Transcript Document

P&G BCP Process
SCRLC February 2007 Meeting
Craig Babcock, Procter & Gamble
Business Continuity Planning
Center Of Expertise
1
Agenda
Introduction
P&G Background
BCP Background
P&G BCP Process
Questions / Comments
2
Introduction
Craig Babcock
 Business Continuity Planning Manager - Manufacturing,
Purchasing, Contract Manufacturing, Distribution
 Global Fire Protection Manager
 27 Years At P&G
 Management Positions In Manufacturing, Warehousing,
Technical Engineering, Safety, Fire Protection
 Led P&G Industrial Hygiene & Safety Technical Network
 Current Member of the Health Safety & Environment Leadership
Team for P&G
3
P&G Background
 The Largest Household & Personal Care
Products Company In The World
 #24 On The Fortune 500 List
 70+ Billion Dollars In Sales
 22 Billion Dollar Brands
 3 Billion Times A Day Someone Uses A P&G
Product
 180 Brands; 22 Product Categories
 140,000 Employees; 80 Countries
4
P&G Background
5
P&G Product Supply
Background
6
P&G Product Supply
Background
Organized By Business Unit
Includes Manufacturing, Engineering, &
Purchasing
Horizontal Processes In Place To Leverage
Size And Best Practices
 P&G Makes Most Of It’s Products
More Contract Manufacturing Is Occurring
7
BCP Background
 Started July 2000 By The Board Of Directors
 Protect NOS, globalization, consolidation
 Audit Committee tracking BCP (2001 – present)
 Global Internal Audit audits BCP as part of General Controls
 CIO Is The Corporate Owner
 Vice Chair provides executive sponsorship
 VP’s & GM’s on Leadership Council
 BCP Well Established Throughout P&G
 Gillette / Braun / Duracell has strong program
 Wella acquisition is getting on board
8
BCP Organization
BCP Company Structure
BCP Leadership Council
Direction, Priority Setting
Issue Resolution, Measurement
Link to GLC
BCP Center Of Expertise Methodology, Standards, tools,
training, counseling, calibration
Global Process Owners
Develop & deploy business unit
CBAs (e.g., global EAPs),
standards & tools
Business Units
Execution of BCP process,
Plan ownership, testing,
maintenance
9
BCP Organization
BCP COE
 BCP COE (2.25 FTE)
 IT Disaster Recovery (0.5 FTE)
 Fire Protection (2 FTE)
 Workplace Services (0.25 FTE)
 Internal Controls Consultant (0.10 FTE)
 Discussion: How Many FTE’s Do You
Have?
10
BCP Implementation
Phase One – 2002 / 2003
 Developed BCP Methodology (CBA’s, tools, etc.)





Deployed to 87 Plants (sites, suppliers, etc.)
Deployed to Global Purchasing
Deployed to GBS Service Centers
Deployed to Total Order Management Processes
Deployed to CS/L Physical Distribution Center
sites
 Deployed to eBusiness
11
BCP Implementation
Phase Two 2003 / 2004
 Deployed to 36 GO Sites
 Deployed to 23 R&D Sites
 Deployed to 23 PS Sites
 Prototyped with Contract Manufacturing
 White Strips, Actonel
 Many more sites have implemented since
12
BCP Tracking
BCP Scorecard
 BCP COE tracks overall progress and status






Plans maintained and up to date
Tested once/year
GIA CSA’s completed as scheduled
Key Supplier BCP Plans reviewed (i.e. HP, IBM)
Next scheduled test
Leadership review
 Updated 4 times/year
13
Recent Crisis Events









