Risk Management

Credit during the early years of the banking industry was exclusive only to big companies and few privileged individuals who were considered very valuable clients by the bank management. The greater number of the bank’s clients – the depositors – were plainly limited to maintaining savings accounts therein. The same funds generated from the deposits of retail savings account-holders were mostly utilized as loans released to borrowers who were deemed qualified by the bank’s credit investigation team, and then by the approving officer.

The principal business of banks is to issue loans and to earn interest in the process. It is an acknowledged fact that extending credit is one thing that accounts for the largest use of the banks’ resources. Loans, therefore, are among the highest yielding assets a bank can add to its portfolio, and they often provide the largest portion of traditional banks’ operating revenue. In the light of this, it is not surprising that credit operations and activities of banks have undergone many changes through time.

Banks have continually improved their existing packages, came up with innovations to make their credit services more attractive, and developed new designs for credit products – all these to make their operations viable. After all, with the multitude of banking entities that have been incorporated and formed, there is little or no room for losers or those whose products have failed to keep up with the demands of the present times. A substantial portion of bank credit is expended to commercial and industrial customers in the form of direct loans.

Historically, commercial banks have preferred to make short-term (whose maturity dates fall within a year from the issuance date) loans to businesses, principally to support purchases of inventory as an integral part of their regular business cycle. In recent years, however, banks have lengthened the maturity of their business loans to include term loans that mature longer than a year after issuance. Term loans are used to finance the purchase of buildings, machinery, and equipment.

Moreover, longer-term loans issued out to business firms have been supplanted to some extent in recent years by equipment leasing plans. These leases are the functional equivalents of a loan – that is, the customer not only makes the required lease payments while using the equipment but is also responsible for the required repairs and maintenance and for any taxes due thereon. (Peter S. Rose; Money and Capital Markets: Financial Institutions and Instruments in a Global Marketplace; 2000) These developments have served the business sector well.

Indeed, many businesses have thrived and have gone through expansion phases through the help of credit from banks which readily made available the cash resources they needed to fund capital expenditures and operating expenses. Thus, during such years – and even up to present times – of credit maximization, one only had to work on paying the interests and loan amortizations promptly whenever they fell due and banks would be going after him and his business as a client that they would want to win.

Competition among banks for identified valued clients can be fierce, given that banks offer products and services that are uniform in nature. It is therefore important to package attractive returns for depositors and to put together a loan product that will be most beneficial to the prospective borrower while at the same time ensuring that the spread or yield for the bank’s funds is satisfactory for the bank management and stakeholders. Good credit standing is tantamount to power.

Industries and companies in it have flourished in partnership with the banking industry and the financial companies offering all sorts of credit and other financial products and services. Then came the time when banks realized that there is the untapped opportunity in catering to the smaller clients – the average depositors – who number millions and therefore can mean figures that are not to be ignored. The small-sized credit transactions that banks can engage in with them as clients can bring in revenues and yield that when taken as a whole can be comparable to the income generated from taking care of the large-sized entities.

Bankers have noted that consumers provide the most of the savings out of which loans are made and financial assets are created in the money and capital markets. Thus, the same consumers ought to be among the most important borrowers in the financial system. (Peter S. Rose; Money and Capital Markets: Financial Institutions and Instruments in a Global Marketplace; 2000) Thus, one of the dynamic areas in bank lending today is the making available of installment loans to individuals and families, particularly loans secured by a property owner’s equity in his own home.

Home equity loans can be used to cover a variety of financial needs ranging from tuition fees of the borrower’s kids in school to the purchase of a family car. From the collateralized home equity loans evolved the consumer loans. The latter requires no real estate collateral, and the basis for their approval basically lies in the good results of personal and credit background investigations conducted on each prospective borrower-client.

At present times, a growing percentage of the working class – particularly those with white-collar jobs – constitutes the consumer loan borrowers of banks. There is a valid concern today, though, that consumer loans, especially the credit-card variety, have become more risky for banks due to higher default rates. Many banks and credit card companies have increased their issuance of new credit cards including high-credit-limit “gold” or “platinum” cards explosively, democratizing credit in order to reach millions of new customers, many of whom represent serious risk for lenders.

Intense competition has encouraged many banks to give credit cards to customers who may have little or no credit history, some of whom even turn out to be poor credit risks. It has come to this after years and years of stiff competition in the credit card industry. CREDIT MANAGEMENT PROCESS A sound credit management process would be one that minimizes, if not completely eliminates, the credit risk undertaken by the lending bank by providing loans to borrowers. Risk is an integral part of financial services, but it can be managed efficiently and effectively.

An effective credit management process, if properly installed and applied, can mean timely detection of a problem with a specific borrower, which would be followed through by actively tackling the identified account. It can also provide major inputs in the planning and budgeting phases of the operations. With the problems identified and the forecasts more inclined to be reasonably accurate because of the processes and systems in place, the management can make well-informed decisions regarding the directions to take and moves to make concerning the credit services of the bank.

The credit management policies adopted should be integrated into the system and values of the entire company or bank. This synchronization will enable the credit department employees to get the support and backing they require from management and from colleagues in other departments of the company or bank – in terms of budget allocation, peer support, technical collaboration with other departments, regular feedback on prevailing concerns, and others.

In this scenario, credit-related problems are arrested at the onset and when it is beyond the credit department people to see to it or to solve it, then such problems are elevated without delay to the senior management for alternative recourses. Effective credit management requires periodic analysis of the financial performance of the credit department at least quarterly. Performance indicators would then collect and restate financial data to provide useful information about the financial standing of the department, or even more specifically, of each group of borrowers.

The performance indicators critical areas including the portfolio quality, the productivity and efficiency with which the credit officer managed the credit portfolio, the financial viability of each account or portfolio, the profitability of the account, the leverage and capital adequacy and the scale, outreach and growth of the accounts. Risk management effectiveness can be seen from the improvement of all these indicators. The portfolio quality, however, is the recommended focus since it reflects the greatest amount of credit risk that the bank is exposed to.

(Managing Risks; Center for Research and Communication Foundation, Inc. ; 2005) A good loan policy would be one written for the objective of packaging and delivering loans that will be paid in full and on time by the borrower. The entire credit management process of a bank should include policies that consistently steer the employees and management of the company or bank toward working for a balanced, profitable and financially healthy credit portfolio. A good loan policy would entitle to credit only applicant-borrowers who would turn out to be good payers.

Thus, at the point of application submission, the bank should have policies regarding what to watch out for, what to verify, what questions to seek answers for, what amount to finally approve for release to each client and what terms will be imposed. One wise rule to follow: Know your client. From this wise rule, the bank would be on guard against clients wanting to borrow more than what they can afford to return. From this same wise rule, the bank would know who to trust and not to trust with credit – especially uncollateralized credit.

ECONOMIC AND COMPETITIVE EVENTS There are the cyclical fluctuations of the demands for credit, and these same fluctuations have been seen through the course of the existence of the banking industry. As an example, between 1990 and 1993, total loans released by banks declined from 62 percent to 58 percent, with the bulk of the drop accounted for by the decline in business loans from 18 percent to 14 percent. This drop and the associated increase in the securities portfolio occurred during and immediately after the 1990 and 1991 recession.

These developments were perfectly consistent with the historical substitution of securities for loans – meaning that demand for loans declines during recessions and so fund managers and banks would opt to park the idle cash in securities rather than to issue them out as loans. Banks have traditionally treated their government securities portfolio as a residual use of funds – buying government securities during recessions when private loan demand is slack, and then selling them off during business recoveries, when private loan demand is vigorous. (Lawrence S. Ritter, William L. Silber and Gregory F.

Udell; Principles of Money, Banking, & Financial Markets 10th Edition; 2000) The Federal Reserve perennially faces a number of serious problems as it attempts to achieve its most recently announced annual money and credit supply targets. Continuing changes in the public’s money-using habits – especially shifts from conventional bank deposits to mutual funds – distort the money supply measures and alter their relationship to the economy. The emergence of the many mutual funds and hedge funds, which all serve as alternative investment vehicles that people can choose, is a reality that banks and other creditors will have to face.

The supply of money that flow into their coffers in the form of savings deposits and time deposits are projected to be not as abundant as before. This, then, lessens the available cash banks have handy for issuance to borrowers; this, then, makes it urgent that they tap other sources of cheap funds for the purpose of continually providing credit services. One source of funds that has become more often resorted to by companies that have the required competencies for it is the initial public offering (IPO) of company shares.

This provides the company with the cash and liquid resources it needs to fund expansion or to provide additional working capital for its operations. To opt for IPO means to sell shares of the company to interested third parties for prices that the management and current stockholders have approved. Thus, IPOs enable companies to end up with the needed cash without having to recourse to the credit services of banks and other financial institutions. IPOs used to be exclusive to elite companies that are financially sound and that have the goodwill needed to bring in good reception for their shares in the public.

Resorting to IPOs brings in both benefits and complications. All these can be studied by companies contemplating IPOs for their own, better so if they employ investment houses to guide them throughout the IPO ride. Through it all, these challenges have been weathered by the credit industry. Credit services by banks will never be out of style for as long as there will be borrowers – big companies needing billions on standby or small consumers needing thousands as credit card lines – to keep the credit business going. ASSET AND LIABILITY MANAGEMENT

The assets and liabilities of the banks are on the regular – if not constant – watch of stakeholders. The internal parties concerned would be the stockholders and the management who would all want the bank running profitably and in great shape for the good returns that it can mean on their investments, and for the good performance that it can represent in the eyes of the board of directors, respectively. The employees, too, are after the security of their jobs and bright prospects for their future, and so would also be concerned with the results of the company operations and its financial condition.

External parties interested in the same would be the government monitoring agencies that cover banks and credit institutions, then more importantly, the depositors and clients of the bank. The depositors would want to be among the first to know if the bank is not in a financially sound condition because this would constitute as the sign to withdraw all that they have deposited in the bank and to transfer them to a safer one. The financial management of the banks involve looking out for the indicators that give sneak peeks of what is happening within.

There are a number of ratios and percentages to constantly monitor, depending on the specific area of concern. Generally, there are ratios and balances between assets and liabilities of the banks that internal and external parties would be interested in. The current ratio is the ratio of the bank’s current assets to its current liabilities. This ratio shows whether or not the bank is capable of settling all of its debts and obligations that are to be due within a year from any given date through the use of its cash, reserves and other assets that can be convertible to cash within the period of one year.

The debt to asset ratio, on the other hand, is the ratio of the total debt of the bank over its total assets. It gives the percentage of the total assets of the bank that is financed or provided by the bank’s creditors. The bigger this ratio, the more unsafe it is for the bank’s creditors. Creditors usually have rules as to the level of existing debts that they will allow for their borrowers. Likewise, there are standards that banks have to stick to, being monitored by the government for the general protection of the public or the bank’s depositors. (Eugene F. Brigham and Joel F.

Houston; Fundamentals of Financial Management; 1998) Good financial management should translate to a healthy combination of the assets and liabilities of the bank. Assets are resources to be maximized and used for the normal course of business of the bank. Liabilities are obligations to be honored to protect the good name and goodwill of the bank. Good financial managers are ever on look out for all these. They are continually working for that equitable balance between assets and liabilities, revenues and costs – all to maintain a financially healthy bank. CREDIT CONCENTRATION AND RISK MANAGEMENT

Almost everybody is risk-averse. But risk is one reality that is never to be completely eradicated from the picture. An article entitled “Figuring Risk: It’s Not Scary” begins as follows: When it comes to investing, you would rather not hear about it. That’s why so much money sits in certificates of deposit or Treasury bills linked to that reassuring phrase “backed by the full faith and credit of the U. S. government. ” (Arthur Keown, David Scott, John Martin and Jay William Petty; Basic Financial Management 7th Edition; 1996) Risk is seen both as an opportunity and a threat.

In a phrase, there is the “risk-return trade-off. ” One does not and should not take an additional risk without being compensated with additional return. In a similar way, one should not incur additional costs in avoiding and mitigating risks without being compensated by additional benefits. To have effective credit management practices in place, the bank must integrate credit risk management into the organization’s culture. It is the task of the top management to communicate the importance of risk management and to instill a risk management culture at all levels of the institution.

