So this is what passes for thought leadership in business continuity management (BCM) these days.

The Business Continuity Institute (BCI), a U.K. professional association with global ambitions and under-exploited footholds in the growth markets of Asia, Middle East and South America, goes looking for a partner in North America. After thoughtful deliberation about the future of BCM in the 21^st century, and with all the time in the world to make a choice, they select…the Disaster Recovery Journal (DRJ), a 24-year old, American, family-owned magazine publisher and conference producer that must be the only BCM business in the world still calling it “disaster recovery,” the most-resented term in BCM profession.

BCI’s announcement says the alliance “aims to align thought leadership between [the] two organizations,” while DRJ’s press release says the alliance will “broaden and deepen discussions in…business continuity and related professions.”

That “thought leadership” bit caught my eye. When I first skimmed the headline, I mistakenly thought the BCI and the American professional association formerly-known-as the Disaster Recovery Institute International – DRII – had finally decided to stop pissing on each other’s shoes. Now, that would be news.  Read more... (2676 words, 2 images, estimated 10:42 mins reading time)

Exercise Raffles III, Singapore’s 2011 financial sector “industry-wide exercise” (IWE), will be an afternoon tabletop on Thursday, 15 September, followed by a “validation” desktop exercise to try out an “industry-wide emergency response model” on Friday, 16 September, and a wrap-up and group hug (“post-exercise review”) on Friday, 30 September. The Association of Banks in Singapore (ABS) has contracted PricewaterhouseCoopers (PwC) to manage the exercise. The next ABS briefings on the IWE are Monday, 22 August (only for the participants’ exercise facilitators) and Tuesday, August 23 for everyone else (the last one before the Big Show).

There will be a test for participants of online connectivity to the exercise portal – through which exercise developments will be delivered – on Wednesday, 24 August.

Click on his name if you’re wondering, ‘Who was Tommy Raffles and why does Singapore name hotels, shopping centers, boulevards, public plazas and disaster exercises after him?’

The scenario will be “multiple events unfolding concurrently, including physical attacks with the possibility of a cyber-element.” Earthquake would be a good scenario, wouldn’t it? It’s certainly topical in Asia at the moment, and Singapore has an outsized ‘it-can’t-happen-here’ attitude, always a sure sign that it eventually will. Past IWE scenarios have been multiple IED’s in the Marina District (after the 2005 London bombings), and pandemic influenza in 2008.  Read more... (383 words, 1 image, estimated 1:32 mins reading time)

What does it really mean for an individual to be “certified” in business continuity?

Like the euphemism “sub-prime”, the word “certified” is losing its meaning in Asia as the number and variety of BCM certifications and their purveyors grow like vines in the jungle. Attend a course, get the certificate and poof! You’re certified!

In Asia, for example, you can become certified by the BCM Institute as a Business Continuity Certified Professional (BCCP) with no prior BCM experience if you fork out US 840, spend one day in a class and another half day answering fifty questions on a test. You do not have to answer all of them correctly. That’s a fast-track bargain by any standard. The BCMI offers plenty more certifications, too.

Or you can become certified by The International Consortium for Organizational Resilience (ICOR) in Asia as a Certified Crisis Team Leader in three days for US 2,200. Or you can become a Certified Media Spokesperson for 800 bucks – in just nine hours (no examination required). I say, bring on the Exxon Valdez disaster: your spokesman is ready.

Long on ambition but short of time? You can be certified as both a Crisis Management AND Communications Professional (CMCP) in as few as four days. It costs US$3,700, but, hey, you only have to get a ‘C’ grade (75 percent) on the exam. You must also list two years of experience, but doing what?  Read more... (2623 words, 0 images, estimated 10:30 mins reading time)

It’s hard not to notice the earthquake risk around the Pacific Rim these days. Maybe the risk is actually higher, or maybe I just notice it more, but in the last four months, Asia has had three earthquakes of 6.0 or higher on the Richter scale, the magnitude at which earthquakes are generally considered destructive.

The Wenchuan earthquake in China’s Sichuan province in May drew worldwide attention to the enormous impact of a big earthquake, even in areas with low population density: 70,000 people killed, 18,000 missing, 375,000 injured, and 5 million people homeless. And that was only the second-deadliest earthquake in Chinese history: the Tangshan earthquake was worse (250,000 people killed, 150,000 injured) and that took place just 30 years ago in 1976.

China is in the largest orogenic zone on the planet (that’s how the Himalayas got there), but Wenchuan had “never been considered high-risk compared to cities near other fault lines”, according to Hong Kong-based seismologist Dr. Michael Spranger. And now, after the Wenchuan earthquake, the earthquake risk in China is even higher because of tectonic shifting.

The Indian Ocean earthquake near Sumatra that caused the 2004 tsunami was also in an “unexpected location”, Dr. Spranger said. In fact, Munich Reinsurance reports that Sumatra accounted for nearly a quarter of all earthquakes measuring 6.9 or greater in the world since the 2004 tsunami; Sumatra had accounted for only 2 percent of them in the previous 30 years.  Read more... (1584 words, 0 images, estimated 6:20 mins reading time)

Singapore Exchange Ltd (SGX) has issued proposed business rules on business continuity for public comment. The rules are likely to take effect for member firms in 3Q 2008, and firms would have twelve (12) months to comply. Member firms were briefed on the new rules in April.