Earthquakes – Kobe, Turkey, Pakistan
Hurricane / Tsunami – New Orleans, Asia
NA Tornadoes – Jackson, Lima
North East US Power Outage
Data Center Outages, IT Virus and Worms
Civil Unrest / War – Caracas, Manila, Middle East
Loss of Key Suppliers
Fires and Floods
SARS
14
BCP Process
Overview
1.
2.
3.
4.
5.
6.
7.
8.
Identify Business Interruption Limit
Risk Analysis and Critical Program Review
IT Disaster Recovery Review
Loss of IT, Site, People Contingency Plans
Crisis Management Plan
Document and Approve BCP Plan
Test / Exercise BCP
Maintenance
15
BCP Process
Step 1 - BIL
 Determine the Business Interruption Limit (BIL)
for each work process
 Manufacturing
 Offices
 Determine the Recovery Priority for each work
processes
 High, medium, low
 Strategy for initial recovery
 Discussion: Does Anyone Use A Similar Step In
Your Process?
16
BCP Process
Step 2 – Risk Analysis
 Complete Risk Analysis
 Identify threats to the Site / Work Processes
 Determine an overall Risk Rating for each identified
threat
 BIL’s help frame the Risk Analysis
 Short BIL’s create more concerns
 Longer BIL’s create less concerns
17
BCP Process
Step 2 - Critical Programs
 Critical Programs help manage, control and reduce
risks to the site
 Ensure the programs are current and maintained
 Review follow-up action steps to see where BCP
exposure exists
 Use Business Interruption risk filter
 Examples
• No sprinklers in part of facility
• Lack of critical spares
• Local IT operations (LIM)
• Discussion: Do You Have Separate Risk Mitigation
Programs?
18
BCP Process
Step 3 - IT Disaster Recovery
 Review Regional Data Center applications
Critical applications only (see BIL’s)
Participate in an IT DR Regional Exercise
 Review Local IT DR
Infrastructure – WAN, LAN, PBX, etc.
Critical applications on local servers
 Confirm site readiness
19
BCP Process
Step 4 – Contingency Plans
A Contingency Plan is a set of procedures
used to restore the business operation
Loss of Site
Loss of IT
Loss of People
Any high or medium risk from the Risk
Analysis
20
BCP Process
Step 5 – Crisis Management Plan
 The set of procedures used if the Site Leader declares a
Crisis
 Site/Crisis Team Leader, Team Members, Back-ups
 Command center location and backup
 Assessing Crisis and Business Recovery Priorities
 Invoking contingency plans
 Linking with Category, Country, Regional Crisis Teams
21
BCP Process
Step 6 – BCP Distribution
 Crisis Team Leaders - keep a copy at work,
home, and in car (trunk, boot, etc.)
 BCP Functional Leaders - keep your specific
plans (Loss of IT, Site, People) in a similar
manner
 Many sites now distributing CD’s and USB
memory sticks
 Still need paper copies though
 Use document revision controls
22
BCP Process
Step 6 - Management Approval
 Typically review with the Site Leader, the Category
Director, and the Manufacturing Director / VP
 Review and approval required every year
 Leadership may ask to see your BCP at any point in time,
particularly if prompted by world events
 The BCP COE should review for content, feasibility, and
standardization
 Discussion: What Level Of Management Approval Is
Required?
23
BCP Process
Step 7 - Plan Testing
 The Site Leader and the Site BCP Owner will
determine the complexity and timing of tests
 The BCP COE can also serve as a resource for
determining scope of testing required
 All sites must test at minimum once every year





Choose either Loss of IT, Site, or People
Rotate scenarios
Test Local IT DR annually
Update/Test call trees every qtr.
Discussion: How Often Do You Test?
24
BCP Process
Step 8 - BCP Maintenance
 Ways to maintain
 Incorporate BCP into change control processes
 Post BCP Action Plan, Test Results, etc on Activity
Boards / Sharepoint
 Make BCP part of scorecards and Mgmt. reviews
 Site BCP Leader forwards qtr. status to COE
 Site BCP Leader conducts BCP CSA
25
26
BCP Program
Learnings
 This is a big effort across the Company but only 1 to
2 effort weeks per site leader
 Well structured CBA disarms ‘too much work’
emotion & provides roadmap to follow
 The BCP Process reveals unknown risks within the
plant and to suppliers
 Role of leadership key, role model behavior and
organization will engage
 Keeping the BCP updated will require leadership
attention or it will fade away
 Purchasing was and continues to be a big chunk of
the work in PS
27
BCP Program
Learnings
 Sites are much more dependent on IT than they
were 6-7 years ago.
 Finding that some IT applications do not have
sufficient contingency plans was an eye opener
 Organizations will try to reinvent the wheel - a
standard process is key to robust BCP
 Auditing for compliance is essential
 Some plants are using BCP material for on boarding
new managers because of detail about site
captured
 Examples of plans are helpful
 Tests are used to improve the plans
28
BCP Program
Learnings From Disasters
Katrina
 Expect Rapid Competitive Response
 Lead, Do Not Manage
 Need Exceptional HR Resources
Jackson
Blue Ash Data Center
 Widespread IT Outages Are Very Impactful
 Our Back-Up Plans Were Not Robust Enough
29
30