Without a firm commitment to effective risk management from the top management and without the needed resources to implement such practices, the employees cannot be expected to perform their respective duties in a manner that mitigates risk. Incentives and other schemes to motivate employees to be constantly practicing proper risk management habits will go a long way. After all, it is the front-line employees of the credit department who attend to the initial stages of the processing of credit for clients.

Even at their levels, they can – out of loyalty to the bank and out of the drive to perform his duties well – save the bank from granting credit to clients who turn out to be unqualified and therefore are candidates for becoming problematic account-holders or delinquent borrowers. Risk management, if tackled in a united and systematic way by the multitudes of people in the bank, managers and rank-and-file employees alike, can be a successful undertaking that will usher in more growth and expansion for the bank. REFERENCES: Ritter, L. , W. Silber and G.

Udell; Principles of Money, Banking, & Financial Markets 10th Edition; USA, Addison Wesley Longman, Inc. ; 2000. Rose, P. ; Money and Capital Markets: Financial Institutions and Instruments in a Global Marketplace; USA, McGraw-Hill; 2000. Center for Research and Communication Foundation, Inc. ; Managing Risks; Philippines; 2005. Brigham, E. and J. Houston; Fundamentals of Financial Management 8th Edition; The Dryden Press; Orlando, FL; 1998 Keown, A. , D. Scott, J. Martin and J. W. Petty; Basic Financial Management 7th Edition; Simon & Schuster (Asia) Pte Ltd; Singapore; 1996

This paper shows the extent of overlap between a broad-based view of risk management, namely Enterprise Risk Management (ERM), and the balanced scorecard, which is a ideal used strategic control system. A case study of one of the Auk’s largest retailers, Tests Pl. Is used to show how ERM can be introduced as part of an existing strategic control system. The case demonstrates that, despite some differences in lines of communications, the strategic controls and risk controls can be used to achieve a common objective.

Adoption of such an integrated approach, however, has implications for the profile of risk and the overall risk culture within an organization. Keywords: balanced scorecard; case study; corporate governance; enterprise risk management; risk controls; strategic control, Tests Pl. Introduction The notion that risk Is Inherent to any business activity Is a long standing one, but the establishment of formalized risk functions in organizations is a much more recent phenomenon.

Corporate governance frameworks serve to create structures that help to facilitate management accountability in a world characterized by a divorce of ownership from control (Spire and Page, 2003), but such controls seem so far to have failed to stem the recurrence of corporate scandals across the globe. Regulatory bodies have responded by Introducing a mix of practice recommendations and pacific requirements that emphasis the importance of internal control systems as a way of improving accountability and reducing the risk of corporate failure. These regulations have served to raise the profile of risk management, as demonstrated below.

In the UK, the Combined Code of the Committee on Corporate Governance was originally published in 1998 and incorporated the recommendations of a number of earlier committees (Academy. Greenberg and Hamper). A revised version of the Combined Code was issued in July 2003, in which the principles of good corporate governance were categorized under a number of headings including financial Combined Code requires the Board of Directors to maintain a ‘sound’ control system in order to safeguard shareholders’ investment and the company’s assets and to review, at least annually, the effectiveness of that control system.

Financial, operational, compliance and risk management controls should all be included in the review. There is, however, no requirement for the Board to report externally on the reviews findings. As part of the process of ensuring effective internal controls, the Board is also required to appoint an audit committee of at least three members, all of homo should be independent non-executive directors. The Combined Code thus emphasis executive responsibility for internal controls, which explicitly include risk management controls.

In the United States the Committee of Sponsoring Organizations (COOS) has published two key reports (COOS, 1992, 2004) laying down guidelines on the design of internal control systems. The internal control framework outlined in the 1992 report identifies risk management as one of five elements within the control system, but the 2003 report (Enterprise Risk Management) was drafted in injunction with consultants from PricewaterhouseCoopers with the specific aim of developing a framework to enable managers to evaluate and improve their companies’ risk management systems.

In so doing it argues that it “expands on internal control, providing a more robust and extensive focus on the broader subject of enterprise risk management … That incorporates the internal control framework within it” (COOS, 2004, foreword, p. V). The profile of risk management is thus raised substantially, as it shifts from being a component of internal control to one in which it effectively encompasses internal control. This change in thinking is of great potential significance for the risk and audit professions.

The COOS 2004 report complements the Sardines Solely Act (SOX) of 2002, which was a direct response to the corporate scandals of World and Enron. The act places great emphasis on the responsibilities of directors for effective internal control, although it contains no provisions on the role of internal audit function. Section 404 of SOX requires that a company’s annual report should contain an internal control report which includes a statement of management’s responsibility for establishing and maintaining an internal control system, and an assessment of the system’s effectiveness.

This must be supplemented by a statement from the external auditor attesting to and reporting on the management’s assessment report. Like the I-J, therefore, the US regulators seek to emphasis management’s responsibilities for the design and maintenance of internal control systems. In designing internal control and risk management systems managers need to try and strike a balance between taking advantage of the growth and returns that can be generated by taking risks with the potential losses that may also result from risk taking.

Setting strategic objectives and establishing an acceptable associated level of risk are thus closely intertwined, and this paper seeks to demonstrate how risk management systems can be used to both encourage line managers to meet strategic objectives whilst also aligning their risk taking to the risk appetite established by the Board of Directors. In other words, utilizing risk management to enhance strategic success. It argues that the ultimate objective decision making and thus enhance performance from the perspective of multiple stakeholders.

The paper contributes to the risk management literature in two distinct ways. Firstly, by using detailed case study information from Tests Pl, one of the Auk’s leading retailers, to provide insights into risk management practice the paper adds an empirical dimension to work that has to date emphasized the design of theoretical models of risk management rather than consideration of risk in practice. Secondly, the paper links the key concept of Enterprise Risk Management (ERM), as promoted by COOS, with the balanced scorecard which is used as a strategic performance measurement system.

In so doing, the link between risk management and strategy is made explicit in a manner that is relatively new to the literature. The paper is structured so that the next section on the development of the concept of enterprise risk management is followed by a section discussing an alternative form of strategic control system, namely the balanced scorecard. The strong parallels between ERM and the balanced scorecard are explained in detail, and arguments presented to show the potential advantages of combining the two control systems.

The main part of the paper then describes the risk management system within Tests Pl, and its interface with the balanced scorecard approach also used within the business. The concluding section seeks to identify the advantages and disadvantages of the risk systems deployed in Tests, and the scope for further research in this field. 2 The development of enterprise risk management (ERM) A review of the risk management literature indicates that both the definition of risk and also our understanding of the term risk management have evolved over time.

Spire and Page (2003) chart in some detail the evolution of risk definitions from the pre-seventeenth century onwards. In pre-rationalism times risk was seen as a ensconce of natural causes that could not be anticipated or managed, but with more modern, scientific based thinking there emerged a view that risk was both quantifiable and manageable via the Judicious use of avoidance and protection strategies. Risk management became institutionalized with the application of science (Beck, 1998) and in the process the public were led to expect risks to be managed.

As a consequence, risk management led to some diffusion of responsibility for the adverse effects of risk whilst the notion of accountability required some demonstration of risk management effort (Spire and Page, 2003). Slim and Menace (1999, p. 161) note what they describe as “major paradigm shifts in organizations’ approach to risk management”. The first of these relates to the fact that over time risk management has evolved from an insurance and transaction based function into a much broader concept that is linked to both corporate governance and the achievement of strategic objectives (Enclave, 1996; Nottingham, 1997; Unshorn, 1995).

The concept of risk management being centered in the treasury division with its use of financial instruments to hedge transaction and funding risks is long dead, as asks have become much more broadly defined to include aspects such as corporate reputation, regulatory compliance, health and safety, employees, supply chain management and general operational activities.

Risk is now viewed from a very broad perspective, and it is almost inevitable that this has important implications for the The second paradigm shift is a result of the broadening of the definition of risk leading to a reconsideration of the purpose of risk management, and the development of views that argue that it is concerned with assisting decision making to improve corporate strategic performance (Dolomite and Touché, 1997).

The Institute of Chartered Accountants of England and Wales (ICE) defines business risk as “the uncertainty as to the benefits that the business will derive from pursuing its objectives and strategies” (ICE, 2002, Para. L . 2, p. 3). One of the core dimensions of the risk management process is thus “identifying, ranking and sourcing the risks inherent in the company’s strategy’ (ICE, 2002, Para. 4. 2, p. 5). Broad definitions of risk, and recognition of the strategic and governance roles played by risk management are the characteristics of Enterprise Risk Management (ERM) or what is moieties called holistic risk management.

The framework for risk management outlined by COOS defines ERM as follows: “Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. ” (COOS, 2004, p. 2) The definition contains a number of key phrases. Firstly, ERM is initiated by the board f directors in the first instance, but is cascaded across the organization via line management.

Secondly, it is broad based because it encompasses all potential events that may affect achievement of objectives. Lastly, ERM aims to contain risk within the boundaries of a specified risk appetite and provide reasonable assurance in this regard. Such a broad perspective of risk management implies a requirement to develop a very comprehensive strategy to identify, measure, monitor and control a vast array of risk exposures, and communicate the company’s risk policies to staff at al levels via the creation of a risk aware culture.

This is a very broad remit for the risk manager, as it encompasses all hierarchical levels within the company as well as multiple functions, and hence poses major challenges in its practical implementation. Perhaps not surprisingly, therefore, there is evidence to indicate a limited take up of ERM to date. In a survey of internal auditors, focused primarily on US based companies, Basely et al. (2005) found that only forty eight per cent of the 174 respondents had at least a partial ERM system in place in their companies and a rather one third were planning to implement ERM in the future.

Basely findings need to be viewed with caution because the survey response rate was only 10%, and the majority of respondents were from large US corporations with annual sales in excess of $1. 3 billion. There is therefore a danger in generalizing up from such results, but they none the less offer some indications that the adoption of ERM is still in its relatively early stages. Notwithstanding the challenges of introducing it, because ERM seeks to assist the fulfillment of strategic objectives it aligns the interests of the risk manager with those of the entity as a broader whole.

In principle performance management systems. The integration may raise issues of professional rivalry between parties such as internal auditors and risk managers, but there is no obvious intrinsic conflict between the aims of ERM and any other control system. One of the most widely documented control and performance management systems in use today is the Balanced Scorecard or Tableau De Bored. In the next section of this paper, the basic principles underpinning the Balanced Scorecard are discussed, gather with its scope for use as the tool for implementation of ERM. The balanced scorecard The balanced scorecard is a management control system popularized by Kaplan and Norton (1992, 1993, AAA,b,c, 2000) that has its origins in Porter’s concept of strategy as a response to competitive forces in an industry. The popularity of the scorecard can be explained in part by the fact that it recognizes the significance of non financial factors in determining strategic success, and hence moves performance measurement away from its traditional focus on purely financial measures.

In addition, it serves as a feed forward control system as well as a performance measurement system (De Has and Giggled, 1999), thereby offering clear advantages over the historically based performance measures that characterize financial systems. The balanced scorecard identifies four component perspectives within which a company must perform well in order to achieve its strategic objectives – namely financial, customer, internal business processes and learning and growth.

Kaplan and Norton (AAA) argue a linked cause and effect relationship between performance in each of the perspectives and strategic outcomes. In other words, for example, improvements in organizational learning may lead to improvements in internal business processes, which in turn raise customer satisfaction levels and ultimately result in higher levels of financial performance. The perspectives may be interlinked and so the order of cause and effect may vary, but the basic principle remains – by setting targets for operational behavior, strategic performance can be improved.

There is some debate within the management accounting literature about the extent to which the balanced scorecard is empirically proven to be an effective intro and performance improvement tool (Dinner and Larker, 1998), but proving the cause and effect relationships in practice is extremely difficult. Kaplan and Norton (ICC) argue that the balanced scorecard is valuable in ensuring both the articulation of corporate strategy and the specification of the factors that will facilitate strategic success, but there are reasons to be rather cautious of these proclaimed benefits.

