daldalrisk management risk management risk · pdf fileauthor: pantaleoc created date:...

Copyright 2008 Claudio Pantaleo Copyright 2008 Claudio Pantaleo

South Europe Security ManagerSouth Europe Security Manager4/18/20084/18/2008

Claudio PantaleoHead of Security - Southern Europe Area British American Tobacco

Chairman OSAC ItalyStella al Merito del Lavoro

11

DalDalDalDal Risk Management Risk Management Risk Management Risk Management allaallaallaalla Business Continuity, Business Continuity, Business Continuity, Business Continuity,

passandopassandopassandopassando per la per la per la per la gestionegestionegestionegestione delledelledelledelle CrisiCrisiCrisiCrisi



Lo Scenario della Sicurezza Globale (1/2)

In passato, le Imprese reagivano alle nuove ed emergenti minacce con iniziative di addestramento e campagne di comunicazione interna, oltre all’implementare di policy e procedure di sicurezza sempre più stringenti ed in linea con l’evoluzione tecnologica.

Questo modo di operare è comunque evidentemente, ancorato al retaggio della cultura reattiva della sicurezza, con iniziative di Security guidate in larga parte da fattori esterni all’Impresa (tipicamente, dalle norme e pratiche industriali) e non da una valutazione completa del rischio reale.

Alcune policy di sicurezza affrontano la materia con l’approccio del “contrastare e ripristinare”, trascurando così una parte, a mio avviso, molto importante, ossia quella del “prevenire”.

Ma “prevenire” come ?? verso cosa ??.. “Prevenire” equivale a “Proteggere” gli asset aziendali in uno scenario operativo in costante e profonda trasformazione, caratterizzato da una sempre più marcata competitività economico-finanziaria e da un profondo dinamismo sociopolitico.

22



Lo Scenario della Sicurezza Globale (2/2)

Le Imprese si trovano, così, ad affrontare livelli di complessità sempre crescenti che richiedono continui aggiustamenti, se non ristrutturazioni vere e proprie dei loro processi operativi. Le attività aziendali sono sempre più dematerializzate e la crescente apertura geografica alla competitività ha, di conseguenza, portato all’intensificarsi dei rapporti internazionali.

In questo scenario, le Imprese hanno visto anche moltiplicarsi il numero dei fronti dove sono costrette ad impegnarsi per conservare la competitività e mantenere integra la capacità di ottenere risultati soddisfacenti.

È di certo aumentata la consapevolezza della presenza di minacce di natura non competitivadolosa o accidentale, mirate: ai processi produttivi; alle attività interne dei dipendenti; ai rapporti con l'esterno, in un contesto sempre più caratterizzato: dalla incertezza, dalla conflittualità e in qualche caso, anche dal pericolo

In ultima analisi, le Imprese, per una efficace creazione del valore aziendale e per il mantenimento della propria capacità reddituale nel tempo, si troveranno sempre di più a dover affiancare la gestione delle variabili tradizionali imposte dal mercato con l'azione di tutela del patrimonio. In questo contesto, la Security deve adeguarsi a nuovi scenari che ne condizionano le scelte e le soluzioni, sia all’interno che all’esterno dell’Impresa.

33

4/18/20084/18/2008Copyright 2008 Claudio Pantaleo Copyright 2008 Claudio Pantaleo

South Europe Security ManagerSouth Europe Security Manager

Dal Risk Management alla Business Continuity passando per la gestione delle Crisi (1/2)

Storicamente, in molte Imprese, l’occuparsi di alcuni aspetti di Internal Audit, Controlli, Rischi, Security, Safety o Strategie a medio/lungo termine avviene in modo isolato, ossia tali argomenti vengono affrontati singolarmente e spesso in modo tale da non considerarne le strette interrelazioni.

Le Imprese devono imparare a guardare a queste aree tra loro interconnesse e ad occuparsi di esse in maniera più strutturata, combinata ed ovviamente correlata.

L’Impresa deve dotarsi di un “Unico Team Interfunzionale” che partendo dall’analisi delle strategie aziendali, ne definisce i rischi e, per ogni rischio, ne valuta l’impatto e la relativa probabilità di accadimento, oltre a sviluppare idonei piani di risposta contenenti contromisure atte a limitare e/o mitigare l’impatto del rischio stesso sul business dell’Impresa.



Dal Risk Management alla Business Continuity passando per la gestione delle Crisi (2/2)

Quando poi uno specifico rischio per l’Impresa viene determinato con impatto elevato, il relativo “risk mitigation plan” non potrà essere più considerato adeguato, per cui si renderànecessario lo sviluppo di uno opportuno “piano di ripristino” o più comunemente conosciuto come “business contingency o continuity plan”, preventivamente predisposto e correntemente testato.