SGX operates and regulates integrated securities and derivatives exchanges. Like many Asian exchanges, SGX is a publicly-traded (demutualized) entity; the shareholders, not the member firms, own it. These are SGX’ derivatives market members (32 trading or clearing firms) and these are the securities market members (27 firms).

If the guidelines are adopted, member firms would be required to:

1. assess their risks, complete a business impact analysis (BIA), and have “appropriate BCM measures to mitigate the risks”

2. make a senior officer responsible for BCM

3. review and test their plans regularly, and participate in financial sector exercises

4. designate and submit emergency contacts

These are not onerous requirements, and many of the member firms already have BCM programs in place. But it’s taken some time and effort to promulgate appropriate guidelines because SGX is both a market operator and a regulator. That means it must consider, in its rule-making, its commercial interests (and those of its members) alongside its fiduciary responsibilities (and those of its members).  Read more... (331 words, 0 images, estimated 1:19 mins reading time)

There is no more important long-term challenge in protecting businesses, homes and lives than bridging the knowledge gaps between what I call the “resilience professions”: business continuity, disaster response, disaster recovery, emergency management, crisis management, risk management and security. Asia is about to host the first conference I’ve seen to take on that challenge explicitly.

The 2008 International Disaster Management Conference on Public Private Partnership will bring together for the first time in Asia both public- and private-sector professionals in disaster, emergency and business continuity management as both presenters and attendees. The conference is on April 16 & 17 in Delhi, India and is endorsed by India’s National Disaster Management Authority.

In one conference you’ll be able to hear and meet senior executives from, for example, the Red Cross/Red Crescent Society, the British Standards Institute, India’s Oil Industry Safety Directorate, the Micro-Insurance Academy, the Federation of Indian Chambers of Commerce & Industry, the US Agency for International Development International Resources Group – and the Mumbai airport. There are about twenty (20) presentations, plus India’s normal introduction and thank-you rituals.

The conference is organized by volunteers at Responsenet, an initiative of the Aidmatrix Foundation, a non-governmental organization (NGO) supported by high-tech companies. Some financial support for the conference has been given by the International Association of Emergency Managers (IAEM), GeoHazards International, Tata Indicom and Sphere India. Last year’s conference organized by Responsenet on supply chain for disasters drew 120 people.  Read more... (676 words, 0 images, estimated 2:42 mins reading time)

Bank Negara Malaysia (BNM) has new BCM guidelines that became effective in January.Banks in Malaysia have until 30 June 2008 to comply with the guidelines.

Download the guidelines here (Adobe® Acrobat® PDF file, 42 pages). The document number is BNM/RH/GL 013-3, but I cannot find it on the BNM web site.

There are 17 principles in 5 categories that banks must follow: BCM framework (4 principles) and methodology (10 principles), communication with internal and external constituencies, internal audit review of a bank’s plan and responsibility for outsourced functions. There is also a glossary of terms and several appendices.

In that glossary, BNM introduces yet another abbreviation – Maximum Tolerable Downtime (MTD) – that means the same thing as the Business Continuity Institute’s obscure Maximum Tolerable Period of Disruption (MTPD). Neither term should be confused with the commonly-used “Recovery Time Objective” (RTO), which is shorter than MTD, as shown in this BNM diagram.

Do you see the “DRP” and “System Recovered” in that diagram? Even in 2008, after a decade of lexicographic struggle between I.T. and business professionals, BCM principles are still illustrated by examples of system recovery instead of business processes recovery. Will BCP ever breathe free of its technical past?  Read more... (425 words, 1 image, estimated 1:42 mins reading time)

I receive email warnings from the U.S. National Oceanographic & Atmospheric Administration (NOAA) Pacific Tsunami Warning Center about earthquakes that might cause tsunami events in the Pacific Rim. The service is fast, free and helpful to emergency response authorities.

Just since late July I’ve received alerts for several earthquakes: two in the South Pacific, two in the Aleutian Islands (Alaska), the big one off the coast of Peru. The PTWC warnings are text-based so they can be received on the lowest common technology denominator, I suppose. The alerts contain no HTML links to the PTWC web site where you could see maps showing the locations of earthquakes.

So I can find it hard to place an event’s latitude and longitude in my mind – “2.7 NORTH 127.5 EAST”, for example. Most people can picture “the coast of Peru,” but I must admit I’m a bit hazy about “North Moluccan Sea.”

Where is that, anyway?

You can find out quickly and simply, and in stunning detail, in Google Earth. Download and install Google Earth (15 megabytes) onto your computer. It’s free. And sign up to receive the PTWC alerts by email. They’re free. too. Then wait for an alert message to show up in your mailbox.

Inside each alert you’ll find data for these parameters:  Read more... (479 words, 0 images, estimated 1:55 mins reading time)

Thailand’s Foreign Bankers’ Association offers this English version of the Bank of Thailand (BoT) July 2006 Circular 896-2549 proposing guidelines for BCM. The guidelines will apply to all commercial banks, which will have one year to comply. That will probably put the compliance target date in 4Q 2007. To track BoT bulletins on all subjects, bookmark this link.

The Reserve Bank of India (RBI) released in August new guidance for financial institutions. The RBI directive suggests how India’s 50,000 bank branches may help customers and communities after “natural calamities.” The guidelines also supplement RBI’s BCP instructions issued in April 2005. FFI: Read Nat Forbes’ BCP Confidential blog post about RBI’s guidelines.