Grady (1991) argues that strategic objectives need to be classified in terms of critical success factors and critical actions, but the balanced scorecard does not rank measures of performance in this way. In addition, the importance of good communication systems cannot be underestimated. Merchant (1989) argues that failure to communicate strategies effectively throughout an organization can lead to poor economic performance, but the balanced scorecard seems to assume the existence of effective communication systems which may not exist in practice.

Despite such criticisms, one of the greatest benefits of the balanced scorecard lies in its potential to overcome the remoteness of strategy from day to day seeking to introduce ERM into an organization. Risks of various types may threaten he achievement of strategic objectives, and systems need to be devised to create a culture or consciousness of how to manage those risks at all levels within the organization.

If risks can be linked to the four perspectives of the balanced scorecard, then the management of those risks can be integrated into an existing performance measurement system. 4 Linking ERM and the balanced scorecard Table 1 below, which draws on Kaplan and Norton (Bibb) and COOS (2004), shows the degree of overlap between ERM and the Balanced Scorecard in terms of their basic philosophies, organizational breadth and scope for use as both control and reference measurement tools.

Table 1 The overlap between ERM and the balanced scorecard ERM Basic philosophy Poor internal control of risk can Jeopardize strategy Interface between control and performance measurement Risk controls help to achieve higher performance levels via minimization of the loss of resources Organization wide High. Controls should work to align operational activity with corporate risk appetite Strategic performance is influenced by both financial and non-financial factors Performance measurement against targets serves to ensure effective controls Balanced scorecard

Level of staff involvement Significance of operational behavior and performance Risk Organization wide High. Targets should work to align operational activity with corporate strategy Straddles all functional and Encountered in all scorecard operational areas perspectives, for example: Customer – risk of dissatisfaction/ loss Financial – interest rate and credit risks Learning and growth – poorly trained staff Internal business processes – delivery delays; cookouts Both ERM and the balanced scorecard recognize the significance of non-financial factors in overall company performance.

In the case of ERM, the non financial component is purely that of risk, which is not explicitly mentioned in the balanced scorecard, although it can indirectly impinge upon any or all of the quadrants of the scorecard, as indicated in the Table. Implicitly if not explicitly, therefore, the balanced scorecard incorporates risk as an influence upon strategic performance. One interpretation is that the balanced scorecard seeks to create a control structure that ensures the implementation of strategy, and risk management complements this by identifying and mitigating any potential threats to strategic implementation.

Table 1 also shows that both systems function across all hierarchical levels within an organization. Neither strategy nor risk issues are exclusively the preserve of the board of directors, with the result that operational effectiveness even at the lowest levels of employment can serve to impact on the achievement of objectives. In the fully stocked can cause lost sales for the business leading to missed targets, simply because customers may be unable to find what they want.

Such an individual, albeit in a limited way, has an impact on the achievement of both risk and strategic sales argues, and hence the setting of operational performance targets and the use of controls to monitor that performance are fundamental to both systems. In both ERM and the balanced scorecard, performance measurement and control may be regarded as complementary – good controls enhance performance, but performance also needs to be managed via Judicious target setting that reinforces strategic objectives.

Ultimately, therefore, the balanced scorecard is Just one specific type of control system and ERM another type, but there are potential advantages to be gained by their integration. If risk issues are managed separately from other strategic objectives, so that a balanced scorecard runs parallel with ERM, then managers may have difficulty in proportioning the targets they have been set.

If the two systems are integrated, then the influence of various types of risk upon, for example, customer loyalty levels becomes clearer, with the result that risk targets become embedded in the performance culture of the organization, and relevant to all grades of staff. Where risk management systems are embedded in this way, there is less need to create a new function of risk management, because everybody Jobs are redefined to incorporate a risk component. Overall responsibility for risk control rests with the board of directors, as suggested under both UK and US regulations.

Simultaneously, the management, implementation and monitoring of risk controls is delegated to line management, whose remuneration and survival is linked to performance against a range of targets, of which risk is Just one element. The following section outlines the structures used to control and manage risk in Tests Pl, one of the Auk’s largest retailers, with over 220,000 employees and group sales in excess of EYE,OHO million. The data for the case study was drawn from two key sources.

The first was the extremely rich and publicly available information contained in the company’s annual report and website which included extensive detail on the corporate governance and control structures in place at Tests. The second source was personal interviews with the head of internal audit and the head of international audit, at the company headquarters in Chunter. The interviews offered further insights into the company’s design of the risk management and internal audit functions, thereby both verifying ND expanding upon the material already collected from the public domain.

The use of case studies in accounting research has been the subject of extensive coverage in the academic literature (Berry and Outlet, 2004; Humphrey, 2001; Outlet and Berry, 1994; Escapes, 1990) and it is now a widely accepted research method. 5 Risk management structures in Tests Pl 5. 1 Strategic planning and control: the balanced scorecard in Tests The corporate governance section of the Tests Pl annual report and financial statements, contains a brief outline of the planning and control structure used across the group.

The group has a five year rolling plan, categorized under revenue and capital expenditure headings, and this forms the basis for the creation of similar plans for each of the separate group businesses. Targets are set, and these are then monitored via the ‘steering wheel’ which is the under four separate headings of customers, operations, people and finance, which the company argues “is the best way to achieve results for our shareholders” and “allows the business to be operated and monitored on a balanced basis with due regard for all stakeholders” (Tests Annual Report, 2004, p. 0). The performance of the individual businesses against targets is reviewed quarterly by the Executive Committee, which is a sub division of the board comprising all executive directors plus the company secretary. The committee meets weekly and takes responsibility for the day to day management and control of the business. It is understood that targets within the separate businesses are set and monitored by line management and the steering wheel concept and performance against it is a familiar concept right down to individual store level.

Performance against targets is closely linked to enumeration at the level of the executive directors, and there is also a profit sharing scheme in place for all employees with more than one year’s service with the company. The executive bonus scheme offers a mix of both long and short term bonuses, which in combination can equal up to 150% of the executive’s annual salary, and payment is linked to the achievement of a mix of targets covering PEPS growth, total shareholder return, and the achievement of specific, but confidential, strategic goals.

Employees receive a profit share that is calculated pro rata to their base salary, p to the maximum EYE annual tax free limit set by the Inland Revenue. The strategic planning system is thus monitored and controlled via the use of a form of balanced scorecard, which assumes that good financial performance is the outcome of good performance in the areas of customers, operations and people.

This approach is very closely aligned with that of Kaplan and Norton, in so far as the cause and effect linkages are acknowledged via the remuneration system and as was noted in the interviews, “this allows the business to be operated with due regard for al stakeholders” (Head of International Audit). It would appear that the cycle is driven by paying very close attention to the customer’s needs, which if satisfied create a virtuous circle of improving results as shown below in Figure 1 .

This focus on the customer fits with the widely accepted principle that increased customer loyalty is the single most important driver of long term financial performance (Nortek, 2000). It may, however, be argued that this view might be limited to or especially applicable to fast moving consumer goods’ markets, such as Tests, where customers make frequent purchases. Starting with employees, investment in staff training and effective recruitment help to ensure low staff turnover rates and ongoing improvements in employee performance, which in turn feed through to better process management.

Equally, process improvements may raise employee performance levels, and so the cause and effect arrows flow in both directions. Efficient operations help to ensure that customer needs are met, and if customers are happy the financial targets will be achieved. Information feedback systems ensure that operational processes are fine tuned to respond to customer complaints ND so once again the cause and effect arrow flows in both directions.

The resulting higher profitability facilitates investment in better customer provision combined with increases in staff bonuses that hopefully reduce staff turnover rates. In this way the circle repeats itself and the controls and performance targets interact to add value impossible because of all of the intervening factors that may impact on performance, but the model suggests that Tests Pl have adopted and believe in a balanced scorecard approach to strategic performance management.

Figure 1 Cause and effect in the steering wheel 5. Linking strategy to risk management Ensuring that targets are met in terms of customers, people and processes does not necessarily mean, however, that risk is being managed. Consequently, there is a need to also ensure that risk management controls complement rather than conflict with the performance targets set within the steering wheel. The first way in which this is achieved is via a strategy:risk management control loop as portrayed in Figure 2.

The risk management standard produced by the Institute of Risk Management (2002) identifies three key elements in the risk management process, namely risk assessment, risk reporting and risk response (measures to reduce or modify risks), and all three elements form part of the control loop. Risk assessment comprises both the establishment of risk appetite and the identification of risks; risk reporting takes place following the risk monitoring by both line management and internal audit.

Risk responses and control mechanisms are the responsibility of line management and internal audit then independently monitors the risk systems established by management. Internal audit may also offer advice to line managers regarding deficiencies or potential improvements to risk controls. As Figure 2 shows, the corporate strategy that is determined by the Board of Directors is translated into a maximum acceptable level of risk, which is set in the light of their knowledge about market and shareholder requirements and the trade off between risk and return.

The risk appetite will also be influenced by the existing business mix and the known associated risks. Line managers, in conjunction with internal audit take responsibility for establishing a complete list of the risks that may be encountered across all businesses and designing the controls that will ensure compliance with the appetite bevel specified by the Board of Directors. The adequacy of the controls is then assessed by internal audit, whose staff use process mapping to compare exposure to risk against the Board’s desired risk appetite.

Figure 2 The strategy: risk management control loop The effectiveness of the controls at business unit level is monitored via performance measures overseen by the line managers, and the CEO of each business unit holds overall responsibility for risk performance. This operationally based risk management is complemented by risk based internal audit, with the audit programmer focusing on received ‘problem’ areas and new businesses where risks are less well understood – “we would audit on the basis of highest risk” (Head of International Audit).

The problem areas are identified via managerial experience and intuition rather than extensive use of sophisticated risk modeling – “at the end of the day it is people’s experience and how you feel” (Head of Internal Audit). This approach matches with were preferred to probabilistic measures of risk. Internal audit sees its role as threefold. Firstly, assisting in the identification of risks; secondly advising on the sign of appropriate controls, and finally using risk based audits to test the effectiveness of the risk control system(s).

The overarching aim is to raise awareness of the formal risk management processes. The degree of controls is closely linked to strategy, so that if investment in a new high risk area is required, then audit resources are diverted to monitor those risks to ensure the fulfillment of strategic aims. This fits with the findings of Slim and Menace (1999) who found that the assets, projects and processes that were deemed key to strategic objectives were entrant to the definition of the audit universe.

In addition, a key risk register is held at board level and a traffic light system used to categories risks, so that any key risks registering as amber or red will be brought to the attention of the board and/or the audit committee within a very short time frame. 5. 3 Communication lines for strategic and risk control In order for any organization to achieve its objectives in respect of strategy or control of risk, effective communication of the objectives across the organization is vital. The communication framework rivers to both support the achievement of objectives and operational the relevant controls.

In the case of Tests Pl, therefore, there is a need to design communication lines to ensure that all staff understand the group’s strategic Figure 3 portrays the lines of communication used within Tests Pl. The direction of the arrows indicates the direction of the flow of information, with upward arrows showing reporting lines, whilst downward arrows show the communication of objectives or priorities. In terms of strategic performance, staff report to the strategy director who, in the case of Tests, is also the finance director.