Questo “Unico Team Interfunzionale”, composto dai “risk owners”, dai “risk managers”oltreché dai componenti delle strutture Audit, Safety e Security, sarà quindi chiamato ad analizzare le opportunità aziendali ed i rischi ad esse connesse e, quindi, a produrre piani e contromisure qualora i rischi ipotizzati dovessero materializzarsi oltre a collaudati piani di ripristino, e non ultimo a farsi carico della gestione delle eventuali crisi qualora queste emergessero.



180 markets where we do business

50+ markets with largest market share

67 factories in 56 Countries

300+ brands in portfolio

Employees around the World

Responsible for planting 267,000 hectares of renewable woodlands

BRITISH AMERICAN TOBACCO

66



GROUP SECURITY & BRAND ENFORCEMENT ORGANISATIONGROUP SECURITY & BRAND ENFORCEMENT ORGANISATION

HEAD OF GROUP SECURITY

INFORMATIONSECURITY

CENTRAL SECURITY

TEAM

AME AM – PAC LA & CASIA – PACEUROPE

AREA HEAD OF SECURITY

BRANDENFORCEMENT

GROUP

Italy – Greece – Ciprus – Malta - Romania – Bulgaria – Slovenia – CroaziaBosnia Erzegovina – Serbia – Montenegro – Kosovo – Albania – Macedonia (FYROM)

5 REGIONS

77



Head of Group Security

Cyprus

Greece

Malta

Claudio PantaleoSouthern Europe Head of Security

Regional Security Manager

Italy

R

Bulgaria

Romania

Vran PloeB L C S C L

Slovenia

Croazia

Bosnia

Kosovo

Macedonia

Serbia

Montenegro

Albania

Balcans

88



The International, National & Internal Company contextInfluence

The Company Business Security solutions

99



Navigational themes are unchangedNavigational themes are unchanged

Experience Experience ““teachesteaches”” and ... produces Securityand ... produces Security

Cataloguing known risksTimely determination of other risk factors

Adaptating the course

Recover from awkward situationsand manage continuity of operations

Risk Analysis

RiskResponse

Contingency Plans

The thema of Business Continuity is as The thema of Business Continuity is as old as the thema of navigationold as the thema of navigation



Business Coontinuity is a cultural and Business Coontinuity is a cultural and organisational themaorganisational thema

Prevention against CurePrevention against Cure

� Repression is very expensive and inefficient

� Reduce opportunities for criminals, to commit crimes .... means, ..... reduce the cost to companies

� Identify emerging alarm situations (early warning) before.... damages are committed

� Raise awareness and consciousness of Employees

Physical, Logical and Organisational countermeasures

•Protection .... Prevention is better then RecoverPrevention is better then Recover



Areas where companies operateAreas where companies operate

�� Operational scenario in constant, profound transformationOperational scenario in constant, profound transformation

�� CompetitiveCompetitive--economic and socioeconomic and socio--political dynamismpolitical dynamism

�� EverEver--increasing complexityincreasing complexity

�� Continious processes of adjustment and/or restructuringContinious processes of adjustment and/or restructuring

�� Dematerialisation of company activitiesDematerialisation of company activities

�� Increasing geographical openness to competitivenessIncreasing geographical openness to competitiveness

�� Intensified international relationsIntensified international relations



WHATER, ELECTRICITY, GAS

RAILWAY, PORTS, AIRPORTS

OTHER CRITICAL INFRASTRUCTURES

COMMUNICATIONS VOICE / DATA

BANK AND FINANCE SYSTEMS

EMERGENCY SERVICES

The new context in which companies operate The new context in which companies operate

Productive multi-location

Atypical competition

Technology

Globalization of the market

New organizational trends

Asset’s Protection

Assets :

�People

�Goods/Products

�Information

�Consumers

Risks & OpportunityRisks & Opportunity



Companies are subject to several sources of Risk & ThreatsCompanies are subject to several sources of Risk & Threats

External Pressures�“Black” or parallel market�Organized crime�Unfair Competition

Illegal acts�Infringement Trademark - Product -Documentation

�Improper use Name - Trademark - Contract - Product

�Removal Information systems – Commercial information – Personal data

�Swindles/ Fraud Supplier - Clients - Employees

�Insider/Outsider espionage

�Sabotage from inside and from outside

�Theft of information

�Theft of computer identity intrusion, e-mail

Traditional threats and on-line threats



Security can help

Attitude to protect Attitude to protect

people/goods/information/Consumers people/goods/information/Consumers

with dedicated security structureswith dedicated security structures (380 degree approach)(380 degree approach)

