BIA but speed there support of have recovery, required been IT changes from requirements Business in the ContinuityMana organisational and priorities. s Also by change mangement, Lack HRof for real succession knowledge planning of what Yes as are critical the biz-crit staff posts systems, are develop also processes identified moreand sophisticated, staff; lack of multi-level time to make questionnaire a thorough toinventory; make data other collection buisiness quic To manage all operational Lack risks of knowledge in relation Response to system to Basel dpendencies committee in relation to capital adequacy It is used every time one needs Inconsistencies to know the in criticality the way Yes of criticality a givenis business expressed process. by stakeholders Will be amended and business to meet the process requirements owners. Management of people thatdoes use its not results. understand that Determing and collecting the Yes financial data that is thelast base BIA forwas the for cost the of complete outage. corporate entity, the next will be for the local enterpr Could be used for other risk Participation mgmt programs from the management/department No heads might be lacking, they send representatives to the meeting see above

Getting all owners of plansYes to complete and update New system/process being introduced soon on international level. Its used by all members of At the times entity. participants are not Yes serious. IT uses the information to evaluate Management what commitment and how they No in are individual backingareas up of critical information Yes We are planning to make this a mandatory requirement for annual business-plans Audit, Technology, business Time unit Yes Revamp to make easier for business unit to supply, probably web based General reference S L O W turnaround of surverys No or non-compliance BCP is normally always the Yes last thisng to consider - when Easier projects to use realise they may have excluded it, they need to reassess their budget Yes Time of participants Yes Lack of any one individual Yes having a full understandingNothing of the day-to-day definative, operations but we want of a tospecific modify the functional analysis unit process. and it's components. BCM is a long way down on Nopepoles agenda used by each department to lack maintain of buy-in contact from lists departments and No to aid succession planning as above Too paper intensive Yes make the templates easier to underastand and put it on a web page for ease of us Communicating purpose and Yes gaining "buy-in" and understanding Increase frequency of data refreshes Validating the responses. Yes Always looking for better methods. plan maintenance staff availability, sufficient business Yes knowledge, interview more scope process creep dependency as stakeholders emphasis extend input Subjective perceptions of importance Yes of business functions. Work on more disaster scenarios, rather than a total unavailability of building. Feeds into requirements documents Doing the for survey, all system normalizing development Yesthe data Integrate into follow-on Application Impact Analysis See above. Also used for systems Using the recovery same questionnaire strategies. No for all functions. You want consistency, but not all questions apply. Utilization of a sample, and a templa explaining why the information Yes is needed & what will be we done are expanding with it. it Business Continuity Planning No has low priority within the business.

ng to make any changes to your BIA procedure in the future? More info

stionnaire in change management/implementation process to keep it current. Review/update annually or bi-annually

will be completed in presence of planner to assure everyone REALLY understands the requirement.

xperience will drive this. I suspect future BIA iterations will include prior results for reference purposes.

ocess as the business areas are learning, so are we, we are continually updating the Form and Process to ensure that it is as user friendly as possible for all concerned.

s revising and implementing good practice as appropriate to business.

surveys. Encompass more business functions into overall plans

mprovement can be identified from this current process once it has been completed than the programme/procedure will be up-dated and improved. s to (re-)evaluate the curretn practise will look at it. The BIA is more and more becoming a Risk Management practise ...Regulations like Basel II in the financial Industry will be drivers in this at gathering information electronically

ing awareness sessions prior to requesting the impact information. We have had a signifcant change in our management structure and all new managers will have to be briefed on the who, w ation by internal audit and senior management. e revised, added, dropped. We will also vary the frequency in which we administer the questionnaire to low priority business groups.

e automated methods and benchmarks e automated methods and benchmarks stionnaire in change management/implementation process to keep it current. Review/update annually or bi-annually mated system into a database verses manual colleciton

as much as I can from requesting BIA info. via filling forms preferring multiple one on one interviews. Need to find a way to present the data in a ROI format and in risk management terminolo

rically covered buildings, systems and people but because of our increasing dependency on external suppliers we have added, in the last 6 months, critical suppliers.