Risk issues are reported to the monitoring committees and internal audit. The non-executive position is represented by the audit committee, to whom the head of internal audit reports on a regular basis. In fact there is two way communication here, because the audit committee may also ‘drive’ internal audit via the expression of concerns over specific areas of business. Figure 3 Communication lines used for control of strategy and risk objectives as defined within the steering wheel, and also the relevance of both steering wheel and risk based performance measures to the attainment of those objectives.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services
in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

Risk management practices and problems of MSU- Marawi City towards catering services

Statement of the Problem

This study will deal with the risk management practices and problems among 5th street catering establishment. Specifically; it will answer the following questions:

1. What is the demographic profile of the MSU-Marawi City catering services in terms of: 1.1. Location of Business
1.2. Operating capital
1.3. Types of catering services offered
1.2. Personal
1.2. a. Age
1.2. b. Types of ownership
1.2. b. Income levels
2. Given the above respondents what are their risk management practices considering:
2.1. Health and safety risk
2.2. Contamination risk and spoilage
2.1. Financial risk
2.2. Packaging
2.2. a. Plastic/paper

3. What problems is catering services encounter:
3.1.
3.2.
3.3.

:Catering Services.Is the business of providing foodserviceat a remote site or a site like a hotel, public house (pub)and other various locations.Contributing Factors. The term refers to the differentterms that affect the operation of the catering services,how it will improve or can attract customers. 8 9. Lay-out and Designs. The term refers to the differentphysical arrangement of the business in which customersfeel at ease when they are in the location.Market Research.It refers to the study of the possiblepeople who will obtain services of the catering services inthe area.Menu Composition.The term refers to the kind of foods thatwill be offered to the customer in which it will be afactor to attract them.Profile.It refers to the distinct characteristics of theowner of catering services like ages and gender in whichresearchers believe has bearing in the present study. 9 10. Chapter II REVIEW OF RELATED LITERATURE AND STUDIES This chapter presents the review of related literatureand studies which is relevant to the present study.Foreign Literature The catering business is tough, with the details ofpreparing food off-premises and on-site for hundreds ofpeople often times mind-boggling. It is not easy to caterto an event of 400 people, much more if people start to dothousands, some 60 miles from your home (what if you forgetthe sauce?). Successfully running a small catering businesstakes much more than a passion for cooking and a knack forpreparing tasty dishes. You have to be a superb planner andmanager as well. they need to be extremely organized, yetflexible enough to be able to deal with last minutechanges. You also need a strong affinity for people and akind of intuition as to what people enjoy in differentenvironmental settings. As the culinary sophistication and desire to beentertained of many people have grown, customers today arelooking for the catered experience to be more restaurant-like. Many caterers are now offering signature dishes and 10 11. house specialties as customers broaden their culinaryexperience. Others are offering family-style menu,especially for large informal functions and even corporatemeetings. Caterers today have to be adept not only in satisfyingthe taste buds but also excel in food preparation. Withthe goal of wowing the socks off the clients, many caterersgive ample focus on plate presentations, venue selection,and table decoration, among others. Some even hire artiststo improve the presentation of the food, while some go tosuch lengths as indoor pyrotechnics, confetti
guns andlaser-light shows. Others employ in-house artists tocustomize each catered event from passing platters to platepresentations. Given the intense competition, caterersnowadays are prepared to do anything to keep the customerhappy (and coming back for more). You do not need special education or training tobecome a successful caterer. Although taking some coursesat culinary institutes or vocational schools can help. Somestart out by working for one or more catering businesses toget an inside look at how the business goes. As with any business, your success will be directlyrelated to the soundness of planning and the working ofthat plan. Start small and keep it simple. Understand 11 12. exactly what your client wants, and give him what he wantsin the way of service that reflects upon the client in acomplimentary manner. Many people dream of running a successful cateringbusiness. They imagine preparing delicious food forappreciative people, building up a steady clientele.Running a catering business takes a lot of work, too –thus, as with any small business, the owner will enjoy moresuccess if she has the ability to think creatively, workindependently, and network widely. Some caterers choose to specialize in a particularmenu or type of function. The business owner must ensurethe local area has a demand for this type of food. Asuccessful business owner does his home work beforepreparing the menu. This includes getting copies of menusfrom successful businesses to find out whats popular, anddeciding on the target audience, as Joyce Wineberg says inher book “The Everything Guide to Starting and Running aCatering Business.” The business owner should also includehis specialties in the menu and keep a running log ofideas, so he can update the menu occasionally, she adds –offering seasonal choices like cold soup in summer, forinstance, is key to success. 12

Risk and value management are processes that are fundamental to the successful delivery of a project. They should be used in every stage of the project lifecycle from concept through to closure. In practice, value management exercises are carried out first, to determine exactly what constitutes value to the business from delivery of the project. A preferred option is identified, together with the risks that are likely to occur if that option was implemented. The project team should repeat the exercises of defining value and associated risks until they arrive at the optimum balance of value and risk.1

The aim of this document is to discuss Risk and Value Management, the linkages between them and then apply the theory to the scenario in order to supply a report detailing the best approach to the project and an initial view of risks. This document will provide both a value and risk management study in order to identify the best approach to the project and an initial view of risks.

Value Management

Literature Review

Value Management was created by Larry Miles and other members of the purchasing team at General Electric (GEC) in 1947 when it was referred to as Value Analysis. The concept was developed in response to the question, “How had companies managed to innovate during World War II?” This question was asked because during the war key materials had been rationed and yet many companies had improved their products and services. However, when the war ended few companies continued to use the innovative processes that helped overcome war time shortages. Miles brief was to understand how they had been so successful. However, he went beyond the brief and presented a model based on the idea that “All cost is for function” and argued that customers in fact buy functions which are experienced through products and services.

In less than 10 years after Larry Miles created Value Analysis at General Electricity the concept had become more widespread, with the US Navy Bureau of Ships setting up a formal value analysis programme in 1954. However, the US department of Defence didn’t advertise vacancies for value analysts, but for value engineers and therefore the term Value Engineering (VE) was born and in 1958 the Society of American Value Engineers (SAVE) was established. Although the use of value analysis was becoming very popular in the United States it was not to be seen in the UK for another 30 years when the American company Xerox started using the technique in their UK headquarters in 1983.

A function is something that a product or service “does” for someone who uses it, and is something they need. When looking at products or projects in terms of functions it helps provide the project team with more creative focus. This is because the team no longer focuses primarily on the mechanical explanation of the product, but instead focuses on what the product does for the customer.

Perhaps one of the most important phases of value management is “Function Analysis”. Function Analysis helps to overcome communication problems by providing a good platform to build creative thinking on. Function Analysis is done by asking questions such as: In 1968 Charles Blythway developed an approach to function analysis called “Function Analysis System Technique” (FAST). This approach helped to identify and link all the functions of a more complex system or product. This technique involves creating a diagram that moves from right to left asking the question “Why?” and moves from left to right answering the question “How?”, which helps test the logic of the links.

The term value management (VM) is very vague and according to Smith (2008)6 covers all value techniques such as value planning (VP), value engineering (VE) and value analysis (VA). There are no strict universally accepted definitions for value management and its related sub groups as value management is a very diverse topic which changes in response to the situation and context of which it is being used. However, it is possible to get a good idea on what value management is by looking at some of the many definitions on offer.

The Institute of Value Management (IVM) defines Value Management on its website as “a structured and disciplined approach that ensures the correct balance of performance, cost, and delivery is in place to meet the market requirements and business need” (IVM, 2000). Although this is an accepted definition it contains no real distinguishing features that separate VM from other management tools and techniques.

Kaufman (1998, p.1) describes value management as: “more than a tool or technique for reducing product cost. Over the last fifty plus years VM has matured into a methodology that employs a set of disciplines proven to solve a broad range of management issues successfully and dramatically to create competitive advantage for the company”. This definition supports the fact that there is a difference between cost and value. Cost is only one factor to take into consideration when making decisions however it usually isn’t the only one.

Value management is the title given to the full range of value techniques; which include: Value Engineering (VE)- This is the title given to the value techniques concerned with the achievement of necessary functions using minimum resource without detriment to quality, reliability, performance or delivery (Smith, 2008).

Value Analysis (VA)

This is the title given to the value techniques applied retrospectively to completed projects to analyse the projects performance against predetermined expectations. The terms VE and VA are very similar and in a lot of Value studies the terms are used interchangeably, therefore to avoid confusion some practitioners just use the term Value Management to cover all applications. A simple illustration of the application of VM, VE and VA to a project might be8:

Value Management

The decision to invest; do we need a project? The project concept and scope, what form of project de we need? The outline design and what should be the major elements?

Value Engineering

Project design and design of project elements Value Analysis – Improvement of a construction, manufacturing or management process and post project review.

Corning Inc., established about 150 years back, is a diversified technological company having three broadly defined operating segments: Telecommunications, Advanced Materials and Information Display. Headquartered in New York, Corning had revenue of $4.6 billion and net income of around $520 million in 1999. The telecommunication Division accounted for around 70% of the total revenues. Corning was the world’s largest manufacturer of optical fiber and amplifiers, with a market share of 50%.

Within the telecommunication division the Photonics business was growing at triple digit annually. The non-telecommunication divisions were also performing at impressive rates. As well, Corning was also the largest producer of flat glass panel for LCDs and had a 60% world market share. In addition Corning’s biotechnology related products were experiencing a healthy demand and this sector was expected to see a steady growth during the next few years. At the time of offering the worldwide market for optical fiber was in a sold out stage and Corning had pre-sold the next 18 months of its entire fiber manufacturing capacity. The demand for Photonics products was also increasing and Corning responded by expanding the capacity for Photonics six fold over the next 18 months.

Corning Inc. shares were currently trading at $71.25 which was around 94 times 200 earnings and 75 times projected 2001 earnings compared to an average of 30 times for S&P 500. Lately, Corning was considering acquisition of Pirelli S.P.A.’s 90% interest in Optical Technologies, Pirelli’s optical components and devices business. In order to finance the acquisition Corning was issuing $2.7 billion in zero coupon convertible debentures priced at $741.923 per $1000 principal amount. Corning was also conducting a separate public offering of 30 million shares of its common stock at $71.25 a share.

Strengths and Weaknesses of the firm Strengths: 1) They own 50% of the optical fiber market, twice that of its nearest competitor 2) They own 60% of the world’s market share of LCD 3) Access to man power, technology and capital, which represent barrier to entry 4) Corning is well diversified in several market segments 5) Shock price went from a low of $10.40 to a high of $113.30 in six years 6) Current Debt-to-Equity ratio is low at 26.2% Weaknesses: 1) 70% of their revenues come from one particular segment: telecommunication, where their customer base is restricted to few key players in the industry. Any adverse relation with anyone of these players, may affect the performance of Corning significantly

2) Beta has increased from 0.87 to 1.53 in six years 3) Stock price is overvalued “past month has been 94 times estimated 2000 earnings and 75 times estimated 2001 earnings, compared with an average of around 30 times for the S & P 500. 4) Low credit rating, bonds have to be sold at a discount Major Issues The market for the products manufactured by Corning depends largely on the telecom service providers and their customer base seems to be highly concentrated. If Corning looses a major customer in this segment its sales will be affected badly. Moreover the telecom division is heavily dependent on the capital spending and the ability of the service providers to raise and invest capital in the infrastructure development. Any downturn in the industry will severely affect the performance of Corning.

Although Corning considered otherwise but many industry experts felt that an excess in fiber capacity was emerging in the optical fiber industry. In spite of such warnings Corning is investing heavily in developing additional capacity. If the actual downturn occurs before the gestation period of Corning’s investments the company will loose large amounts of money. Moreover, an overcapacity in the industry will lead Corning to face pricing pressure further reducing its margins.

The telecom division of Corning grew during the last couple of years on the basis of expansion by the major US carriers like MCI, Sprint, AT&T, and their customer base was largely restricted to these few key players. Now the major investment in this sector in the US was likely to slow down which would result an overcapacity of Corning in its manufacturing units. In order to overcome this Corning has to shift its focus to overseas markets. Although the overseas markets were expected to be strong, the overseas service providers were much smaller compared to their US counterparts and were considered riskier.

Finally, the market for Corning’s products was characterized by rapidly changing technologies, evolving industry standards and frequent new product introductions. Corning’s success was heavily dependent on the timely and successful introduction of new products, upgrades of current products to comply with emerging industry standards and ability to address competing technologies and products. If this is not achieved it could have a negative impact on the company’s performance.

In addition to selling debentures, Corning is going to be issuing 30 million shares, which means Corning is chasing after the same investment dollar. This is primarily done by Corning to reduce the cost of capital by providing an increased upside to debt holders. In the past year, the volatility of Corning stock has increased which makes the call option more valuable. But Corning appears to be issuing converts at a time when both its share price and stock market valuations are at historic highs.

