Theories and Models of Communication Essay Example | Topics and Well Written Essays - 1250 words

Theories and Models of Communication - Essay Example The hypothesis of communication assists individuals in comprehending this phrase, since communication involves analysis of facts to deduce the meaning. Failure to evaluate these facts of information might lead to failing to deduce the correct interpretation. This way this hypothesis assists in analyzing information. For instance, it is easy to discern someone’s intentions; by the way, they speak. Lack of these visible signs might imply otherwise (Griffith, p.10). Mass media describe all media technologies utilized to reach an enormous audience through mass communication. Mass media also describes the institutions which manage these technologies, for instance, television stations, as well as publishing companies. An exemplar of mass media includes broadcast media, which describes the electronic transmission of information via television, radio, as well as CDs and DVDs. In addition, broadcast media involves other devices such as cameras, as well as video consoles. Another exemplar is print media, which involves utilization of a physical object as a way of transferring information. Other print media include brochures and pamphlets among others (Igor, p.10). The mass medium is an extremely powerful tool which significantly influences peoples’ ways of existence. It is extremely influential in that the images or information media displays have the capacity to foster stereotypes, products, alter cultures among others. For instance, in many countries, the dress code displayed by media is usually adopted by the youngsters. Media particularly Internet media is also readily available and affords a massive outreach. It can be utilized in varied parts of the globe concurrently and cost-effectively. This portrays the influence of media. 4 Semiotics involves the study of symbols, as well as sign systems. Semiotics also entails indication, description, metaphor, similarity among others. The fundamental component of meaning is the symbol. It is anything that can characterize an idea. It also includes studying the organization and meaning of lingo. The significant elements of any semiotic include content, as well as expression (Littlejohn and Foss, p. 23). Rhetorical evaluation assists in looking into

Promoting mental wellbeing amongst older adults Essay

Promoting mental wellbeing amongst older adults - Essay Example Below one can see a health strategy to promote mental wellbeing among older adults of a country. Strategy to Promote Mental Well being of Older Adults First and foremost , there should be provision in the health and social welfare policy to allot more funding and financial services to health centers which exclusively for older adults with mental illness. The government should increase the awareness among public regarding the mental well being of an older adult, so that they become alert and conscious regarding their food habits, exercise and lifestyle. Mental ill health could be due to a disability or serious physical illness, so the older citizens should be educated more about various diseases. The informal carers should be encourages and supported in the right manner, so that they feel motivated to take care of the older diseases citizen of the society. â€Å"Informal support groups are not provided by law but are volunteers ‘who offer to do something without charging a feeà ¢â‚¬  (Fischer, 2003,pg.13).Same should be done to formal carers as well as they are the part of social support group. The poor and secluded old people should be given social benefits like, income support and other medical benefits so that they do not feel dejected and ignored. This can fill a great gap in their life from being helpless and destitute. The older citizen should be alerted about the bad consequences of drugs, alcohol and other addictive substances to avoid misuse of them .Drug, alcohol abuse are due to the stress factor and they should be warned against this action. – As per, (SHFWP,2009) â€Å"Homelessness, refugee status, discrimination, having a physical disability all increase the risk, as do family factors (e.g. partner violence), drug and alcohol problems and lack of social support from others†. The non –profit organization which work for the welfare of the mental health of older adults should be given monetary benefits to encourage them in introducing programs which can aid old people with mental disease to improve their health. A strong strategic and leadership role should be undertaken by local government, working in partnership with other agencies, particularly the health centers, to ensure a wide range of effective programs to meet the needs of mentally ill old people. According to (Barnes2010)â€Å"Encouraging the development of new service models and utilizing new the opportunities afforded by emerging technologies to deliver the best outcomes for adult social care†. This will help in giving better and quality medical services to old aged who is mentally ill. Critical Evaluation of Contribution of Social Policy Mainly most of the developed countries have a well defined Social and health polices but when it comes to the implementation, it is not up to the mark. They put forward various programs and strategies to maintain and upgrade the mental and physical health of the older citizen, but when it comes to practice less is done. (Hasenfield,1991,pg.451-479) writes that â€Å"It is argued that policy output is determined by the organizational systems which develop as a result of technological specifications, economic considerations, and power relations†. So the government should create plans and policies according to the technology, economic condition and financial budget of the country. The living condition of an old aged person who is mentally il

Solution of a System of Linear Equations for INTELx64

Solution of a System of Linear Equations for INTELx64 A multi core hyper-threaded solution of a system of linear equations for INTELx64 architecture Richa Singhal ABSTRACT. A system of linear equations forms a very fundamental principal of linear algebra with very wide spread applications involving fields such as physics, chemistry and even electronics. With systems growing in complexity and demand of ever increasing precision for results it becomes the need of the hour to have methodologies which can solve a large system of such equations to accuracy with fastest performance. On the other hand as frequency scaling is becoming limiting factor to achieve performance improvement of processors modern architectures are deploying multi core approach with features like hyper threading to meet performance requirements. The paper targets solving a system of linear equations for a multi core INTELx64 architecture with hyper threading using standard LU decomposition methodology. This paper also presents a Forward seek LU decomposition approach which gives better performance by effectively utilizing L1 cache of each processor in the multi core architectu re. The sample uses as input a matrix of 40004000 double precision floating point representation of the system. 1. INTRODUCTION A system of linear equations is a collection of linear equations of same variable. A system of linear equations forms a very fundamental principal of linear algebra with very wide spread applications involving fields such as physics, chemistry and even electronics. With systems growing in complexity and demand of ever increasing precision for results it becomes the need of the hour to have methodologies which can solve a large system of such equations to accuracy with fastest performance. On the other hand as frequency scaling is becoming limiting factor to achieve performance improvement. With increasing clock frequency the power consumption goes up P = C x V2 x F P is power consumption V is voltage F is frequency It was because of this factor only that INTEL had to cancel its Tejas and Jayhawk processors. A newer approach is to deploy multiple cores which are capable to parallel process mutually exclusive tasks of a job to achieve the requisite performance improvement. Hyper threading is another method which makes a single core appears as two by using some additional registers. Having said that it requires that traditional algorithms which are sequential in nature to be reworked and factorized so that they can efficiently utilize the processing power offered by these architectures. This paper aims to provide an implementation for standard LU decomposition method used to solve system of linear equations adopting a forward seek methodology to efficiently solve a system of double precision system of linear equations with 4000 variable set. The proposed solution addresses all aspects of problem solving starting from file I/O to read the input system of equations to actually solving the system to generate required output using multi core techniques. The solution assumes that the input problem has one and only one unique solution possible. 2. CHALLENGES The primary challenge is to rework the sequential LU decomposition method so that the revised framework can be decomposed into a set of independent problems which can be solved independently as far as possible. Then use this LU decomposition output and apply standard techniques of forward and backward substitution each again using multi core techniques to reach the final output. Another challenge associated is cache management. Since a set of 4000 floating point variable will take a memory approximately 32KB of memory and there will 4000 different equations put up together, hence efficiently managing all data in cache becomes a challenge. A forward seek methodology was used in LU decomposition which tries to keep the relevant data at L1 cache before it is required to be processed. It also tries to maximise operations on set of data once it is in cache so that cache misses are minimum. 3. IMPACT With a 40 core INTEXx64 machine with hyper threading the proposed method could achieve an acceleration of ~72X in performance as compared to a standard sequential implementation. 