Most industrial parks don’t include SCUBA divers in their recovery plans. But car companies and a shoe maker in Thailand – but nowhere near the ocean – had to hire divers to retrieve hard-to-replace moulds from submerged factories in November. “No one thought about such a worst-case scenario”, said one company president. “In future we will need to reconsider the flood risk.”

They sure will. Three (3) major rivers – the Chao Phraya, Lopburi and Pa Sak – converge around the industrial estates in Ayutthaya. But companies obviously decided that tax incentives and the proximity of suppliers outweighed the risks of catastrophic flooding. Or maybe they just skipped a risk assessment entirely.

Supply chain resilience strategy: don’t build a shoe-, car- or disk drive factory in a floodplain. Some companies may even avoid Thailand. Impact: if one Japanese multinational were to choose, say, Vietnam or Myanmar for its next factory, others would follow, beginning a chain of falling dominoes for Thailand – eventually. Prime Minister Shinawatra’s crisis management effort is just beginning.

• In addition to flooding and storms, risks in Asia include volcanoes, earthquakes and volcanoes with earthquakes – not generally worries in Europe or North America.

The Bank of Thailand (BoT) released a BCM/BCP policy for financial institutions in January 2007. This is the 15-page English version from Thailand’s Foreign Bankers’ Association and this is the Thai version of BOT Notification No. 118-2550 (23-01-07).

Banks have 12 months to comply: the deadline is January 2008.

This final policy does not differ significantly from BoT’s proposed BCM guidelines to which I linked in my post of September 2006 when they were released for comment. The policy requires board-level involvement, identification and recovery plans for “Critical Business Functions,” writing plans and testing them at least once every 12 months. Pretty standard stuff.

An appendix (page 15) to the policy lists sixteen (16) “Examples of Disruptive Events” for which continuity plans should be made, in five categories: natural, reputation, economy/physical, human resources and man-made. Tsunami is listed, of course, but so are “volcanic eruption” and “hostage taking,” which I haven’t seen in other national guidelines. Are there volcanoes in Thailand?

I don’t recommend limiting planning to “Critical Business Functions,” defined in the policy as those that could “significantly impact operations, business, reputation, status and performance.”

A business continuity plan should list and plan continuity of all functions of a bank or any other enterprise. Some functions will be determined “critical,” others won’t be, in a business impact analysis (BIA). In a proper BIA, the business impact of failure of all functions – big and small – is assessed.  Read more... (485 words, 0 images, estimated 1:56 mins reading time)

Thailand’s Foreign Bankers’ Association offers this English version of the Bank of Thailand (BoT) July 2006 Circular 896-2549 proposing guidelines for BCM. The guidelines will apply to all commercial banks, which will have one year to comply. That will probably put the compliance target date in 4Q 2007. To track BoT bulletins on all subjects, bookmark this link.

The Bank of Thailand (BoT) issued its first IT disaster recovery guidelines for banks at the end of 2005. Thailand’s Foreign Bankers’ Association offers this English translation of those guidelines. Mai pen rai: the Land of Smiles may also get its first BCP guidelines for banks this year. BOT’s Operational Risk Audit guidelines, December 2003: note section 2.3.4.3 about BCP on page 32.