Hlstorlcal background, overall objectives, political climate, and pre- feasibility studies. 2-Development-Overall planning, feasibility studies, financing, and conceptual design, 3-1mplementation-Detail design, construction, installation, testing, and commissioning. 4-Closeout-RefIection on overall performance, settlement of claims, financial status, and post-project evaluation. 1974- Initial tunnel ideas gather but abandoned. 1978-British & French discussions resumed. 83-Frensh & British banks & contractors propose tunnel scheme. 1984 British and French agree to common safety, environmental, and security concerns. 1. Please complete your evaluation of project management during this phase, using the following grid: Project Management Area Closeout Phase Scope Management Time Management Cost Management Quality Management HR Management Communication Management Risk Management Procurement Management Integration Management 2.

Please highlight the major areas of strength In the management of this phase of he project: Scope Management 2 Communication Mangement 2. Please highlight the major areas of strength in the management of this phase of tOf2 the following grid: Project Management Area Time Management 3 Quality Management 4 HR Management 2 Communication Management2 Risk Management 2 Integration Management 3 Closeout Phase the project: 1. Please complete your evaluation of project management during this phase, using the following grid: Project Management Area Closeout Phase

Celem niniejszej pracy jest zaprezentowanie roli i znaczenia Planu Ciaglosci Funkcjonowania Przedsiebiorstwa w calosciowym procesie zarzadzania ryzykiem w firmie oraz przedstawienie przykladowej tresci takiego planu.

Rozdzial pierwszy zawiera ogolne wprowadzenie do zagadnienia zarzadzania ryzykiem. Przedstawia on definicje ryzyka w sensie, w jakim jest ono rozumiane w niniejszej pracy. Ponadto, znajduje sie w nim opis wielorakich zagroSen, ktore sa zwiazane z funkcjonowaniem przedsiebiorstwa, a takSe lista metod sluSacych do pomiaru ryzyka oraz opis przykladowych postaw, jakie sa przybierane wobec zagroSen. W rozdziale drugim zaprezentowano pojecie Zarzadzania Ciagloscia Funkcjonowania Przedsiebiorstwa. Znajduje sie tu charakterystyka ewolucji tego zagadnienia oraz wyjasnienie, dlaczego Plan Ciaglosci Funkcjonowania

Przedsiebiorstwa jest dokumentem o ogromnym znaczeniu dla firmy i jej interesariuszy. Ponadto, w rozdziale tym poddano dyskusji pewne szeroko rozpowszechnione mity dotyczace Zarzadzania Ciagloscia Fukncjonowania Przedsiebiorstwa. Ta czesc pracy konczy sie opisem Analizy Wplywu na Przedsiebiorstwo jako glownego narzedzia, ktorym posluguje sie opisywany typ zarzadzania. W rozdziale trzecim przedstawiono rezultaty dokonanej przez autorke analizy roSnych Planow Ciaglosci Funkcjonowania Przedsiebiorstwa i ich szablonow.

To studium bylo podstawa do zaprezentowania przykladowej struktury Planu oraz opisu najczesciej spotykanych w nim bledow. Ostatni rozdzial zawiera takSe charakterystyke faz wprowadzania i testowania Planu, ktore sa rownie waSne jak etap jego przygotowania. Wspolczesne przedsiebiorstwa nie moga sobie pozwolic na postawe reaktywna wobec realnych zagroSen, gdyS wydarzenia bedace w stanie zaklocic ich funkcjonowanie sa liczne i moga zaistniec zarowno w wewnetrznym, jak i zawnetrznym srodowisku firmy. Profesjonalnie przygotowany i skrupulatnie 5 aktualniany Plan Ciaglosci Funkcjonowania Przedsiebiorstwa cechuje postawe proaktywna. Jest nie tylko ogromnie pomocny w przezwycieSaniu trudnosci, ale dla interesariuszy firmy stanowi takSe dowod jej wiarygodnosci. MoSna wiec oczekiwac, Se coraz wiecej przedsiebiorstw bedzie sie staralo zdobyc ten nieoceniony atut. 6 ABSTRACT The aim of this thesis is to present the role and significance of a Business Continuity Plan (BCP) in the holistic process of a company’s Risk Management, and to provide a characteristic of exemplary BCP contents. The first chapter contains a general introduction into Risk Management.

It delivers the definition of risk as it is understood in the context of the present thesis. Moreover, there is a description of multiple risks which are relevant to a company’s activity, as well as a list of the risk measurement methods and an account of exemplary attitudes towards threats. The second chapter presents the question of Business Continuity Management (BCM). It characterizes the evolution of this concept and explains the reasons why the BCP is a document of utmost importance to the company and its stakeholders. What is more, certain wide-spread myths concerning BCM are also disputed there.

This part of the thesis ends with a description of Business Impact Analysis as the main tool of Business Continuity Management. The third chapter provides the results of the author’s analysis of various Business Continuity Plans and their templates. That study has been the basis for the presentation of an exemplary structure of a Business Continuity Plan, as well as for the description of the most frequent mistakes which occur in BCPs. The last chapter also contains a characterization of implementation and testing phases which are as significant as the preparation of a Business Continuity Plan.

Modern companies cannot afford a reactive stance towards possible threats as the dangers which may disrupt their functioning are multiple and come both from the inner and outer environment. A professionally prepared and carefully updated Business Continuity Plan characterizes a proactive attitude. Not only does it significantly help to overcome difficulties, but it is also a convincing proof of the firm’s reliability to all its stakeholders. Therefore, it may be expected that more and more companies will attempt to acquire this invaluable asset. 7 INTRODUCTION

The present thesis is the result of the author’s interest in various aspects of Risk Management, especially in the procedures which are applied by companies in case their functioning is faced with a serious threat. The most effective method used by business units is called Business Continuity Management (BCM) and focuses on the preparation and implementation of a Business Continuity Plan (BCP). The aim of this thesis is to present the role and significance of a Business Continuity Plan in the holistic process of a company’s Risk Management, and to characterize the contents of an exemplary Plan.

The first chapter contains a general introduction into Risk Management and includes, inter alia, a description of multiple threats which are relevant to the company’s activity and a list of risk measurement methods. The second chapter discusses the concept of Business Continuity Management, explains the importance of Business Continuity Plan and characterizes the steps which lead to the development and implementation of this document. In the third chapter, there is a description of the contents which should be included in a Business Continuity Plan.

That presentation is based on the author’s analysis of various BCPs and their templates. The exemplary materials enclosed in appendices have been provided by Punk, Ziegel & Company, Business Link, London Borough and Wallsal Council. All the translations which are enclosed in the present thesis have been made by the author. The references have been edited in accordance with the traditional Footnote/Endnote System. 8 CHAPTER 1 RISK MANAGEMENT This chapter contains an introduction into the nature and types of risk, as well as a description of the methods by which risk is assessed and managed.

All these issues are inseparably connected with the concept of Business Continuity Plan, which aims at making provisions for the whole spectrum of present and future threats that may put a company’s proper activity into danger. When a company decides to prepare and implement such a plan, it has to carry out a complex and accurate analysis of all the factors which may influence its operation, so that even the least expected dangers are taken into consideration. The first phase of drafting a BCP requires the recognition of existing and prospective risks, evaluation of their possible impacts and assumption of particular attitudes towards them.

These vital steps are covered by Risk Management, which helps to organize the findings and solutions in a logical way. The proactive nature and principles of this comprehensive process will be presented and explained in the following chapter. 1. 1. The Definition of Risk Risk and uncertainty are inseparable parts of every aspect of life. As Jan Mikolaj writes, “risk is connected with human activity, while uncertainty applies to the environment. ”1 When these terms are used in the scientific context, they must be precisely defined.

Some of the authors of economic and financial literature do not stress the difference between them. For example, Allan Willet states that “risk is objective uncertainty of the occurrence of an undesirable event. ”2 In his opinion, “risk changes in accordance with uncertainty, not with probability level. ”3 Similarly, Joseph Sinkey defines risk as “uncertainty connected with some occurrence or profit 1 2 Jan Mikolaj, Risk Management, (RVS FSI ZU, Zilina 2001), p. 17. Allan Willet, The Economic Theory of Risk Insurance, (Philadelphia 1951), p. . 9 in the future. ”4 Frank Reilly thinks that “risk is the uncertainty that the investment may not bring the expected return. ”5 However, the prevailing trend in modern professional literature is to differentiate between them. According to the Dictionary of Economic and Financial Terminology by Bernard and Colli, risk is “the probability of incurring losses by a business unit as a consequence of making a certain economic decision by this unit. The probability results from the uncertainty of the future. 6 The same source states further that “the concept of uncertainty is used in the situation when calculus of probability cannot be applied, whereas the term risk concerns recurrent events which possibility of occurrence can be calculated using the calculus of possibility. ”7 Similar classification is introduced by Frank Knight. In his opinion, risk is a “measurable uncertainty,”8 while “immeasurable uncertainty”9 is uncertainty sense stricto. According to Irving Pfeffer, “risk is the combination of hazard and is measurable by probability mathematics, whereas uncertainty is measured by the level of confidence.

Risk is a state of the world while uncertainty is a state of mind. ”10 To summarize, risk means “a condition in which there exists a possibility of deviation from an outcome that is expected or hoped for. ”11 Risk “can be expressed as a probability, ranging from 0 to 100 percent. ”12 What is important, although not often mentioned in professional literature, there is not only the negative aspect of risk, but also the positive one. Thus, it is a possibility of loss as well as gain. 3 4 ibid. Joseph Sinkey, Commercial Bank Financial Management, (New York: Macmillan Publishing Co. 1992), p. 391. 5 Frank Reilly, Investments, The Dryden Press, (London: Intenational Edition, Collins, 1988), p. 463 6 Bernard and Colli, Slownik ekonomiczny i finansowy, (Wydawnictwo “KsiaSnica”, 1995), p. 156. 7 ibid. , p. 157. 8 Frank Knight, Risk, Uncertainty and Profit, (Boston: University of Boston Press, 1921), p. 233. 9 ibid. 10 Irving Pfeffer, Insurance and Economic Theory, (Illinois: Irvin Inc. Homewood, 1956), p. 42. 11 Reto Gallati, Risk Management and Capital Adequacy, (New York: Mc Graw Hill, 2003), p. 7. 12 ibid. , p. 8. 10 1. 2. Risk in Business Activity

The volume and diversity of risk obviously depend on a company’s type and branch of economy, but risk as such is a phenomenon which accompanies in its versatile forms any kind and field of business activity. It may come from the external environment of a company as well as from the internal one. For some entrepreneurs, risk is a necessary evil, whereas for others it is an additional motivation, if not the main one. Whatever the point of view is, if a given business activity is to succeed, it is essential to recognize what are the kinds of possible risk, asses their possible impact and acknowledge ways of reacting towards them.

Such identification will considerably help in developing a suitable attitude, which allows minimizing a potential loss and maximizing a gain. 1. 2. 1. Types of Risk Types of risk which threaten a company’s activity are complex and numerous. Classifications of risk provided by professional literature differ with regard to the assumed criteria. The following comprehensive categorization is based mainly on the division presented in the book Risk Management in Emerging Markets.

How to Survive and Prosper by Carl Olsson13: • business risk (also called strategic risk) concerns potential results of inappropriate strategies, inadequate allocation of resources and changes in economic or competitive environment; • market risk is associated with potential results of changes in market prices. It can be divided into: – interest rate risk, –foreign exchange risk, – commodity price risk, Carl Olsson, Risk Management in Emerging Markets. How to Survive and Prosper, (London, Pearson Education United, 2002), pp. 35-36. 13 11 shares price risk; • • • • • • • • • • • • • • credit risk means that a debtor may not pay in due time; industry risk regards operating in a particular industry; liquidity risk applies to inability to pay debts because of the lack of available funds; operational risk means potential results of actions by people, processes, and infrastructure; accounting risk concerns a possibility of financial accounts not being in accordance with the reality; reputation risk regards the results of changes in a company’s reputation; country risk is associated with effects which the mother ountry’s and foreign countries’ economic policies may have over the company; sovereign risk applies to lending money to the government or a party guaranteed by the government; political risk means results of changes in political environment; legal/regulatory risk is associated with the consequences of non-compliance with legal or regulatory requirements; environmental/ecological risk applies to the changes in natural environment which affect a company; systemic risk concerns small events which may produce much larges results than expected; technological risk is associated with the consequences of bringing new technology products to the market and introducing new IT systems; natural risk concerns natural and space disasters. All these risks usually appear simultaneously and their effects are synergic. Therefore, none of them should be ignored when considering the company’s situation. After realizing the large number and complex nature of different types of risk involved in all aspects of business activity, a logical step is to try to estimate their potential impact and results. 12 1. 2. 2. Methods of Risk Evaluation An assessment of a particular risk, both internally- and externally-driven, allows taking an appropriate attitude towards it.