4. STATE OF THE ART The proposed solution uses state of the art programming techniques available for multithreaded architecture. It also uses INTEX ADVANCED VECTOR SET (AVX) intrinsic instruction set to achieve maximum hyper threading. Native POSIX threads were used for the purpose. Efficient disk IO was made possible by mapping input vector file to RAM directly using mmap. 5. PROPOSED SOLUTION A system of linear equations representing CURRENT / VOLTAGE relationship for a set of resistances is defined as [R][I] = [V] Steps to solve this can be illustrated as Decompose [R] into [L] and [U] Solve [L][Z] = [V] for [Z] Solve [U][I] = [Z] for [I] Resistance matrix is modelled as an array 40004000 of double precision floating type elements. The memory address being 16 byte aligned so that RAM access speeds up for read and write operations. FLOAT RES[MATRIX_SIZE*MATRIX_SIZE] __attribute__((aligned(0x1000))); Voltage matrix is modelled as an array 40001 of double precision floating type elements. The memory address being 16 byte aligned so that RAM access speeds up for read and write operations. FLOAT V [MATRIX_SIZE] _attribute__ ((aligned(0x1000))); LU Decomposition To solve the basic model of parallel LU decomposition as suggested above was adopted. Here as we move along the diagonal of the main matrix we calculate the factor values for Lower triangular matrix. Simultaneously each row operation updates elements for upper triangular matrix. Basic routine to do row operation This routine is the innermost level routine which updates the rows which will eventually determine the upper triangular matrix. For each element of row there is one subtraction and one multiplication operation (highlighted). LOOP B designates row major operation, while LOOP A designates column major operation. Basic Algorithm SUB LUDECOM (A, N) DO K = 1, n – 1 DO I = K+1, N Ai, k = Ai, k / Ak, j DO j = K + 1, N Ai, j = Ai, j Ai, k * Ak, j END DO END DO END DO END LUDECOM Each row major operation (LOOP B) iteration can be independently executed on a separate core. This was achieved by using POSIX threads which were non-blocking in nature. Because of mutual exclusion over the set of data MUTEX locks are not required provided we keep the column major operation (LOOP A) sequential. Also for 2 consecutive elements in one row operation 2 subtraction and 2 multiplication operations are done. These 2 operations each are done in single step using Single Instruction Multiple Data instructions (Hyper threading) Multi core Algorithm SUB LUDECOM_BLOCK (A, K, BLOCK_START, BLOCK_END) DO I = BLOCK_START, BLOCK_END Ai, K = Ai, K / AK, K DO j = K + 1, N Ai, j = Ai, j Ai, K * Ak, K END DO END DO END LUDECOM_BLOCK SUB LUDECOM (A, N) DO K = 1, N – 1 BLOCK_SIZE = (N – K) / MAX_THREADS Thread = 0 WHILE (Thread P_THREAD ( LUDECOMPOSITION_BLOCK (A, K, Thread*BLOCK_SIZE, Thread*(BLOCK_SIZE + 1) ) ENDWHILE END DO END LUDECOM Forward substitution Once LU decomposition is done, forward substitution gives matrix [Z]. Here again Single Instruction Multiple Data instructions are used [L][Z] = [V] for [Z] Backward substitution After forward substitution final step of backward substitution gives current matrix [I] [U][I] = [Z] for [I] Here again Single Instruction Multiple Data instructions are used 5. CACHE IMPROVEMENTS On profiling it is observed that the core processing in above solution happens to be LU decomposition. However if we create threads equal in number to available cores the result was improving but not in same proportion to the number of cores. A VALGRIND analysis of cache performance reveals that because of large size of matrix each row operation was suffering a performance hit due to cache misses happening. If we observe above solution it could be observed any jth is processed for (j – 1) columns. So (j – 1) threads are forked for each iteration of column major operation (LOOP A). The data to be processed refers to same memory location but by the time next operation or thread is forked for the same row the corresponding memory data had been pushed out of lower level caches. Thus cache miss happens. To solve this we adopted a forward seek approach wherein we first pre-process a set of columns sequentially thus enabling more operations on a row to be performed in the same thread. Now the data happens to be at lower level cache as we do not have to wait for another thread to process the same row. Multi core Algorithm with forward seek operation SUB LUDECOM_BLOCK_SEEK (A, K, S, BLOCK_START, BLOCK_END) DO I = BLOCK_START, BLOCK_END DO U = 1, S M = K + U -1 Ai, M = Ai, M / AM, j DO j = K + M + 1, N Ai, j = Ai, j Ai, M * AK, M END DO END DO END DO END LUDECOM_BLOCK SUB LUDECOM (A, N) K = 1 WHILE (K //Forward seek DO J = K, K + F_SEEK LU_DECOM_BLOCK_SEEK (A, J, 0, J, J+F_SEEK) END DO //Multi core K = K + F_SEEK DO L = 1, N – 1 BLOCK_SIZE = (N – L) / MAX_THREADS Thread = 0 WHILE (Thread P_THREAD ( LUDECOMPOSITION_BLOCK (A, L, F_SEEK, Thread*BLOCK_SIZE, Thread*(BLOCK_SIZE + 1) ) ENDWHILE END DO END WHILE END LUDECOM CONCLUSION Results For purpose of computation a sample array of double precision floating point matrix of size 40004000 was taken. Performance numbers were generated on an 8 core INTEL architecture machine. TABLE 4.i A programmer that writes implicitly parallel code does not need to worry about task division or process communication, focusing instead in the problem that his or her program is intended to solve. Implicit parallelism generally facilitates the design of parallel programs and therefore results in a substantial improvement of programmer productivity. Many of the constructs necessary to support this also add simplicity or clarity even in the absence of actual parallelism. The example above, of List comprehension in the sin() function, is a useful feature in of itself. By using implicit parallelism, languages effectively have to provide such useful constructs to users simply to support required functionality (a language without a decent for loop, for example, is one few programmers will use). Languages with implicit parallelism reduce the control that the programmer has over the parallel execution of the program, resulting sometimes in less-than-optimal solution The makers of the Oz programming language also note that their early experiments with implicit parallelism showed that implicit parallelism made debugging difficult and object models unnecessarily awkward.[2] A larger issue is that every program has some parallel and some serial logic. Binary I/O, for example, requires support for such serial operations as Write() and Seek(). If implicit parallelism is desired, this creates a new requirement for constructs and keywords to support code that cannot be threaded or distributed. REFERENCES Gottlieb, Allan; Almasi, George S. (1989).Highly parallel computing. Redwood City, Calif.: Benjamin/Cummings.ISBN0-8053-0177-1. S.V. Adve et al. (November 2008).Parallel Computing Research at Illinois: The UPCRC Agenda(PDF). [emailprotected], University of Illinois at Urbana-Champaign. The main techniques for these performance benefits– increased clock frequency and smarter but increasingly complex architectures– are now hitting the so-called power wall. The computer industry has accepted that future performance increases must largely come from increasing the number of processors (or cores) on a die, rather than making a single core go faster. Asanovic et al. Old [conventional wisdom]: Power is free, but transistors are expensive. New [conventional wisdom] is [that] power is expensive, but transistors are free Bunch, James R.;Hopcroft, John(1974), Triangular factorization and inversion by fast matrix multiplication,Mathematics of Computation28: 231–236,doi:10.2307/2005828,ISSN0025-5718. Cormen, Thomas H.;Leiserson, Charles E.;Rivest, Ronald L.;Stein, Clifford(2001),Introduction to Algorithms, MIT Press and McGraw-Hill,ISBN978-0-262-03293-3. Golub, Gene H.;Van Loan, Charles F.(1996),Matrix Computations(3rd ed.), Baltimore: Johns Hopkins,ISBN978-0-8018-5414-9.

Television and Media - Variety in TV Shows :: Exploratory Essays Research Papers

Variety in Television Shows There are many different television shows today, practically one for every person in the family. Comedies, dramas, action-adventure all these different forums of television, but they all seem to be about the same people. Threw all the different verity of shows on TV all the characters have common similarities with each other. They are mostly composed of white people and the upper class. Even if the show claims to be about the working class the characters are usually never seen working or even warring about money, they also never have a problem paying rent or buying new clothes. This gives a false image of the working class. The lack of a divers cast also misleads the audience the black population is expected to outnumber the white population in this country by the year 2009. Yet all major television stations don't have many if ant minority in their shows. This leaves most of America's people unrepresentative on television. If these stations where trying to portray the middle class they did not do so in an affective manor. Looking at the show "friends" the whole cast is composed of white actors and never has a minority ever been represented in the show. All the characters have jobs but are never seen at them, occasionally we see Monica in the kitchen where she works, or Rachel in the Coffey shop doing anything but work. Even with the unusual appearance at work the characters still seem to have great apartments and seem fashionably beautiful. "Friend" is one of the most popular shows on television today. How is that possible, the answer is that executives who write and produce the shows have no idea what its really like for young adults in society today. They assume things about the American public and pass it on as the real thing. This in turn is digested by the American public and watched because theirs nothing else that is entertaining enough to keep their attention the reason why television shows seem the same is because they are made and produced by the same people with a formula that i s followed by others. Look at the show "Will and Grace" it seems to have broken the mold of the usual sitcom.

