Risk Assessment and Management

Introduction
It is a fact of modern corporate life that organisations exist in a world where often unforeseen and potentially highly disruptive events can be a threat to their ongoing viability and existence. The growing complexity and interconnectivity of most organisations only adds to challenges and issues they face when such issues occur.

In recent years, the following examples can be cited:

Natural disasters (wildfire, flood, earthquake)
Pandemics and disease (Covid-19, SARS, Ebola, MERS, Swine Flu, Zika Virus)
Economic and financial shocks (credit rating/ inflation/ liquidity and cashflow)
Supply chain disruption/failure of external companies/ partners to deliver on contracts
Man-made disasters (explosion, factory fire, toxic substance spill or leak)
Adverse publicity (human rights infringements, inadequate sustainability policies)
Stealing/copying/infringement of intellectual property rights (patents, trademarks)
Utility disruption (electricity, gas or water supplies)
Rapid technological change/obsolesce and new innovations/products/actions of competitors
Sabotage and war (bomb, terrorism, GDPR risk, arson, armed conflict in key regions)
Cybersecurity attacks (data breach, ransomware, SQL injection attack)

Aim of Coursework

The aim of this coursework is to develop a Business Continuity Management System (BCM) based on the guidance provided for an engineering focussed organisation of your choice. To do this, you will work in a group and complete the deliverables more particularly specified in the next sections.

Specification of requirements
As part of the coursework, you are required to complete a report which includes the sections more particularly described in the sections below. Be sure to search for a variety of BCMS templates available from the literature and those you may find from the internet as a guide, in order to design your own templates for answering particular parts of the coursework.

Rationale for selecting the organisation and contextual setting
Select a suitable engineering industry, company or organisation of your choice based on available literature, work experiences, placement, or personal research, and explain the rationale for selecting it. The case study company should be from a recognised "developed" nation (United States, Europe, Japan or South Korea). Be sure to obtain approval for the selection made before you start work on the assignment. The organisation selected must be a reasonable size to sustain a serious incident that would pose a significant threat to normal business. Approval for the choice made may be sought from Dr Andrew Carruthers.

Identify and discuss at least TWO case studies from the literature, in a related area of the organisation business, whereby a business continuity management system has worked well or failed and what lessons have been learned from it. Be sure to include such lessons in your proposed BCMS.

Leadership

Discuss how senior management demonstrates leadership and commitment to the Business Continuity Management System (BCMS). Outline the BCMS policy and the associated roles, responsibilities and authorities. Discuss how senior management promotes the BSMS policy and highlights its importance, evaluates risks and opportunities, and ensures appropriate resources and accountabilities are made available.

Planning

Discuss how the organisation addresses risks and opportunities that impact on the ability of the BCMS to achieve its intending outcomes and determine the action required to address them, how Business Continuity objectives are managed commensurate with the BCMS policy, how such objectives can be achieved and measured given the available resources, and how the organisation manages changes and likely impacts on the integrity of the BCMS.

Support
Discuss the resources required for the establishment, implementation and maintenance of the BCMS you are proposing. Refer critically to the competences required and the various communication protocols, the resources both internal and external (capable, competent and sufficient), that the organisation must master in the event of an incident. Also refer critically to training/skills matrices, appraisals and supplier assessments that can be used for determining competence in so far as business continuity is concerned. Show example documentation and the process of review, control and dissemination.

Operation
Discuss the operation and control of processes that need to be in place in case of an incident. Conduct a Business Impact Analysis and Risk Assessment and Business Continuity Strategy, and outline all associated resources and procedures, incident response structure, and warning and communication. Focus your business continuity plans and recovery plans as specified below:

Include in your ‘Risk Assessment and Analysis', a detailed risk evaluation by:
Identification of critical business functions essential for continued service or production.
Determination of events that can adversely affect the organisation, the damage that such events can cause and the controls needed to prevent or minimise their effects.

Include in your "Resource Requirements"

All internal and external resources
People
Information and data
Infrastructure and supporting utilities
Equipment and consumables
IT and communication systems
Transport and logistics
Finance
Partners and suppliers.

Include in your ‘Business Impact Analysis':
Identification of the impacts that result from disruption that can affect the company and the techniques that can be used to quantify and qualify such impacts

Prioritisation of critical business functions

Include in your ‘Business Continuity Plan':

A Recovery Strategy: Determine and guide the selection of alternative recovery operating strategies to be used to maintain the critical functions

Include in your "Internal Audit and Management Review":

Planned intervals to assess the BCMS continued adequacy, suitability and effectiveness in meeting the needs of the organisation, any changes required to improve its efficiency and effectiveness, and communication plans to relevant interested parties.

Performance evaluation
Discuss how you can test, approve, and implement the proposed business continuity plan, and how to maintain it on an ongoing basis in order to meet the changing demands of the organisation. For example, discuss testing criteria and procedures and develop processes to keep the plan up-to-date. Finally, discuss how to manage non-conformities.
Conclusions
Provide a list of up to 10 conclusion points from the work derived. These may be in the form of lessons learned from developing the proposed BCMS.