As Andrzej Stanislaw Barczak writes, such a measurement involves both subjective and objective elements. 14 The subjective component consists in assuming a priori particular stipulations of a given evaluation tactic, as well as interpreting obtained results in a specific way. The objective constituent derives from the common agreement of the business circle on the methods widely applied to the assessment of risk. Two main types of risk measurement tactics are quantitative risk assessment and qualitative risk assessment. 1. 2. 2. 1. Quantitative Risk Assessment The main conception of quantitative risk assessment is to determine the cost of a given unwelcome occurrence, i. e. o calculate how big the loss would be if an adverse event happened. As it is pointed out in The Security Risk Management Guide, “it is important to quantify the real possibility of a risk and how much damage, in monetary terms, the threat may cause in order to be able to know how much can be spent to protect against the potential consequence of the threat. ”15 This method involves: • evaluation of assets (determining the overall value of a company’s assets, the immediate financial impact of losing the asset and the indirect value of losing the asset); • measurement of the Single Loss Expectancy (SLE), which means “the total amount of revenue that is lost from a single occurrence of the risk. 16 It is calculated by “multiplying the asset value by the exposure factor (EF). The 14 Andrzej Stanislaw Barczak, Ryzyko – kategoria obiektywna czy subiektywna? , (Poznan: WSB, 2000), s. 30. 15 Microsoft, The Security Risk Management Guide, (Microsoft Corporation, 2004), p. 19. 16 ibid. , p. 18. 13 exposure factor represents the percentage of loss that a realized threat could have on a certain asset. ”17 • assessment of the Annual Rate of Occurrence (ARO), which is “the number of times that one can reasonably expect the risk to occur during one year. ”18 This step is very difficult; it bases on historical data and previous experiences, and requires consultation with experts. calculation of the Annual Loss Expectancy (ALE), which stands for “the total amount of money that an organization will lose in one year if nothing is done to mitigate the risk. ”19 This figure is established by multiplying the SLE and the ARO. • valuation of the Cost of Controls (ROSI), i. e. establishing “accurate estimates on how much acquiring, testing, deploying, operating, and maintaining each control would cost. “20 It is estimated by using the following equation: (ALE before control) – (ALE after control) – (annual cost of control) = ROSI Although quantitative risk analysis provides clearly defined goals and results, all of the involved calculations are based on subjective estimates, which may prove inaccurate. Moreover, the whole process can be long and costly. 1. 2. 2. 2. Qualitative Risk Assessment

In opposition to the quantitative method, qualitative risk assessment does not “assign hard financial values to assets, expected losses, and cost of controls”21 but instead, 17 18 ibid. , p. 19. ibid. , p. 19. 19 ibid. , p. 19. 20 ibid. , p. 19. 21 ibid. , p. 20. 14 “calculates relative values. ”22 It involves distribution of questionnaires among people in the company who have relevant skills and knowledge, and workshops. The questionnaires are designed to discover what assets and controls are already deployed, and the information gathered can be very helpful during the workshops that follow. In the workshops participants identify assets and estimate their relative values.

Next they try to figure out what threats each asset may be facing, and then they try to imagine what types of vulnerabilities those threats might exploit in the future. The information security experts and the system administrators typically come up with controls to mitigate the risks for the group to consider and the approximate cost of each control. Finally, the results are presented to management for consideration during a cost-benefit analysis. 23 This tactic does not require a lot of time and it is not a big burden for the people involved. What is more, the results of the implemented solutions are quickly visible. However, the estimated figures are often perceived as too vague.

These two presented approaches are often used together in order to obtain the most comprehensive information about a potential threat. Although scientific methods of risk assessment are helpful in estimating the possible impact which particular occurrences may have on the company’s activity, it is essential to remember that none of the methods can be perceived as 100% trustworthy and absolutely infallible. However, even if it is impossible to predict all threats and provide for all undesirable events, the significance of risk evaluation tactics combined with human knowledge, experience, imagination and intuition cannot be questioned. 1. 3. Risk Management in Business Activity

The fact that the phenomenon called risk is measurable and its occurrence may be predicted means that it is also possible to take preventive measures and proactive attitude towards it. As Reto Gallati stresses, “the term Risk Management is a recent creation, but the actual practice of risk management is as old as civilization itself. ”24 In everyday life, people face risk in a varying degree all the time and they manage it in a natural way so as to minimize undesired impact and render possible profits. 22 23 ibid. , p. 20. ibid. , p. 20. 15 Certain individuals even enjoy plunging into extraordinarily dangerous situations in order to check how they will cope in difficult moments.

However, Andrew Holmes notices that “at the individual level, if a person takes a risk and fails to manage it properly, the damage is limited to him, and maybe his near relatives,”25 while “the management of risk for organizations is not as simple. ”26 As it was presented in the part 1. 2. 1, the company is a subject to various and multiple threats. Holmes stresses that “ultimately, all risks have a financial impact. ”27 The complexity of the required actions aimed at coping with the risk means that “within the modern corporation, risk management must encapsulate managing strategic, business, operational, and technical risks, rather than those associated with pure finance such as credit, interest rate, and currency risk. ”28 Nowadays, Risk Management is not an extra feature added to a company’s basic activity, but “an essential skill of all modern corporations. ”29 All usiness units should realize its great importance, because it is essential not only for their success but simply survival. According to Holmes, a company’s attitude towards the risk depends on its risk sophistication, which can be divided into five stages30: • at the lowest level of sophistication (reactive stance), risks are dealt with only when they turn into live issues or when crisis strikes. There is no effort to recognize and measure possible risks in advance. • At a slightly more sophisticated stage, a company understands the importance of risk management and takes the trouble to identify and manage threats more actively. It tends to seek out the best practice and views adverse events in a wide context. At the next level, there are organizations which acknowledge the need to manage risks throughout the organization and usually develop some form of 24 25 Reto Gallati, Risk Management and Capital Adequacy, (New York: McGraw Hill, 2003), p 11. Andrew Holmes, Risk Management (Oxford: Capstone Publishing, 2002), p. 2. 26 ibid. 27 ibid. 28 ibid. 29 ibid. 30 ibid. , p. 8. 16 risk management framework to ensure consistency of approach. • At the following stage, a company understands the link between risk and reward. It is aware that for every risk there is an associated opportunity which can be exploited. Such a business unit is often a market leader and is willing to take risks to achieve its strategic objectives. At the ultimate level of risk sophistication, there are organizations which integrate risk management with the goal of enhancing shareholder value. Thus, they shift the responsibility for risk management away from the traditional areas of audit and compliance to everyone within the organization. Of course, the active process of Risk Management requires commitment and focus as it means following a deliberate set of actions which are designed to identify, quantify, manage and then monitor the events or actions that could lead to financial loss. Often, there is too little data about a given risk, and therefore, this kind of management may involve a large degree of judgment and assumptions concerning the future. 1 Yet, all the effort is worthwhile as “successful organizations tend to be excellent risk managers, not only because they understand the risks they face, but also because of how they manage them. Conversely, those organizations that are poor at risk management spend no time scanning the risk horizon, instead leaving their futures to fate. This invariably means shocks, falling market share, takeovers and missed opportunities. ”32 As Holmes reflects, “risk management is both an art and a science, and being successful depends on how well the two are kept in balance. ”33 1. 3. 1. Methods of Risk Management John Holliwell, the managing director of Smith Williamson Consultancy, once said, “There is nothing wrong with risk.

It is the lifeblood of business and the test of entrepreneurs and managers. What matters is how you handle risk and the culture in 31 32 ibid. ibid. 17 which you operate. ’’34 A similar thought is expressed by Clifford Tijok, “Entrepreneurial behaviour demonstrated in real life entails, i. a. , the ability to enter into calculated risk, so that return-driven opportunities can be pursued and the ability to identify the relevant risks associated with these opportunities and the decision on appropriate behaviour to address these risks. ”35 When a company decides on its risk management techniques, it usually analyses the following features: Table 1. Factors influencing the type of risk management framework required by the organization36ors the type of risk managementframework required by an organizatio FACTORS INFLUENCING RISK MANAGEMENT REQUIREMENT DIMENSIONS TO CONSIDER Strategy risk appetite of owners/risk managers industry geographical coverage aggressive or conservative risk taking or risk averse sunrise or sunset industry; primary, manufacturing, service sector local, national, regional or global is the company critically dependent on critical success factors one or two factors which require close management? volatility is the environment likely to change significantly or unpredictability? monopoly, few or limited number of osition in industry players, or free market with many players and no barriers to entry is the area of operations highly controlled by regulatory environment legislation and/or regulatory bodies? are regulators intrusive or hands off? 33 34 ibid. ibid. , p. 2. 35 Clifford Tijok, Risk Management in Finance, (Lehrverangstaltung, 2005), p. 8. 36 Carl Olsson, Risk Management in Emerging Markets… pp. 110-111. 18 is deregulation occurring or the level of regulation increasing? management style centralized or decentralized adequate or inadequate people and resources technology resources, financial position – adequate funds available, highly or lowly geared. tatus/ownership Organizational culture Public or privately owned Is the culture strong or weak? are they simple and predictable or nature of risks faced complex/ unpredictable? is the size of risks manageable or is catastrophic risk a cause for concern? Such an analysis leads to adopting one of the main risk management techniques, as presented by Cliff Tijok37: • • • risk limitation – a company establishes its range of tolerance towards a given risk and constantly monitors whether the limits are not breached; risk avoidance – a company chooses the least risky option or none of them; risk transfer – a company reduces or completely transfers specific risks by hedging against a risk (i. e. , obtaining insurance) or diversification.

Whatever the approach is, managing risks “takes a degree of courage and requires the organization to take responsibility for its actions. ”38 It is a continuous process, which is “based on a distinct philosophy and follows a well-defined sequence of steps. ”39 After the application of the methods and rules provided by risk management, the obtained data are organized in a clear and logical way. This is the basis which allows the company to go one level up and prepare action schedules that will be used in case a recognized danger occurs. An essential part of such planning is encompassed by Business Continuity Management and will be discussed in the next chapter. 37 38 Cliff Tijok, Risk Management… pp. 12-13. Andrew Holmes, Risk Management… p. 2. 39 Reto Gallati, Risk Management… p. 11. 19 CHAPTER 2 BUSINESS CONTINUITY MANAGEMENT This chapter provides information on what is Business Continuity Management, when it appeared in the history of management, what purposes it serves and how it should be organized and introduced into a company’s activity. Moreover, it contains a description of the steps which lead to the preparation of a Business Continuity Plan and of the implementation process that follows. Business Continuity Management forms an integral part of Risk Management. It met with particularly deep interest in the 1990s as the result of the frenzy which concerned the year 2000.