Motivation Evaluation

Motivation can help and hinder the choices an individual makes, sometimes simultaneously. People act and behave various ways and some people may never be understood or why may never be pinpointed. However, every action or behavior is an impulse of an experience or the potential of that individual. Whether it is to achieve a goal, better themselves, or gain success people will act or behave certain ways through their specific form of motivation. Miley Cyrus’s actions evaluatedMost people that surf the Internet, watch MTV, or music television, have witnessed or seen the controversy over Miley Cyrus’s latest performance on MTV’s Music Video Awards (The Huffington Post, 2013). There were many controversies over her lyrics, clothing, and actions that pertained to her overall behavior during the performance (The Huffington Post). From her clothing of the bare essentials to her obscene gestures, she was obviously motivated by one thing or another.The psychoanalytic view Assuming Miley was motivated by the psychoanalytic view of motivation, would suggest her decision to behave that way was of little or no control of her own (John Wiley & Sons Inc. , 2009). It would also suggest her actions were driven by either her unconscious instincts of life and sexuality or her unconscious instincts of death and aggression (John Wiley & Sons Inc.).More specifically her unconscious need of an outlet for aggression or her unconscious need for sexual satisfaction (John Wiley & Sons Inc. ). For example: Miley behaved that way because she was upset about losing a boyfriend, and unconsciously let out her aggression through dancing seductively on another man (The Huffington Post, 2013).The humanistic viewAssuming Miley was motivated by the humanistic view of motivation, would suggest her decision to behave that way could be because of a specific need, such as self-actualization or achievement that she consciously needed to fulfill (John Wiley & Sons Inc. , 2009). It w ould also suggest she was driven by her goals of fulfilling her full personal potential (John Wiley & Sons Inc. , 2009). (John Wiley & Sons Inc. ). For example: Miley was tired of her well-known Disney roles in entertainment that subdued her true self, therefore her behavior was an attempt to move toward her new goals of achievement and self-actualization.The diversity view Assuming Miley was motivated by the diversity view of motivation, would suggest her decision to behave that way could be because of her individual goals and personal incentives (John Wiley & Sons Inc. , 2009). It would also suggest she behaved that particular way to fulfill a psychogenic need, or combination of the various needs simultaneously to fulfill her personal goal (John Wiley & Sons Inc. ).For example: Her behavior was an attempt to fulfill her needs of achievement to increase self-regard, affiliation of being an adult instead of a child, and sentience to enjoy sensuous impressions (John Wiley & Sons Inc. ). To better explain: The diversity view of motivation by Henry Murray is the theory of needs. This theory states human lives have to be understood in the context of time, because people live in response to the past and their anticipation of the future (John Wiley and Sons Inc. , 2009).Therefore, people organize their lives and bind their time through direct and select forces that resides within the person and their environment (John Wiley & Sons Inc. ). The direct forces are needs, specifically physiological (viscerogenic) needs and psychogenic needs (John Wiley & Sons Inc. , 2009). The physiological needs are basic human needs, such as air, sleep, and water (John Wiley & Sons Inc. ). The psychogenic needs are categorized into 20 basic needs, such as dominance, sex, order, and 17 others (John Wiley & Sons Inc.).According to Henry Murray (John Wiley & Sons Inc. ), human behavior is organized by a single need or a combination of needs simultaneously, to fulfill a personal goal (John Wiley & Sons Inc. ). However, â€Å"The full dynamics of human behavior are revealed in the interaction of needs and press, producing a thema (John Wiley & Sons Inc. , 2009, p. 281). Therefore, when a need is built up overtime, it causes tension, which is released through thoughts and behavior by the individual (John Wiley & Sons Inc. ).ConclusionThere is a purpose behind every person’s behavior, whether it follows the psychoanalytic, humanistic, or diversity view of motivation, it can be analyzed or evaluated through certain processes and theories to see the purpose (John Wiley & Sons Inc. , 2009). One thing stands to be true, all people are unique, but behave similarly and differently for various reasons. Whether it is to achieve a goal, better themselves, or gain success people will act or behave certain ways through their specific form of motivation.

Business Continuity Plan as a Part of Risk Management

Celem niniejszej pracy jest zaprezentowanie roli i znaczenia Planu Ciaglosci Funkcjonowania Przedsiebiorstwa w calosciowym procesie zarzadzania ryzykiem w firmie oraz przedstawienie przykladowej tresci takiego planu.Rozdzial pierwszy zawiera ogolne wprowadzenie do zagadnienia zarzadzania ryzykiem. Przedstawia on definicje ryzyka w sensie, w jakim jest ono rozumiane w niniejszej pracy. Ponadto, znajduje sie w nim opis wielorakich zagroSen, ktore sa zwiazane z funkcjonowaniem przedsiebiorstwa, a takSe lista metod sluSacych do pomiaru ryzyka oraz opis przykladowych postaw, jakie sa przybierane wobec zagroSen. W rozdziale drugim zaprezentowano pojecie Zarzadzania Ciagloscia Funkcjonowania Przedsiebiorstwa. Znajduje sie tu charakterystyka ewolucji tego zagadnienia oraz wyjasnienie, dlaczego Plan Ciaglosci FunkcjonowaniaPrzedsiebiorstwa jest dokumentem o ogromnym znaczeniu dla firmy i jej interesariuszy. Ponadto, w rozdziale tym poddano dyskusji pewne szeroko rozpowszechnione mity dotyczac e Zarzadzania Ciagloscia Fukncjonowania Przedsiebiorstwa. Ta czesc pracy konczy sie opisem Analizy Wplywu na Przedsiebiorstwo jako glownego narzedzia, ktorym posluguje sie opisywany typ zarzadzania. W rozdziale trzecim przedstawiono rezultaty dokonanej przez autorke analizy roSnych Planow Ciaglosci Funkcjonowania Przedsiebiorstwa i ich szablonow.To studium bylo podstawa do zaprezentowania przykladowej struktury Planu oraz opisu najczesciej spotykanych w nim bledow. Ostatni rozdzial zawiera takSe charakterystyke faz wprowadzania i testowania Planu, ktore sa rownie waSne jak etap jego przygotowania. Wspolczesne przedsiebiorstwa nie moga sobie pozwolic na postawe reaktywna wobec realnych zagroSen, gdyS wydarzenia bedace w stanie zaklocic ich funkcjonowanie sa liczne i moga zaistniec zarowno w wewnetrznym, jak i zawnetrznym srodowisku firmy. Profesjonalnie przygotowany i skrupulatnie 5 aktualniany Plan Ciaglosci Funkcjonowania Przedsiebiorstwa cechuje postawe proaktywna. Jest nie tylko ogromnie pomocny w przezwycieSaniu trudnosci, ale dla interesariuszy firmy stanowi takSe dowod jej wiarygodnosci. MoSna wiec oczekiwac, Se coraz wiecej przedsiebiorstw bedzie sie staralo zdobyc ten nieoceniony atut. 6 ABSTRACT The aim of this thesis is to present the role and significance of a Business Continuity Plan (BCP) in the holistic process of a company’s Risk Management, and to provide a characteristic of exemplary BCP contents. The first chapter contains a general introduction into Risk Management.It delivers the definition of risk as it is understood in the context of the present thesis. Moreover, there is a description of multiple risks which are relevant to a company’s activity, as well as a list of the risk measurement methods and an account of exemplary attitudes towards threats. The second chapter presents the question of Business Continuity Management (BCM). It characterizes the evolution of this concept and explains the reasons why the BCP is a documen t of utmost importance to the company and its stakeholders. What is more, certain wide-spread myths concerning BCM are also disputed there.This part of the thesis ends with a description of Business Impact Analysis as the main tool of Business Continuity Management. The third chapter provides the results of the author’s analysis of various Business Continuity Plans and their templates. That study has been the basis for the presentation of an exemplary structure of a Business Continuity Plan, as well as for the description of the most frequent mistakes which occur in BCPs. The last chapter also contains a characterization of implementation and testing phases which are as significant as the preparation of a Business Continuity Plan.Modern companies cannot afford a reactive stance towards possible threats as the dangers which may disrupt their functioning are multiple and come both from the inner and outer environment. A professionally prepared and carefully updated Business Con tinuity Plan characterizes a proactive attitude. Not only does it significantly help to overcome difficulties, but it is also a convincing proof of the firm’s reliability to all its stakeholders. Therefore, it may be expected that more and more companies will attempt to acquire this invaluable asset. 7 INTRODUCTIONThe present thesis is the result of the author’s interest in various aspects of Risk Management, especially in the procedures which are applied by companies in case their functioning is faced with a serious threat. The most effective method used by business units is called Business Continuity Management (BCM) and focuses on the preparation and implementation of a Business Continuity Plan (BCP). The aim of this thesis is to present the role and significance of a Business Continuity Plan in the holistic process of a company’s Risk Management, and to characterize the contents of an exemplary Plan.The first chapter contains a general introduction into Risk Management and includes, inter alia, a description of multiple threats which are relevant to the company’s activity and a list of risk measurement methods. The second chapter discusses the concept of Business Continuity Management, explains the importance of Business Continuity Plan and characterizes the steps which lead to the development and implementation of this document. In the third chapter, there is a description of the contents which should be included in a Business Continuity Plan.That presentation is based on the author’s analysis of various BCPs and their templates. The exemplary materials enclosed in appendices have been provided by Punk, Ziegel & Company, Business Link, London Borough and Wallsal Council. All the translations which are enclosed in the present thesis have been made by the author. The references have been edited in accordance with the traditional Footnote/Endnote System. 