ess over the next few months - this should lead to modifications in detail but is unlikely to change the concept. formal regular reporting, through scorcard, and check list.

cting information under review. Other key resources will be influencial in providing information.

stantly engaging to find a robust methodology

ements to make the gathered data more dynamic he mechanism with possible survey approach using a web site and browser based tools. ot foretell what the changes might be, I can almost guarantee that changes will be required. That's the nature of business today!

matures the BIA will be amended to suit the needs of the business. Depending on feedback it may be lengthend or reduced, or terminology amended to ensure consistent use.

o us it will inevitably be updated and changed.

, but we think we've now got the business groups to understand the value of independent BIA.

mplates, increase BIA template options, improve use instructions, move to a more consistant methodology across the business (note - this decision is political and not beneficial to accurate B

the form 2. Additional questions to be added

hough we are seeking new paths and ways to get staff and managers involved in the whole process. ity to quantify RTO and add ability to measure cost impact using different methods. nt state of incremental improvement, based on industry best practices

ew with the senior management

procedure/process basis to business outputs basis

eview as a Six sigma project. regulatory environment. The question is irrelevant if the plan documentation does not include the ability to change. eping it mainly in house without use of consultants, and to maintain it.

nt but always looking to improve. May gather from BCI Forum greater reliance on information in product database rather than on interviews and questionnaires. However, this will take time as not all the information for all products is in the database.

nnual internal regional review and rehearsals.

igned with new corporate standards and the overall process to be siimplified and made more user friendtly he BCI's new Best Practices, implementing it enterprise-wide, awareness and education, re-engineering the whole BC policy, model, roles & responsibilities, process and procedures t lower levels withing the organization

we will be allowed to. Something like an interview process would be much better than the way it is handled now.

r business units individually

re frequently. *Possibly review automation/tools. *Would like to demonstrate risk better in terms of more accurate cost/analysis. *Improvements required to identify interfaces better.

DIVISIONS TO INCLUDE BIA IN 6 MONTHLY REVIEWS ON WORK SCHEDULESWITH ACTIONS COMPLETED AND SCHEDULE OF ACTIONS TO BE TAKEN

ted use of software to guide and analyse the data odified to this methodology because we were having trouble getting members to participate in providing information as well as final approval on findings. Funding will always be an issue in a

A is being viewed as part of the strategic business process - see answer to 9.

about the BIA but there have been changes in the organisational structure with more responsibility placed upon the businesses and Group Operations and the BCMF taking a lesser role. ophisticated, multi-level questionnaire to make data collection quicker and easier . PS AS I am a consultant in BC and DR I have answered for the procedures that I put into companies with w

d to meet the requirements of people that use its results. the complete corporate entity, the next will be for the local enterprise only.

cess being introduced soon on international level.

g to make this a mandatory requirement for annual business-plans. ke easier for business unit to supply, probably web based

tive, but we want to modify the analysis process.

ates easier to underastand and put it on a web page for ease of use.

isaster scenarios, rather than a total unavailability of building. low-on Application Impact Analysis

ser friendly as possible for all concerned.

tions like Basel II in the financial Industry will be drivers in this process

ure and all new managers will have to be briefed on the who, what and why.

ent the data in a ROI format and in risk management terminology.

n the last 6 months, critical suppliers.

erminology amended to ensure consistent use.

note - this decision is political and not beneficial to accurate BIA's)

not all the information for all products is in the database.

odel, roles & responsibilities, process and procedures

*Improvements required to identify interfaces better.

DULE OF ACTIONS TO BE TAKEN

nal approval on findings. Funding will always be an issue in a tough economy and a government entity.

and Group Operations and the BCMF taking a lesser role. e answered for the procedures that I put into companies with whom I work. The main change for BIAs is going to be the drivers from regulatory, statutory, and contractual sources to ensure t

from regulatory, statutory, and contractual sources to ensure that the due process of BCM is carried oout.