At that time, there were many anticipated business continuity problems, implicated by the date change in computer systems. Business Continuity Management became even a bigger focus of attention in 2001, after the terrorist attack in New York. As Michael Gallagher observes, that huge calamity “increased awareness of business interruption issues, resulted in a better understanding of critical processes and vulnerabilities and improved co-operation and collaboration between public and private sectors on emergency management questions. ”40 Lyndon Bird adds that “‘business today has far more economic interdependency between regions than ever before. There are often global consequences when risk becomes reality. 41 Yet, at the same time “there is a growing awareness of what business continuity really is about and why it is so important to both businesses and individuals. ”42 8 2. 1. The Concept of Business Continuity Management Business Continuity Management (also called BCM) is defined by the Business Continuity Institute as “a holistic management process which identifies potential Michael Gallagher, Business Continuity Management, (Edinburgh: Pearson Education Limited, 2003), p. 7 41 Lyndon Byrd, “Business Continuity Management in a shrinking world,” Business Continuity & Risk Management (a supplement distributed in The Times), July 26 2006, p. 2 40 20 mpacts that threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. ” Its main purpose is to enable the company’s regular functioning, even though everyday operations are disrupted. As Lorraine Lane observes, “organizations must be capable of withstanding the shocks that can so easily distract management from their primary purpose of meeting and beating their ‘normal’ operational goals. ”43 BCM appears as the solution that is exactly needed to guarantee such stability to the business. Obviously, BCM looks different in various companies as each organization is a unique system of multiple factors and interdependencies.

Dr David Smith explains that “because of its all-embracing nature, the way BCM is carried out will inevitably be dependent upon, and must reflect, the nature, scale and complexity of an organization’s risk profile, risk appetite and the environment in which it operates. ”44 Gallagher supports this view by stating that “the plan must fit comfortably with the culture and management style of the organization. For example, the type of plan that suits a financial institution would be totally inappropriate in a radio or television broadcasting organization. ”45 It is also very important to acknowledge that the company’s BCM must be continuously revised and tested, in order to stay valid and fulfill its tasks. As Dr Smith emphasizes, “BCM is, by necessity, a dynamic, proactive and ongoing process. It must be kept up-to-date and fit-for-purpose to be effective. 46 Maintaining the validity of proper plans and policies is actually more difficult than establishing them, but this is what constitutes the point of developing BCM by a business. On the following page, there is an approximate structure of steps involved in Business Continuity Management, which is focused on planning. 42 43 ibid. “Corporate resilience: the new regime,” Business Continuity & Risk Management,…, p. 11 44 David Smith, “Business continuity and crisis management,” Management Quarterly, July 2003, p. 27 45 Michael Gallagher, Business Continuity Management,…, p. 43 46 ibid. 21 Scheme 2. 1. Procedures involved in Business Continuity Management47 INPUTS 1. 2. 3. 4. 5. 6. scope definition desired objectives policies and standards inventory – information, technology, people management commitment finance

ANALYSIS ASSET ASSESSMENT BUSINESS IMPACT ANALYSIS TECHNICAL REQUIREMENTS 1. analyze BIA and Asset Assessment 2. list technical strategies based on the analysis of each asset and business process in scope 3. document drawbacks and advantages of each listed strategy 1. identify and quantify asset needs 2. document ownership 3. assign weight based on importance 4. assess exposure 5. identify access control and other preventive measures 1. rate processes based on criticality 2. identify dependencies 3. identify custodian 4. identify threats and consequences 5. identify safeguards needed/possible 6. list critical resource requirement 7. quantify acceptable owntime and and losses DEVELOPMENT 1. 2. 3. define continuity goals and chosen strategy in the form of a plan acquire resources needed for preparing and implementing the continuity plan test the plan RESULTS 1. 2. 3. 4. preventive control Business Continuity Plan continuity team training plan for team 47 Padmavathy Ramesh, Business Continuity Planning, (Tata Consultancy services, 2002), p. 28 22 2. 1. 1 The Evolution of BCM As Halls observes, “Business Continuity Management is a relatively modern idea. Its first mentions can be found in the 1980s, although it was only in the very late 1990s that it became a more widespread as a business discipline. 48 In fact, Business Continuity Management is “the outcome of a process that started in the early 1970s as computer Disaster Recovery Planning (DRP) and then moved through an era where the emphasis was on business continuity planning rather than on management. ”49 In that time, computer managers were responsible for DRP. Soon, they realized that “the concentration of systems and data in itself created new risks; computer operations management introduced formal procedures governing issues such as backup and recovery, access restrictions, physical security, resilience measures such as alternative power supply, and change control. ”50 In 1970s, if a big problem appeared, the tolerated downtime was not measured in hours, but days. Therefore, “the cost of back-up computers sitting idle in an alternative location waiting for a disaster to happen was prohibitive. However, for some companies, data safety was a priority; no matter at what cost it would be obtained. As Gallagher points out, “organizations such as banks were in a more vulnerable position and invested considerable resources in installing and testing computers at alternative sites. Back-up tapes or disks were increasingly stored at protected locations well away from the computer centre. ”51 Later, in the 1980s, commercial recovery sites offering services started to appear, often on a shared basis. “This was the start of the sophisticated recovery centers that operate today,”52 notes Gallagher. However, they all concerned mainly IT: “The disaster recovery plans documented the actions required to safeguard and restore computer operations.

These covered computer processing, computer applications, telecommunications services and data after a disruptive event. The objectives were to 48 49 Michael Halls, “What is Business Continuity Management? ” … Michael Gallagher, Business Continuity Management,…, p. 6 50 ibid. 51 ibid. 52 ibid. 23 prevent or at least minimize the impact that such an event would have on the business. ”53 Such plans were far from being perfect as “they were more concerned with, for example, restoring a company’s financial systems to an operational state than with worrying about whether there would be accommodation available to allow the staff of the finance department actually to use the systems. 54 Not much attention was paid to implementing BCL into every aspect of the company’s activity. In 1990s, a significant change in the IT environment took place and the movement from DRP to Business Continuity Planning became considerably quicker. Gallagher confirms that “throughout this decade, and into the 2000s, there were significant changes in the IT approach to DRP/BCP and in what constituted acceptable downtime. The emphasis moved from being mainly on IT to an approach that considered all aspects of an organization’s business and relationships. ”55 It is only then that “BCP has become BCM with the emphasis on management – not just planning.

This encompasses the emphasis on risk management and the measures to be taken to reduce risk. BCM is no longer regarded as a project – it is now a program, emphasizing that it is a continuous process rather than a task with a defined enddate. ”56 The next step is to make managers of all companies aware of the importance of BCM as “the increased recognition of BCM means that a greater budget allocation may be available to it. More significantly, the message preached by business continuity practitioners for years that business continuity principles should be an integrated part of the business planning process may be heard. ” 57 2. 1. 2 The Significance of BCM

Thanks to proper Business Continuity Management, a company has a professional plan which allows acting as quickly and efficiently as possible in case a dangerous 53 54 ibid. ibid. 55 ibid. 56 ibid. 57 ibid. 24 event happens, because “BCM not only aims to provide continuity in customer service at a minimum acceptable level, it also aims to limit the impact on the financial position of an organization by ensuring that its critical functions continue to operate during a crisis and that the remainder are recovered in a controlled manner. ”58 Therefore, when a BCP is applied, there are no chaotic, haphazard attempts to minimize the losses as clear and logical procedures have been devised earlier and communicated to the staff.

As Mel Gosling notices, “decisions made in the first few hours of an event that causes serious disruption to an organization’s operations are critical, and actions undertaken in the first few days will have a significant financial impact”59 and “a company that has an effective and well-tested Business Continuity Plan is more likely to take the right decisions in the first few hours and to subsequently undertake the best actions to limit the impact on its financial position. It has a better chance of incurring significantly less additional expenditure at the time of a disruption. ”60 Moreover, “one of the benefits that implementing business continuity management brings to a firm, which is not immediately apparent, is an understanding of what the business does and what is important to it. ”61 In this way, a company can analyze its allocation of resources and improve it, as well as “find out what is critical and of value, and what can be outsourced or left undone. ”62 Besides, certain companies, e. g. , financial institutions, are legally obliged to develop BCM and maintain an effective business continuity plan.

It is also becoming increasingly common that businesses require from their suppliers to be presented with their BCM plans. This facilitates the process of assessing the supplier’s infallibility and constitutes an element of developing a sound business relationship. Mel Gosling, “Why invest in business continuity,” 1 February 2007, . 59 ibid. 60 ibid. 61 ibid. 62 ibid. 62 ibid. 58 25 The investment into Business Continuity Management is beneficial not only in the matter of a business being prepared for multiple diverse crises. It also adds significantly to the company’s reputation and brand image by “demonstrating effective and efficient governance to the media, markets and stakeholders. 63 Moreover, it enhances the competitive advantage of the business, because to some investors and customers it may be a vital factor in deciding to which company they should entrust their capital. Osborne explains it as follows, “To a firm’s shareholders it’s part of investor relations – you are showing your commitment to keeping their investment safe. To a firm’s staff it is labour relations – you are showing your willingness to protect the livelihood of your staff. ”64 Furthermore, he stresses that “it’s customer relations too – you’re demonstrating your commitment to providing a service for them even in the most extreme of circumstances. ”65 Last but not least, devising professional plans and keeping them updated increases the company’s credibility in the eyes of nsurers and auditors because they are becoming increasingly aware of the importance of BCM. As Osborne observes, “Five years ago, auditors simply would have said to their clients, do you have a plan in place? A couple of years ago, they would have wanted to inspect it, to see if every contingency was covered and how practical it appeared to be. Nowadays, they will ask how it worked in practice. When it was last tested and what were the results? ”66 What is more, “insurers like to see evidence that all reasonable steps have been taken to understand the past accident record and that actions have been put in place to prevent them from happening again. 67 This is confirmed by Gosling, who states that “insurance companies themselves are now starting to realize the opportunities that business continuity provides for loss reduction, and it is becoming increasingly common for a condition of insurance cover to be the existence of a business 63 64 David Smith, “Business continuity and crisis management,” … p. 27 Ask the panel of business continuity experts,” … 65 ibid. 66 ibid. 67 “Pro-active Risk Management: Avoiding catastrophe. ” Business Continuity & Risk Management,…, p. 14 26 continuity plan. ”68 All in all, devising and implementing an effective BCM plans brings versatile advantages to a company, while the failure to do so “means taking an unnecessary risk with an organization’s future and profitability. ”69 2. 1. 4 Continuity Culture in a Company A vital step in forming Business Continuity Management in a company is to instill a proper attitude in the staff.

Michael Gallagher believes that “it is about creating a continuity culture in the organization. This can be at least as important as producing the actual plans. ”70 He also states that “for BCM to work, it must be driven from the top. “71 Therefore, senior managers must understand that BCM is “not just another expense but also a significant resource,’ 72 as Mike Osborne assures. However, the amount of data that has to be taken into consideration while developing preventive measures is overwhelming. Lane points out that “while responsibility for corporate resilience sits firmly with the executive board, the skills and experience required to combat the growing list of disruptive threats exists throughout the organization. 73 Thus, in large companies, it is a wise move to appoint a full-time Business Continuity Manager, whose tasks are to accumulate the relevant knowledge from all departments and co-ordinate proper procedures, as well as devise professional plans and keep them updated. Smaller businesses may use the services offered by consulting companies. The staff’s awareness of specific procedures ready to be applied in case of any foreseeable disaster enhances their efficiency and identification with the company. Instructing them of the specific plans encourages them to pay bigger attention to the safety issues, which significantly contributes to the BCM process. 68 69

Mel Gosling, “Why invest in business continuity,” … ibid. 70 Michael Gallagher, Business Continuity Management,…, p. XI 71 ibid. 72 “Ask the panel of business continuity experts,” Business Continuity & Risk Management,…, p. 12 73 David Smith, “Business continuity and crisis management” … p. 27 27 Gallagher explains that “if the business continuity culture is sufficiently developed, the continuity considerations will be a natural part of the development of the plans. ”74 2. 2 BCM and the Company’s Size For the definite majority of large corporations, BCM is a regular part of their activity but, as Gallagher states, “there is a feeling that it is not a matter of concern to the smaller business. 75 This happens because “a lot of the emphasis in the business continuity press, and in business continuity material generally, relates to large organizations and to the financial services industry. ”76 While “for the largest corporations and those with enormous sums of money at stake, the complexity of planning is breathtaking,”77 “small and medium-sized enterprises tend to get ignored when talking about business continuity planning. The planning is more prosaic. The challenges are fewer. And most importantly, their budgets are smaller. ”78 Another problem is the fact that “smaller companies are typically less aware of the correct procedures than larger firms where systems have been developed. 79 The managers of small and medium-sized businesses simply tend to think that their company’s size is a kind of safeguard against a disaster, or that potential recovery will be quick and simple, so “the process of developing a plan is perceived as too complicated, involving excessive costs and management time. ”80 However, Mike Osborne emphasizes that “the issue for small to medium sized businesses is that they often do not have the inherent resilience that say, a UK multinational has. ”81 He warns the managers against an illusive safety feeling as “smaller firms often trade from a single location and do not benefit from vast armies of support staff and Michael Gallagher, Business Continuity Management,…, p. 88 Michael Gallagher, Business Continuity Management,…, p. 28 76 ibid. 7 Michael Halls, “What is Business Continuity Management? ” Business Continuity & Risk Management,…, p. 3 78 Michael Halls, “Small is still beautiful (but riskier too),” Business Continuity & Risk Management,…, p. 10 79 ibid. 80 “It’s never too late to plan for the future,” Business Continuity & Risk Management,…, p. 15 75 74 28 specialists who can react to and recover from an incident. If they are hit by a disaster, the impact is greater then it would be the case in a larger organization. ”82 This view is supported by Gallagher, who states, “Small businesses should remember that their biggest threats do not come from high profile incidents such as earthquakes or terrorist bombs.