8 CHAPTER 1 RISK MANAGEMENT This chapter contains an introduction into the nature and types of risk, as well as a description of the methods by which risk is assessed and managed.All these issues are inseparably connected with the concept of Business Continuity Plan, which aims at making provisions for the whole spectrum of present and future threats that may put a company's proper activity into danger. When a company decides to prepare and implement such a plan, it has to carry out a complex and accurate analysis of all the factors which may influence its operation, so that even the least expected dangers are taken into consideration. The first phase of drafting a BCP requires the recognition of existing and prospective risks, evaluation of their possible impacts and assumption of particular attitudes towards them.These vital steps are covered by Risk Management, which helps to organize the findings and solutions in a logical way. The proactive nature and principles of this comprehensive process will be presented and explained in the following chapte r. 1. 1. The Definition of Risk Risk and uncertainty are inseparable parts of every aspect of life. As Jan Mikolaj writes, â€Å"risk is connected with human activity, while uncertainty applies to the environment. †1 When these terms are used in the scientific context, they must be precisely defined.Some of the authors of economic and financial literature do not stress the difference between them. For example, Allan Willet states that â€Å"risk is objective uncertainty of the occurrence of an undesirable event. †2 In his opinion, â€Å"risk changes in accordance with uncertainty, not with probability level. †3 Similarly, Joseph Sinkey defines risk as â€Å"uncertainty connected with some occurrence or profit 1 2 Jan Mikolaj, Risk Management, (RVS FSI ZU, Zilina 2001), p. 17. Allan Willet, The Economic Theory of Risk Insurance, (Philadelphia 1951), p. . 9 in the future. †4 Frank Reilly thinks that â€Å"risk is the uncertainty that the investment may not bring the expected return. †5 However, the prevailing trend in modern professional literature is to differentiate between them. According to the Dictionary of Economic and Financial Terminology by Bernard and Colli, risk is â€Å"the probability of incurring losses by a business unit as a consequence of making a certain economic decision by this unit. The probability results from the uncertainty of the future. 6 The same source states further that â€Å"the concept of uncertainty is used in the situation when calculus of probability cannot be applied, whereas the term risk concerns recurrent events which possibility of occurrence can be calculated using the calculus of possibility. †7 Similar classification is introduced by Frank Knight. In his opinion, risk is a â€Å"measurable uncertainty,†8 while â€Å"immeasurable uncertainty†9 is uncertainty sense stricto. According to Irving Pfeffer, â€Å"risk is the combination of hazard and is measurable by pr obability mathematics, whereas uncertainty is measured by the level of confidence.Risk is a state of the world while uncertainty is a state of mind. †10 To summarize, risk means â€Å"a condition in which there exists a possibility of deviation from an outcome that is expected or hoped for. †11 Risk â€Å"can be expressed as a probability, ranging from 0 to 100 percent. †12 What is important, although not often mentioned in professional literature, there is not only the negative aspect of risk, but also the positive one. Thus, it is a possibility of loss as well as gain. 3 4 ibid. Joseph Sinkey, Commercial Bank Financial Management, (New York: Macmillan Publishing Co. 1992), p. 391. 5 Frank Reilly, Investments, The Dryden Press, (London: Intenational Edition, Collins, 1988), p. 463 6 Bernard and Colli, Slownik ekonomiczny i finansowy, (Wydawnictwo â€Å"KsiaSnica†, 1995), p. 156. 7 ibid. , p. 157. 8 Frank Knight, Risk, Uncertainty and Profit, (Boston: Univ ersity of Boston Press, 1921), p. 233. 9 ibid. 10 Irving Pfeffer, Insurance and Economic Theory, (Illinois: Irvin Inc. Homewood, 1956), p. 42. 11 Reto Gallati, Risk Management and Capital Adequacy, (New York: Mc Graw Hill, 2003), p. 7. 12 ibid. , p. 8. 10 1. 2. Risk in Business ActivityThe volume and diversity of risk obviously depend on a company’s type and branch of economy, but risk as such is a phenomenon which accompanies in its versatile forms any kind and field of business activity. It may come from the external environment of a company as well as from the internal one. For some entrepreneurs, risk is a necessary evil, whereas for others it is an additional motivation, if not the main one. Whatever the point of view is, if a given business activity is to succeed, it is essential to recognize what are the kinds of possible risk, asses their possible impact and acknowledge ways of reacting towards them.Such identification will considerably help in developing a suitable a ttitude, which allows minimizing a potential loss and maximizing a gain. 1. 2. 1. Types of Risk Types of risk which threaten a company’s activity are complex and numerous. Classifications of risk provided by professional literature differ with regard to the assumed criteria. The following comprehensive categorization is based mainly on the division presented in the book Risk Management in Emerging Markets.How to Survive and Prosper by Carl Olsson13: †¢ business risk (also called strategic risk) concerns potential results of inappropriate strategies, inadequate allocation of resources and changes in economic or competitive environment; †¢ market risk is associated with potential results of changes in market prices. It can be divided into: – interest rate risk, –foreign exchange risk, – commodity price risk, Carl Olsson, Risk Management in Emerging Markets. How to Survive and Prosper, (London, Pearson Education United, 2002), pp. 35-36. 13 11 shar es price risk; †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ †¢ credit risk means that a debtor may not pay in due time; industry risk regards operating in a particular industry; liquidity risk applies to inability to pay debts because of the lack of available funds; operational risk means potential results of actions by people, processes, and infrastructure; accounting risk concerns a possibility of financial accounts not being in accordance with the reality; reputation risk regards the results of changes in a company’s reputation; country risk is associated with effects which the mother ountry’s and foreign countries’ economic policies may have over the company; sovereign risk applies to lending money to the government or a party guaranteed by the government; political risk means results of changes in political environment; legal/regulatory risk is associated with the consequences of non-compliance with legal or regulatory requirements; environmental/ecological risk applies to the changes in natural environment which affect a company; systemic risk concerns small events which may produce much larges results than expected; technological risk is associated with the consequences of bringing new technology products to the market and introducing new IT systems; natural risk concerns natural and space disasters. All these risks usually appear simultaneously and their effects are synergic. Therefore, none of them should be ignored when considering the company’s situation. After realizing the large number and complex nature of different types of risk involved in all aspects of business activity, a logical step is to try to estimate their potential impact and results. 12 1. 2. 2. Methods of Risk Evaluation An assessment of a particular risk, both internally- and externally-driven, allows taking an appropriate attitude towards it.As Andrzej Stanislaw Barczak writes, such a measu rement involves both subjective and objective elements. 14 The subjective component consists in assuming a priori particular stipulations of a given evaluation tactic, as well as interpreting obtained results in a specific way. The objective constituent derives from the common agreement of the business circle on the methods widely applied to the assessment of risk. Two main types of risk measurement tactics are quantitative risk assessment and qualitative risk assessment. 1. 2. 2. 1. Quantitative Risk Assessment The main conception of quantitative risk assessment is to determine the cost of a given unwelcome occurrence, i. e. o calculate how big the loss would be if an adverse event happened. As it is pointed out in The Security Risk Management Guide, â€Å"it is important to quantify the real possibility of a risk and how much damage, in monetary terms, the threat may cause in order to be able to know how much can be spent to protect against the potential consequence of the threat . †15 This method involves: †¢ evaluation of assets (determining the overall value of a company’s assets, the immediate financial impact of losing the asset and the indirect value of losing the asset); †¢ measurement of the Single Loss Expectancy (SLE), which means â€Å"the total amount of revenue that is lost from a single occurrence of the risk. 16 It is calculated by â€Å"multiplying the asset value by the exposure factor (EF). The 14 Andrzej Stanislaw Barczak, Ryzyko – kategoria obiektywna czy subiektywna? , (Poznan: WSB, 2000), s. 30. 15 Microsoft, The Security Risk Management Guide, (Microsoft Corporation, 2004), p. 19. 16 ibid. , p. 18. 13 exposure factor represents the percentage of loss that a realized threat could have on a certain asset. †17 †¢ assessment of the Annual Rate of Occurrence (ARO), which is â€Å"the number of times that one can reasonably expect the risk to occur during one year. †18 This step is very diffi cult; it bases on historical data and previous experiences, and requires consultation with experts. calculation of the Annual Loss Expectancy (ALE), which stands for â€Å"the total amount of money that an organization will lose in one year if nothing is done to mitigate the risk. †19 This figure is established by multiplying the SLE and the ARO. †¢ valuation of the Cost of Controls (ROSI), i. e. establishing â€Å"accurate estimates on how much acquiring, testing, deploying, operating, and maintaining each control would cost. â€Å"20 It is estimated by using the following equation: (ALE before control) – (ALE after control) – (annual cost of control) = ROSI Although quantitative risk analysis provides clearly defined goals and results, all of the involved calculations are based on subjective estimates, which may prove inaccurate. Moreover, the whole process can be long and costly. 1. 2. 2. 2. Qualitative Risk AssessmentIn opposition to the quantitative method, qualitative risk assessment does not â€Å"assign hard financial values to assets, expected losses, and cost of controls†21 but instead, 17 18 ibid. , p. 19. ibid. , p. 19. 19 ibid. , p. 19. 20 ibid. , p. 19. 21 ibid. , p. 20. 14 â€Å"calculates relative values. †22 It involves distribution of questionnaires among people in the company who have relevant skills and knowledge, and workshops. The questionnaires are designed to discover what assets and controls are already deployed, and the information gathered can be very helpful during the workshops that follow. In the workshops participants identify assets and estimate their relative values.Next they try to figure out what threats each asset may be facing, and then they try to imagine what types of vulnerabilities those threats might exploit in the future. The information security experts and the system administrators typically come up with controls to mitigate the risks for the group to consider and the approx imate cost of each control. Finally, the results are presented to management for consideration during a cost-benefit analysis. 23 This tactic does not require a lot of time and it is not a big burden for the people involved. What is more, the results of the implemented solutions are quickly visible. However, the estimated figures are often perceived as too vague.These two presented approaches are often used together in order to obtain the most comprehensive information about a potential threat. Although scientific methods of risk assessment are helpful in estimating the possible impact which particular occurrences may have on the company’s activity, it is essential to remember that none of the methods can be perceived as 100% trustworthy and absolutely infallible. However, even if it is impossible to predict all threats and provide for all undesirable events, the significance of risk evaluation tactics combined with human knowledge, experience, imagination and intuition canno t be questioned. 1. 3. Risk Management in Business ActivityThe fact that the phenomenon called risk is measurable and its occurrence may be predicted means that it is also possible to take preventive measures and proactive attitude towards it. As Reto Gallati stresses, â€Å"the term Risk Management is a recent creation, but the actual practice of risk management is as old as civilization itself. †24 In everyday life, people face risk in a varying degree all the time and they manage it in a natural way so as to minimize undesired impact and render possible profits. 22 23 ibid. , p. 20. ibid. , p. 20. 15 Certain individuals even enjoy plunging into extraordinarily dangerous situations in order to check how they will cope in difficult moments.However, Andrew Holmes notices that â€Å"at the individual level, if a person takes a risk and fails to manage it properly, the damage is limited to him, and maybe his near relatives,†25 while â€Å"the management of risk for orga nizations is not as simple. †26 As it was presented in the part 1. 2. 1, the company is a subject to various and multiple threats. Holmes stresses that â€Å"ultimately, all risks have a financial impact. †27 The complexity of the required actions aimed at coping with the risk means that â€Å"within the modern corporation, risk management must encapsulate managing strategic, business, operational, and technical risks, rather than those associated with pure finance such as credit, interest rate, and currency risk. †28 Nowadays, Risk Management is not an extra feature added to a company’s basic activity, but â€Å"an essential skill of all modern corporations. †29 All usiness units should realize its great importance, because it is essential not only for their success but simply survival. According to Holmes, a company’s attitude towards the risk depends on its risk sophistication, which can be divided into five stages30: †¢ at the lowest level of sophistication (reactive stance), risks are dealt with only when they turn into live issues or when crisis strikes. There is no effort to recognize and measure possible risks in advance. †¢ At a slightly more sophisticated stage, a company understands the importance of risk management and takes the trouble to identify and manage threats more actively. It tends to seek out the best practice and views adverse events in a wide context. At the next level, there are organizations which acknowledge the need to manage risks throughout the organization and usually develop some form of 24 25 Reto Gallati, Risk Management and Capital Adequacy, (New York: McGraw Hill, 2003), p 11. Andrew Holmes, Risk Management (Oxford: Capstone Publishing, 2002), p. 2. 26 ibid. 27 ibid. 28 ibid. 29 ibid. 30 ibid. , p. 8. 16 risk management framework to ensure consistency of approach. †¢ At the following stage, a company understands the link between risk and reward. It is aware that for eve ry risk there is an associated opportunity which can be exploited. Such a business unit is often a market leader and is willing to take risks to achieve its strategic objectives. At the ultimate level of risk sophistication, there are organizations which integrate risk management with the goal of enhancing shareholder value. Thus, they shift the responsibility for risk management away from the traditional areas of audit and compliance to everyone within the organization. Of course, the active process of Risk Management requires commitment and focus as it means following a deliberate set of actions which are designed to identify, quantify, manage and then monitor the events or actions that could lead to financial loss. Often, there is too little data about a given risk, and therefore, this kind of management may involve a large degree of judgment and assumptions concerning the future. 1 Yet, all the effort is worthwhile as â€Å"successful organizations tend to be excellent risk man agers, not only because they understand the risks they face, but also because of how they manage them. Conversely, those organizations that are poor at risk management spend no time scanning the risk horizon, instead leaving their futures to fate. This invariably means shocks, falling market share, takeovers and missed opportunities. †32 As Holmes reflects, â€Å"risk management is both an art and a science, and being successful depends on how well the two are kept in balance. †33 1. 3. 1. Methods of Risk Management John Holliwell, the managing director of Smith Williamson Consultancy, once said, â€Å"There is nothing wrong with risk.It is the lifeblood of business and the test of entrepreneurs and managers. What matters is how you handle risk and the culture in 31 32 ibid. ibid. 17 which you operate. ’’34 A similar thought is expressed by Clifford Tijok, â€Å"Entrepreneurial behaviour demonstrated in real life entails, i. a. , the ability to enter int o calculated risk, so that return-driven opportunities can be pursued and the ability to identify the relevant risks associated with these opportunities and the decision on appropriate behaviour to address these risks. †35 When a company decides on its risk management techniques, it usually analyses the following features: Table 1. Factors influencing the type of risk management framework required by the organization36ors the type of risk managementframework required by an organizatio FACTORS INFLUENCING RISK MANAGEMENT REQUIREMENT DIMENSIONS TO CONSIDER Strategy risk appetite of owners/risk managers industry geographical coverage aggressive or conservative risk taking or risk averse sunrise or sunset industry; primary, manufacturing, service sector local, national, regional or global is the company critically dependent on critical success factors one or two factors which require close management? volatility is the environment likely to change significantly or unpredictability ? monopoly, few or limited number of osition in industry players, or free market with many players and no barriers to entry is the area of operations highly controlled by regulatory environment legislation and/or regulatory bodies? are regulators intrusive or hands off? 33 34 ibid. ibid. , p. 2. 35 Clifford Tijok, Risk Management in Finance, (Lehrverangstaltung, 2005), p. 8. 36 Carl Olsson, Risk Management in Emerging Markets†¦ pp. 110-111. 18 is deregulation occurring or the level of regulation increasing? management style centralized or decentralized adequate or inadequate people and resources technology resources, financial position – adequate funds available, highly or lowly geared. tatus/ownership Organizational culture Public or privately owned Is the culture strong or weak? are they simple and predictable or nature of risks faced complex/ unpredictable? is the size of risks manageable or is catastrophic risk a cause for concern? Such an analysis leads to adopting one of the main risk management techniques, as presented by Cliff Tijok37: †¢ †¢ †¢ risk limitation – a company establishes its range of tolerance towards a given risk and constantly monitors whether the limits are not breached; risk avoidance – a company chooses the least risky option or none of them; risk transfer – a company reduces or completely transfers specific risks by hedging against a risk (i. e. , obtaining insurance) or diversification.Whatever the approach is, managing risks â€Å"takes a degree of courage and requires the organization to take responsibility for its actions. †38 It is a continuous process, which is â€Å"based on a distinct philosophy and follows a well-defined sequence of steps. †39 After the application of the methods and rules provided by risk management, the obtained data are organized in a clear and logical way. This is the basis which allows the company to go one level up and prepare action schedul es that will be used in case a recognized danger occurs. An essential part of such planning is encompassed by Business Continuity Management and will be discussed in the next chapter. 37 38 Cliff Tijok, Risk Management†¦ pp. 12-13. Andrew Holmes, Risk Management†¦ p. 2. 39 Reto Gallati, Risk Management†¦ p. 11. 