It is the dozens of relatively minor issues such as prolonged power outages or computer network failures that may cause the problems. The vast majority of problems are caused by people or process failures. ”83 He points out that “this is where the effort and investment should be concentrated. Because of size, the process is simpler and the cost will be proportionally less than for larger organizations. The consequences of not having a plan are, however, likely to be disastrous. ”84 Therefore, as Michael Halls stresses, “Business Continuity Management is a must for companies of all sizes. A small firm that loses its data will go out of business just as surely as a larger one. ”85 2. 3 BCM in Relation to Insurance

Some managers wonder why they should engage themselves into Business Continuity Management while their company is insured. To them, devising a BCM plan seems to be an unnecessary waste of time and money, because they think that risks are looked after by the insurers and thus, there is no need to worry. But these are absolutely false conclusions. As Mark Baylis emphasizes, “insuring the risk is not the answer, because it is better for the business that the problem does not happen at all. ” 86 This view is supported by Gallagher, who states that “insurance is simply a necessary part of the total business protection and recovery plan – but it is only a part. 87 Although it is true that insurance provides financial aid in case a disaster strikes, the money may 81 82 ibid. ibid. 83 Michael Gallagher, Business Continuity Management,…, p. 28 84 ibid. 85 Michael Halls, “Small is still beautiful (but riskier too),” … 86 Mark Baylis, “Weak links in the supply chain,” Business Continuity & Risk Management,…, p. 11 87 Michael Gallagher, Business Continuity Management,…, p. 33 29 arrive after quite a long period. Moreover, “insurance for loss of profits, or for increased cost of working, will cover only a defined period – which in practice may prove to be inadequate. ”88 Besides, “proving loss of profits can be very difficult.

The outcome may be based on historical performance and may not take account of recent market developments. ”89 It is also very important to notice that insurance will not “keep customers supplied or guarantee that market share will be recovered,”90 nor will it “protect the organization’s reputation and image. ”91 Last but not least, as it was mentioned in the previous paragraph, there may be a situation when the insurer refuses to provide a cover unless the company devises a BCM, because nowadays businesses are required to act more actively in protecting themselves from various possible risks. Therefore, it is vital for a firm to have efficient Business Continuity Management in order to obtain insurance on favourable terms.

To sum up, managers must remember that “insurance is reactive – while it has its place, the whole protection process must be more proactive and BCM is the key. ”92 2. 4 Business Impact Analysis Business Impact Analysis (also known as BIA) is the most important tool of Business Continuity Management. Gallagher defines it as “a management-level analysis that identifies the impacts of losing company resources. It measures the effect of resource loss and escalating losses over time in order to provide senior management with reliable data upon which to base decisions on risk mitigation and continuity planning. ”93 The BIA process “identifies and ranks the business processes, 88 89 ibid. , p. 34 ibid. 90 ibid. 91 ibid. 92 ibid. 93 ibid. , p. 146 30 criticalities and dependencies. 94 It is closely related to risk analysis, which was discussed in the previous chapter, therefore, it may base on the materials that have already been gathered during the general Risk Management process in the company. The method by which BIA is carried out “depends on the nature of the organization – size, structure, local or international, etc. ”95 Generally, in order to maximize the efficiency of a BIA processes, standardized questionnaires should be used. They should contain questions which are formed in such a way as to provide information that concerns the following issues: • • the nature of given problems; the impact of the problems, which should be presented from different perspectives, e. g. the company’s reputation, costs involved, loss of future business, etc. • • • the influence that may be caused by the problems at different times of the day, week, month and year; the kind of resilience that may be currently provided in a quick and easy way; the recovery from the addressed problems (time needed for recovery, priorities for resumption, duration of backlog, additional costs, insurance cover); • • the available workarounds and the way they operate; the continuity and recovery requirements, e. g. , accommodation, computer systems, etc. 96 After the questionnaires have been filled in, the Business Continuity Manager prepares a comprehensive report which presents the company’s Business Impact Analysis. The report is composed of the following parts: 1. Introduction 2. Executive Summary 3. Background to Study 94 95 ibd. , p. 47 ibid. 96 cf. Michael Gallagher, Business Continuity Management,…, p. 57 31 4. Current State Assessment 5. Threats and Vulnerabilities 6. Critical Business Functions/Operations 7. Business Impacts – Operational and Financial 8. Potential Strategies 9. Recommendations 10. Conclusion 11.

Appendices97 Thanks to the logical and substantial structure, the report fully represents the current standing of the company, clearly indicates its weak points and realistically describes possible procedures. Business Continuity Management is an extremely important process, which not only enables the assumption of proper attitudes towards multiple threats that endanger a firm’s functioning, but it also significantly deepens the understanding of the business and improves the staff’s morale. Proper implementation of BCM in a company leads to the creation of a Business Continuity Plan, which will be discussed in detail in the following chapter. 32 CHAPTER 3

BUSINESS CONTINUITY PLAN In the previous chapters, the importance of Business Continuity Management was explained and it was stated that devising a Business Continuity Plan is one of the main tasks of this type of management. This chapter provides information on how to construct, implement and test a Business Continuity Plan. Moreover, it contains a description of the most frequent mistakes that appear while drafting a BCP and advises how to avoid them. The exemplary plans and templates on which the analysis is based are attached as Appendices B, C, D, E and F at the end of the present thesis. 3. 1 The Structure of an Exemplary Business Continuity Plan

Business Continuity Plans vary in length and are divided into different parts, which mostly depends on the size and type of a company. However, certain sections are vital and thus common for all the plans. They should be organized in such a way as to enable quick access to the required information. These crucial parts will be successively discussed herein. 3. 1. 1 Front Page and Introduction On the front page of a Business Continuity Plan, there should be written the name of the company, the issue date and a distinct lettering stating BUSINESS CONTINUITY PLAN. Moreover, if the Plan is confidential, it should be indicated on the front page as well. Optional elements inserted here may include contact details for feedback, references, the revision date, etc.

These components are followed by an introduction, which consists of a distribution list (copy number, name and location) and a table of contents. 97 cf. Michael Gallagher, Business Continuity Management,…, p. 57 33 3. 1. 2 Aim This section should contain the description of the purpose for which the Plan has been created. It usually gives examples of possible disasters and explains the objectives which the plan is intended to meet in case of a calamity. What is more, a company which wishes to convey an especially powerful message concerning its reliability may include in this part a summary of the extensive works and professional researches which have been involved in the development of the Plan. 3. 1. 3 Critical Functions Checklist

Critical Functions are these activities without which the company would not be able to perform. In order to prepare a Critical Functions Checklist, the following steps should be completed: • • • • • the identification of Critical Functions, e. g. , sales and distribution; the description of the Functions in terms of the impact which may be caused by their interruption in the first 24 h, 48 h, one week and two weeks; the prioritization of the Functions; the ascription of a reasonable timeframe within which the recovery is possible; the determination of resources which will be necessary in the recovery process, such as: a) the staff – the required number of people, their knowledge and skills; b) alternative location – e. g. the staff working at home or provisional premises; together with necessary equipment like computers, cars; c) data – information and documents, e. g. , insurance certificate, service, customers and suppliers details; d) communications – all ways in which customers, suppliers, the staff and media can be contacted in case of disaster. 34 Such a Checklist allows ensuring that “critical tasks are completed on time and according to a pre-agreed priority schedule. It may also be used to provide a handover document between different shifts in the recovery process. ”98 3. 1. 4 Risk Analysis Table This part should contain a table comprising a list of dangers which may interrupt and threaten the activity of the company.

The matrix presented below may be used to ascribe values to the particular risks with regard to the likelihood of their occurrence and their potential impact. Table 3. 1. 4 Risk Matrix LIKELIHOOD NEGLIGIBLE CATASTROPHIC RARE UNLIKELY POSSIBLE PROBABLE M M M L L H H M L L VH VH H M L VH VH H M L VH VH H M L IMPACT SIGNIFICANT MODERATE MINOR INSIGNIFICANT Legend: L – low, M- medium, H – high, VH – very high Moreover, there may be also attached a list of possible losses, endangered people and equipment, as well as the actions which had to be taken in case a particular risk occurs. 98 Appendix D, p. 77. 35 3. 1. 4 Emergency Response Checklist Such a Checklist greatly facilitates the performance of people involved in fighting a potential adverse event.

It also acts a concise register of actions that were taken after the disaster happened. It should be later analyzed, developed and improved. It is preferable that tasks to be completed are organized in the form of a table, together with a column in which the date of termination will be written down. The actions may be listed as follows: • during the first 24 h a) to establish the Actions and Expenses Log, which is a more detailed and comprehensive version of the Emergency Response Checklist; b) to contact emergency services; c) to identify and approximately assess the damage which has been incurred by the staff, equipment, buildings, data, etc. d) to determine the critical functions which have been interrupted; e) to decide on the steps that need to be taken within the recovery process, which is based on the Critical Function Checklist; f) to contact the staff, customers, suppliers, insurers, relevant authorities and other stakeholders in order to assure them that the situation is under control; g) to issue a special PR statement to the media. • daily within the recovery period a) to update the Actions and Expenses Log; b) to provide valid information to the staff, customers, suppliers, insurers, relevant authorities and other stakeholders, as well as the media; • after the recovery period a) to interview the staff with respect to their welfare needs; b) to analyze the Emergency Response Checklist and Actions and Expenses Log in order to introduce possible improvements into the Business Continuity Plan. 36

As it can be seen, the response to the crisis should focus on its effects, not on the causes. The reasons of the adverse event should be identified as quickly as possible, but a comprehensive analysis of them must not be performed before the main steps of the recovery process have been taken. 3. 1. 5 Roles and Responsibilities This section should contain information and contact details regarding the people who are responsible for the shape and content of the Business Continuity Plan (e. g. , Business Continuity Manager, the BCM Team). Moreover, there may be included a list of duties which are ascribed to the particular staff members in case an adverse event happens.

Last but not least, it is necessary to indicate the names and contact details of the co-ordinators of the recovery process, help-line numbers (possibly, with pre-recorded messages) and location of meeting rooms and the Business Recovery Command Centre, together with maps. 3. 1. 6 Contact List In this part, there should be listed the following contact details: • staff members (divided in respect to the departments) and their next of kin a) name, b) address, c) work telephone number, d) home telephone number, e) mobile telephone number, f) e-mail address; • key suppliers a) name, b) provided goods, c) address, d) telephone/fax number, 37 e) e-mail address; • key customers a) name, b) service/good used, c) address, d) telephone/fax number, e) e-mail address; • mergency services (ambulance, fire service, flood line, hospitals, police) a) address, b) telephone number; • utilities (water, telecommunication, gas and electricity companies) a) name, b) telephone number, c) e-mail address; • insurers and banks a) name, b) address, c) telephone/fax number, d) e-mail address; • authorities a) name b) address c) telephone/fax number; • media a) name, b