19 CHAPTER 2 BUSINESS CONTINUITY MANAGEMENT This chapter provides information on what is Business Continuity Management, when it appeared in the history of management, what purposes it serves and how it should be organized and introduced into a company’s activity. Moreover, it contains a description of the steps which lead to the preparation of a Business Continuity Plan and of the implementation process that follows. Business Continuity Management forms an integral part of Risk Management. It met with particularly deep interest in the 1990s as the result of the frenzy which concerned the year 2000.At that time, there were many anticipated business conti nuity problems, implicated by the date change in computer systems. Business Continuity Management became even a bigger focus of attention in 2001, after the terrorist attack in New York. As Michael Gallagher observes, that huge calamity â€Å"increased awareness of business interruption issues, resulted in a better understanding of critical processes and vulnerabilities and improved co-operation and collaboration between public and private sectors on emergency management questions. †40 Lyndon Bird adds that â€Å"‘business today has far more economic interdependency between regions than ever before. There are often global consequences when risk becomes reality. 41 Yet, at the same time â€Å"there is a growing awareness of what business continuity really is about and why it is so important to both businesses and individuals. †42 8 2. 1. The Concept of Business Continuity Management Business Continuity Management (also called BCM) is defined by the Business Conti nuity Institute as â€Å"a holistic management process which identifies potential Michael Gallagher, Business Continuity Management, (Edinburgh: Pearson Education Limited, 2003), p. 7 41 Lyndon Byrd, â€Å"Business Continuity Management in a shrinking world,† Business Continuity & Risk Management (a supplement distributed in The Times), July 26 2006, p. 2 40 20 mpacts that threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. † Its main purpose is to enable the company’s regular functioning, even though everyday operations are disrupted. As Lorraine Lane observes, â€Å"organizations must be capable of withstanding the shocks that can so easily distract management from their primary purpose of meeting and beating their ‘normal’ operational goals. †43 BCM appears as the solutio n that is exactly needed to guarantee such stability to the business. Obviously, BCM looks different in various companies as each organization is a unique system of multiple factors and interdependencies.Dr David Smith explains that â€Å"because of its all-embracing nature, the way BCM is carried out will inevitably be dependent upon, and must reflect, the nature, scale and complexity of an organization’s risk profile, risk appetite and the environment in which it operates. †44 Gallagher supports this view by stating that â€Å"the plan must fit comfortably with the culture and management style of the organization. For example, the type of plan that suits a financial institution would be totally inappropriate in a radio or television broadcasting organization. †45 It is also very important to acknowledge that the company’s BCM must be continuously revised and tested, in order to stay valid and fulfill its tasks. As Dr Smith emphasizes, â€Å"BCM is, by necessity, a dynamic, proactive and ongoing process. It must be kept up-to-date and fit-for-purpose to be effective. 46 Maintaining the validity of proper plans and policies is actually more difficult than establishing them, but this is what constitutes the point of developing BCM by a business. On the following page, there is an approximate structure of steps involved in Business Continuity Management, which is focused on planning. 42 43 ibid. â€Å"Corporate resilience: the new regime,† Business Continuity & Risk Management,†¦, p. 11 44 David Smith, â€Å"Business continuity and crisis management,† Management Quarterly, July 2003, p. 27 45 Michael Gallagher, Business Continuity Management,†¦, p. 43 46 ibid. 21 Scheme 2. 1. Procedures involved in Business Continuity Management47 INPUTS 1. 2. 3. 4. 5. 6. scope definition desired objectives policies and standards inventory – information, technology, people management commitment financeANALYSIS ASSET ASS ESSMENT BUSINESS IMPACT ANALYSIS TECHNICAL REQUIREMENTS 1. analyze BIA and Asset Assessment 2. list technical strategies based on the analysis of each asset and business process in scope 3. document drawbacks and advantages of each listed strategy 1. identify and quantify asset needs 2. document ownership 3. assign weight based on importance 4. assess exposure 5. identify access control and other preventive measures 1. rate processes based on criticality 2. identify dependencies 3. identify custodian 4. identify threats and consequences 5. identify safeguards needed/possible 6. list critical resource requirement 7. quantify acceptable owntime and and losses DEVELOPMENT 1. 2. 3. define continuity goals and chosen strategy in the form of a plan acquire resources needed for preparing and implementing the continuity plan test the plan RESULTS 1. 2. 3. 4. preventive control Business Continuity Plan continuity team training plan for team 47 Padmavathy Ramesh, Business Continuity Planning, (Tata Consultancy services, 2002), p. 28 22 2. 1. 1 The Evolution of BCM As Halls observes, â€Å"Business Continuity Management is a relatively modern idea. Its first mentions can be found in the 1980s, although it was only in the very late 1990s that it became a more widespread as a business discipline. 48 In fact, Business Continuity Management is â€Å"the outcome of a process that started in the early 1970s as computer Disaster Recovery Planning (DRP) and then moved through an era where the emphasis was on business continuity planning rather than on management. †49 In that time, computer managers were responsible for DRP. Soon, they realized that â€Å"the concentration of systems and data in itself created new risks; computer operations management introduced formal procedures governing issues such as backup and recovery, access restrictions, physical security, resilience measures such as alternative power supply, and change control. †50 In 1970s, if a big probl em appeared, the tolerated downtime was not measured in hours, but days. Therefore, â€Å"the cost of back-up computers sitting idle in an alternative location waiting for a disaster to happen was prohibitive. However, for some companies, data safety was a priority; no matter at what cost it would be obtained. As Gallagher points out, â€Å"organizations such as banks were in a more vulnerable position and invested considerable resources in installing and testing computers at alternative sites. Back-up tapes or disks were increasingly stored at protected locations well away from the computer centre. †51 Later, in the 1980s, commercial recovery sites offering services started to appear, often on a shared basis. â€Å"This was the start of the sophisticated recovery centers that operate today,†52 notes Gallagher. However, they all concerned mainly IT: â€Å"The disaster recovery plans documented the actions required to safeguard and restore computer operations.These co vered computer processing, computer applications, telecommunications services and data after a disruptive event. The objectives were to 48 49 Michael Halls, â€Å"What is Business Continuity Management? † †¦ Michael Gallagher, Business Continuity Management,†¦, p. 6 50 ibid. 51 ibid. 52 ibid. 23 prevent or at least minimize the impact that such an event would have on the business. †53 Such plans were far from being perfect as â€Å"they were more concerned with, for example, restoring a company’s financial systems to an operational state than with worrying about whether there would be accommodation available to allow the staff of the finance department actually to use the systems. 54 Not much attention was paid to implementing BCL into every aspect of the company’s activity. In 1990s, a significant change in the IT environment took place and the movement from DRP to Business Continuity Planning became considerably quicker. Gallagher confirms tha t â€Å"throughout this decade, and into the 2000s, there were significant changes in the IT approach to DRP/BCP and in what constituted acceptable downtime. The emphasis moved from being mainly on IT to an approach that considered all aspects of an organization’s business and relationships. †55 It is only then that â€Å"BCP has become BCM with the emphasis on management – not just planning.This encompasses the emphasis on risk management and the measures to be taken to reduce risk. BCM is no longer regarded as a project – it is now a program, emphasizing that it is a continuous process rather than a task with a defined enddate. †56 The next step is to make managers of all companies aware of the importance of BCM as â€Å"the increased recognition of BCM means that a greater budget allocation may be available to it. More significantly, the message preached by business continuity practitioners for years that business continuity principles should b e an integrated part of the business planning process may be heard. † 57 2. 1. 2 The Significance of BCMThanks to proper Business Continuity Management, a company has a professional plan which allows acting as quickly and efficiently as possible in case a dangerous 53 54 ibid. ibid. 55 ibid. 56 ibid. 57 ibid. 24 event happens, because â€Å"BCM not only aims to provide continuity in customer service at a minimum acceptable level, it also aims to limit the impact on the financial position of an organization by ensuring that its critical functions continue to operate during a crisis and that the remainder are recovered in a controlled manner. †58 Therefore, when a BCP is applied, there are no chaotic, haphazard attempts to minimize the losses as clear and logical procedures have been devised earlier and communicated to the staff.As Mel Gosling notices, â€Å"decisions made in the first few hours of an event that causes serious disruption to an organization’s opera tions are critical, and actions undertaken in the first few days will have a significant financial impact†59 and â€Å"a company that has an effective and well-tested Business Continuity Plan is more likely to take the right decisions in the first few hours and to subsequently undertake the best actions to limit the impact on its financial position. It has a better chance of incurring significantly less additional expenditure at the time of a disruption. †60 Moreover, â€Å"one of the benefits that implementing business continuity management brings to a firm, which is not immediately apparent, is an understanding of what the business does and what is important to it. †61 In this way, a company can analyze its allocation of resources and improve it, as well as â€Å"find out what is critical and of value, and what can be outsourced or left undone. †62 Besides, certain companies, e. g. , financial institutions, are legally obliged to develop BCM and maintain an effective business continuity plan.It is also becoming increasingly common that businesses require from their suppliers to be presented with their BCM plans. This facilitates the process of assessing the supplier’s infallibility and constitutes an element of developing a sound business relationship. Mel Gosling, â€Å"Why invest in business continuity,† 1 February 2007, . 59 ibid. 60 ibid. 61 ibid. 62 ibid. 62 ibid. 58 25 The investment into Business Continuity Management is beneficial not only in the matter of a business being prepared for multiple diverse crises. It also adds significantly to the company’s reputation and brand image by â€Å"demonstrating effective and efficient governance to the media, markets and stakeholders. 63 Moreover, it enhances the competitive advantage of the business, because to some investors and customers it may be a vital factor in deciding to which company they should entrust their capital. Osborne explains it as follows, à ¢â‚¬Å"To a firm’s shareholders it’s part of investor relations – you are showing your commitment to keeping their investment safe. To a firm’s staff it is labour relations – you are showing your willingness to protect the livelihood of your staff. †64 Furthermore, he stresses that â€Å"it’s customer relations too – you’re demonstrating your commitment to providing a service for them even in the most extreme of circumstances. †65 Last but not least, devising professional plans and keeping them updated increases the company’s credibility in the eyes of nsurers and auditors because they are becoming increasingly aware of the importance of BCM. As Osborne observes, â€Å"Five years ago, auditors simply would have said to their clients, do you have a plan in place? A couple of years ago, they would have wanted to inspect it, to see if every contingency was covered and how practical it appeared to be. Nowadays, they will ask how it worked in practice. When it was last tested and what were the results? †66 What is more, â€Å"insurers like to see evidence that all reasonable steps have been taken to understand the past accident record and that actions have been put in place to prevent them from happening again. 67 This is confirmed by Gosling, who states that â€Å"insurance companies themselves are now starting to realize the opportunities that business continuity provides for loss reduction, and it is becoming increasingly common for a condition of insurance cover to be the existence of a business 63 64 David Smith, â€Å"Business continuity and crisis management,† †¦ p. 27 Ask the panel of business continuity experts,† †¦ 65 ibid. 66 ibid. 67 â€Å"Pro-active Risk Management: Avoiding catastrophe. † Business Continuity & Risk Management,†¦, p. 14 26 continuity plan. †68 All in all, devising and implementing an effective BCM plans brings ve rsatile advantages to a company, while the failure to do so â€Å"means taking an unnecessary risk with an organization’s future and profitability. †69 2. 1. 4 Continuity Culture in a Company A vital step in forming Business Continuity Management in a company is to instill a proper attitude in the staff.Michael Gallagher believes that â€Å"it is about creating a continuity culture in the organization. This can be at least as important as producing the actual plans. †70 He also states that â€Å"for BCM to work, it must be driven from the top. â€Å"71 Therefore, senior managers must understand that BCM is â€Å"not just another expense but also a significant resource,’ 72 as Mike Osborne assures. However, the amount of data that has to be taken into consideration while developing preventive measures is overwhelming. Lane points out that â€Å"while responsibility for corporate resilience sits firmly with the executive board, the skills and experience required to combat the growing list of disruptive threats exists throughout the organization. 73 Thus, in large companies, it is a wise move to appoint a full-time Business Continuity Manager, whose tasks are to accumulate the relevant knowledge from all departments and co-ordinate proper procedures, as well as devise professional plans and keep them updated. Smaller businesses may use the services offered by consulting companies. The staff’s awareness of specific procedures ready to be applied in case of any foreseeable disaster enhances their efficiency and identification with the company. Instructing them of the specific plans encourages them to pay bigger attention to the safety issues, which significantly contributes to the BCM process. 68 69Mel Gosling, â€Å"Why invest in business continuity,† †¦ ibid. 70 Michael Gallagher, Business Continuity Management,†¦, p. XI 71 ibid. 72 â€Å"Ask the panel of business continuity experts,† Business Continu ity & Risk Management,†¦, p. 12 73 David Smith, â€Å"Business continuity and crisis management† †¦ p. 27 27 Gallagher explains that â€Å"if the business continuity culture is sufficiently developed, the continuity considerations will be a natural part of the development of the plans. †74 2. 2 BCM and the Company’s Size For the definite majority of large corporations, BCM is a regular part of their activity but, as Gallagher states, â€Å"there is a feeling that it is not a matter of concern to the smaller business. 75 This happens because â€Å"a lot of the emphasis in the business continuity press, and in business continuity material generally, relates to large organizations and to the financial services industry. †76 While â€Å"for the largest corporations and those with enormous sums of money at stake, the complexity of planning is breathtaking,†77 â€Å"small and medium-sized enterprises tend to get ignored when talking about bus iness continuity planning. The planning is more prosaic. The challenges are fewer. And most importantly, their budgets are smaller. †78 Another problem is the fact that â€Å"smaller companies are typically less aware of the correct procedures than larger firms where systems have been developed. 79 The managers of small and medium-sized businesses simply tend to think that their company’s size is a kind of safeguard against a disaster, or that potential recovery will be quick and simple, so â€Å"the process of developing a plan is perceived as too complicated, involving excessive costs and management time. †80 However, Mike Osborne emphasizes that â€Å"the issue for small to medium sized businesses is that they often do not have the inherent resilience that say, a UK multinational has. †81 He warns the managers against an illusive safety feeling as â€Å"smaller firms often trade from a single location and do not benefit from vast armies of support sta ff and Michael Gallagher, Business Continuity Management,†¦, p. 88 Michael Gallagher, Business Continuity Management,†¦, p. 28 76 ibid. 7 Michael Halls, â€Å"What is Business Continuity Management? † Business Continuity & Risk Management,†¦, p. 3 78 Michael Halls, â€Å"Small is still beautiful (but riskier too),† Business Continuity & Risk Management,†¦, p. 10 79 ibid. 80 â€Å"It’s never too late to plan for the future,† Business Continuity & Risk Management,†¦, p. 15 75 74 28 specialists who can react to and recover from an incident. If they are hit by a disaster, the impact is greater then it would be the case in a larger organization. †82 This view is supported by Gallagher, who states, â€Å"Small businesses should remember that their biggest threats do not come from high profile incidents such as earthquakes or terrorist bombs.It is the dozens of relatively minor issues such as prolonged power outages or computer ne twork failures that may cause the problems. The vast majority of problems are caused by people or process failures. †83 He points out that â€Å"this is where the effort and investment should be concentrated. Because of size, the process is simpler and the cost will be proportionally less than for larger organizations. The consequences of not having a plan are, however, likely to be disastrous. †84 Therefore, as Michael Halls stresses, â€Å"Business Continuity Management is a must for companies of all sizes. A small firm that loses its data will go out of business just as surely as a larger one. †85 2. 3 BCM in Relation to InsuranceSome managers wonder why they should engage themselves into Business Continuity Management while their company is insured. To them, devising a BCM plan seems to be an unnecessary waste of time and money, because they think that risks are looked after by the insurers and thus, there is no need to worry. But these are absolutely false c onclusions. As Mark Baylis emphasizes, â€Å"insuring the risk is not the answer, because it is better for the business that the problem does not happen at all. † 86 This view is supported by Gallagher, who states that â€Å"insurance is simply a necessary part of the total business protection and recovery plan – but it is only a part. 87 Although it is true that insurance provides financial aid in case a disaster strikes, the money may 81 82 ibid. ibid. 83 Michael Gallagher, Business Continuity Management,†¦, p. 28 84 ibid. 85 Michael Halls, â€Å"Small is still beautiful (but riskier too),† †¦ 86 Mark Baylis, â€Å"Weak links in the supply chain,† Business Continuity & Risk Management,†¦, p. 11 87 Michael Gallagher, Business Continuity Management,†¦, p. 33 29 arrive after quite a long period. Moreover, â€Å"insurance for loss of profits, or for increased cost of working, will cover only a defined period – which in practice may prove to be inadequate. †88 Besides, â€Å"proving loss of profits can be very difficult.The outcome may be based on historical performance and may not take account of recent market developments. †89 It is also very important to notice that insurance will not â€Å"keep customers supplied or guarantee that market share will be recovered,†90 nor will it â€Å"protect the organization’s reputation and image. †91 Last but not least, as it was mentioned in the previous paragraph, there may be a situation when the insurer refuses to provide a cover unless the company devises a BCM, because nowadays businesses are required to act more actively in protecting themselves from various possible risks. Therefore, it is vital for a firm to have efficient Business Continuity Management in order to obtain insurance on favourable terms.To sum up, managers must remember that â€Å"insurance is reactive – while it has its place, the whole protection proce ss must be more proactive and BCM is the key. †92 2. 4 Business Impact Analysis Business Impact Analysis (also known as BIA) is the most important tool of Business Continuity Management. Gallagher defines it as â€Å"a management-level analysis that identifies the impacts of losing company resources. It measures the effect of resource loss and escalating losses over time in order to provide senior management with reliable data upon which to base decisions on risk mitigation and continuity planning. †93 The BIA process â€Å"identifies and ranks the business processes, 88 89 ibid. , p. 34 ibid. 90 ibid. 91 ibid. 92 ibid. 93 ibid. , p. 146 30 criticalities and dependencies. 94 It is closely related to risk analysis, which was discussed in the previous chapter, therefore, it may base on the materials that have already been gathered during the general Risk Management process in the company. The method by which BIA is carried out â€Å"depends on the nature of the organiza tion – size, structure, local or international, etc. †95 Generally, in order to maximize the efficiency of a BIA processes, standardized questionnaires should be used. They should contain questions which are formed in such a way as to provide information that concerns the following issues: †¢ †¢ the nature of given problems; the impact of the problems, which should be presented from different perspectives, e. g. the company’s reputation, costs involved, loss of future business, etc. †¢ †¢ †¢ the influence that may be caused by the problems at different times of the day, week, month and year; the kind of resilience that may be currently provided in a quick and easy way; the recovery from the addressed problems (time needed for recovery, priorities for resumption, duration of backlog, additional costs, insurance cover); †¢ †¢ the available workarounds and the way they operate; the continuity and recovery requirements, e. g. , acco mmodation, computer systems, etc. 96 After the questionnaires have been filled in, the Business Continuity Manager prepares a comprehensive report which presents the company’s Business Impact Analysis. The report is composed of the following parts: 1. Introduction 2. Executive Summary 3. Background to Study 94 95 ibd. , p. 47 ibid. 96 cf. Michael Gallagher, Business Continuity Management,†¦, p. 57 31 4. Current State Assessment 5. Threats and Vulnerabilities 6. Critical Business Functions/Operations 7. Business Impacts – Operational and Financial 8. Potential Strategies 9. Recommendations 10. Conclusion 11.Appendices97 Thanks to the logical and substantial structure, the report fully represents the current standing of the company, clearly indicates its weak points and realistically describes possible procedures. Business Continuity Management is an extremely important process, which not only enables the assumption of proper attitudes towards multiple threats that endanger a firm’s functioning, but it also significantly deepens the understanding of the business and improves the staff’s morale. Proper implementation of BCM in a company leads to the creation of a Business Continuity Plan, which will be discussed in detail in the following chapter. 32 CHAPTER 3BUSINESS CONTINUITY PLAN In the previous chapters, the importance of Business Continuity Management was explained and it was stated that devising a Business Continuity Plan is one of the main tasks of this type of management. This chapter provides information on how to construct, implement and test a Business Continuity Plan. Moreover, it contains a description of the most frequent mistakes that appear while drafting a BCP and advises how to avoid them. The exemplary plans and templates on which the analysis is based are attached as Appendices B, C, D, E and F at the end of the present thesis. 3. 1 The Structure of an Exemplary Business Continuity PlanBusiness Continuity Plan s vary in length and are divided into different parts, which mostly depends on the size and type of a company. However, certain sections are vital and thus common for all the plans. They should be organized in such a way as to enable quick access to the required information. These crucial parts will be successively discussed herein. 3. 1. 1 Front Page and Introduction On the front page of a Business Continuity Plan, there should be written the name of the company, the issue date and a distinct lettering stating BUSINESS CONTINUITY PLAN. Moreover, if the Plan is confidential, it should be indicated on the front page as well. Optional elements inserted here may include contact details for feedback, references, the revision date, etc.These components are followed by an introduction, which consists of a distribution list (copy number, name and location) and a table of contents. 97 cf. Michael Gallagher, Business Continuity Management,†¦, p. 57 33 3. 1. 2 Aim This section should con tain the description of the purpose for which the Plan has been created. It usually gives examples of possible disasters and explains the objectives which the plan is intended to meet in case of a calamity. What is more, a company which wishes to convey an especially powerful message concerning its reliability may include in this part a summary of the extensive works and professional researches which have been involved in the development of the Plan. 3. 1. 3 Critical Functions ChecklistCritical Functions are these activities without which the company would not be able to perform. In order to prepare a Critical Functions Checklist, the following steps should be completed: †¢ †¢ †¢ †¢ †¢ the identification of Critical Functions, e. g. , sales and distribution; the description of the Functions in terms of the impact which may be caused by their interruption in the first 24 h, 48 h, one week and two weeks; the prioritization of the Functions; the ascription of a reasonable timeframe within which the recovery is possible; the determination of resources which will be necessary in the recovery process, such as: a) the staff – the required number of people, their knowledge and skills; b) alternative location – e. g. the staff working at home or provisional premises; together with necessary equipment like computers, cars; c) data – information and documents, e. g. , insurance certificate, service, customers and suppliers details; d) communications – all ways in which customers, suppliers, the staff and media can be contacted in case of disaster. 34 Such a Checklist allows ensuring that â€Å"critical tasks are completed on time and according to a pre-agreed priority schedule. It may also be used to provide a handover document between different shifts in the recovery process. †98 3. 1. 4 Risk Analysis Table This part should contain a table comprising a list of dangers which may interrupt and threaten the activi ty of the company.The matrix presented below may be used to ascribe values to the particular risks with regard to the likelihood of their occurrence and their potential impact. Table 3. 1. 4 Risk Matrix LIKELIHOOD NEGLIGIBLE CATASTROPHIC RARE UNLIKELY POSSIBLE PROBABLE M M M L L H H M L L VH VH H M L VH VH H M L VH VH H M L IMPACT SIGNIFICANT MODERATE MINOR INSIGNIFICANT Legend: L – low, M- medium, H – high, VH – very high Moreover, there may be also attached a list of possible losses, endangered people and equipment, as well as the actions which had to be taken in case a particular risk occurs. 98 Appendix D, p. 77. 35 3. 1. 4 Emergency Response Checklist Such a Checklist greatly facilitates the performance of people involved in fighting a potential adverse event.It also acts a concise register of actions that were taken after the disaster happened. It should be later analyzed, developed and improved. It is preferable that tasks to be completed are organized in the form of a table, together with a column in which the date of termination will be written down. The actions may be listed as follows: †¢ during the first 24 h a) to establish the Actions and Expenses Log, which is a more detailed and comprehensive version of the Emergency Response Checklist; b) to contact emergency services; c) to identify and approximately assess the damage which has been incurred by the staff, equipment, buildings, data, etc. d) to determine the critical functions which have been interrupted; e) to decide on the steps that need to be taken within the recovery process, which is based on the Critical Function Checklist; f) to contact the staff, customers, suppliers, insurers, relevant authorities and other stakeholders in order to assure them that the situation is under control; g) to issue a special PR statement to the media. †¢ daily within the recovery period a) to update the Actions and Expenses Log; b) to provide valid information to the staff, cu stomers, suppliers, insurers, relevant authorities and other stakeholders, as well as the media; †¢ after the recovery period a) to interview the staff with respect to their welfare needs; b) to analyze the Emergency Response Checklist and Actions and Expenses Log in order to introduce possible improvements into the Business Continuity Plan. 36As it can be seen, the response to the crisis should focus on its effects, not on the causes. The reasons of the adverse event should be identified as quickly as possible, but a comprehensive analysis of them must not be performed before the main steps of the recovery process have been taken. 3. 1. 5 Roles and Responsibilities This section should contain information and contact details regarding the people who are responsible for the shape and content of the Business Continuity Plan (e. g. , Business Continuity Manager, the BCM Team). Moreover, there may be included a list of duties which are ascribed to the particular staff members in ca se an adverse event happens.Last but not least, it is necessary to indicate the names and contact details of the co-ordinators of the recovery process, help-line numbers (possibly, with pre-recorded messages) and location of meeting rooms and the Business Recovery Command Centre, together with maps. 3. 1. 6 Contact List In this part, there should be listed the following contact details: †¢ staff members (divided in respect to the departments) and their next of kin a) name, b) address, c) work telephone number, d) home telephone number, e) mobile telephone number, f) e-mail address; †¢ key suppliers a) name, b) provided goods, c) address, d) telephone/fax number, 37 e) e-mail address; †¢ key customers a) name, b) service/good used, c) address, d) telephone/fax number, e) e-mail address; †¢ mergency services (ambulance, fire service, flood line, hospitals, police) a) address, b) telephone number; †¢ utilities (water, telecommunication, gas and electricity comp anies) a) name, b) telephone number, c) e-mail address; †¢ insurers and banks a) name, b) address, c) telephone/fax number, d) e-mail address; †¢ authorities a) name b) address c) telephone/fax number; †¢ media a) name, b