Physical �Production and work places

Company goods �Transport �Manufacturing plants�Warehouses

Transfers�Travel �Conventions and Exhibitions�Airports and public places

Colleagues/Collab’s�Visitors �Suppliers �Business Partners

Mobile work equipment�Laptops - Palmars�Mobile telephony systems�Video-Telephones

Information Systems�Confidential and vital data �Disaster recovery �Telematic and informatics infrastructure�Workflow and workgroup systems



MissionMission

“ The study, development and implementation of strategies, policies and operational plans

dedicated to preventing, tackling and overcoming events, mostly fraudulent and/or culpable

that can damage material, immaterial, organisational and human resources

which the company has or needs in order to maintain adequate competitive capacity,

in the short, medium and long term”

Uni10459

Security can help



Security can help The evolution in Company SecurityThe evolution in Company Security

2000’s Understand & Manage•• Vulnerability & Risk Analysis Vulnerability & Risk Analysis •• Monitoring and network security Monitoring and network security •• Response to incidents Response to incidents •• Business RecoveryBusiness Recovery

1990’s Digital evolution

•• Electronic vulnerability Electronic vulnerability

•• Confidentiality, integrity Confidentiality, integrity and availability of data,and availability of data,

•• Threats from both outside Threats from both outside and insideand inside

1980’s Physical First •• Gates, Perimeters, Guards,Gates, Perimeters, Guards,•• Physical protectionPhysical protection•• Classification of dataClassification of data•• Threats solely from outsideThreats solely from outside



““20002000’’s .. Understand and manages .. Understand and manage”” the Risks & the Risks & ThreatsThreats

Business Information

� know-how� technologies� development� policy� results� defects� crisis� plans

� ……

Resources &Relationships

� skills� alliances� dynamics� economics � investments � organisation� competencies� joint-ventures� ……………….

Market &Customer share

� terms&conditions� customer profiles � customer claims� orders portfolio� bench-marking � partnerships� prospects� contracts� ……….

Economic, Scientific, Technical, Payroll,Account Receivable, Shipping Schedules,

In w

hether f

ormat t

angible or intangible

however sto

red, m

emorize

Customer Deadlines, ...., Badget, Data, Plans, Programs, Tools, Successes and Failures, Mechanisms, Processes,

Procedures, ....,



Making business in the new ContextMaking business in the new Contextwith new RISKSwith new RISKS

An accumulation of fronts where companies are forced to engage An accumulation of fronts where companies are forced to engage to preserve to preserve competitiveness and maintain whole the capacity to obtain satisfcompetitiveness and maintain whole the capacity to obtain satisfying resultsying results

Increased awareness of the presence of fraudulent or accidental Increased awareness of the presence of fraudulent or accidental nonnon--competitive threats:competitive threats: to production processes, to production processes,

to the employees actions, to the employees actions, to relations with the outside worldto relations with the outside world

in a context characterised by uncertainty, conflict in a context characterised by uncertainty, conflict and sometimes ....... danger and sometimes ....... danger

Management of traditional competitive variables marching alongsiManagement of traditional competitive variables marching alongside with de with actions to protect assetsactions to protect assets for effective creation of company value and keeping of the for effective creation of company value and keeping of the company capacity to generate income in the long termcompany capacity to generate income in the long term

Professionalof Business Security



Processes that are not executed in a perfect way

represent huge opportunities for anyone

wishing to abuse them

Some causes or supplementary causes should be carefully assessedSome causes or supplementary causes should be carefully assessed

Process weaknesses and criticality

are opportunities to protect

Increasing risk of new and intangible dangers that are difficultto intercept with conventional/traditional security measures

.... recognize a problem before it becomes an emergency ....

Apply Risk Analysis Process to Company Goals, Strategy, Directions, Objective ….

Anyhow



Business ContinuityBusiness Continuity

•• Identify and EvaluateIdentify and Evaluate the Assets the Assets •• Analyze and MeasureAnalyze and Measure Threats Threats -- RisksRisks•• Analyze the Environment Analyze the Environment VulnerabilitiesVulnerabilities

•• Recommend improvements based on Recommend improvements based on the solution the solution impact andimpact and--or Cost/Benefitor Cost/Benefit

Protect the market share Provide a return on the investment

Protect the market share Protect the market share Provide a return on the investmentProvide a return on the investment

With objective and methodical approach that produces measurable results

With objective and methodical approach that With objective and methodical approach that produces measurable resultsproduces measurable results



Know your DominionEnvironment

Crisis(whilst the event)

Post Crisis immediate(short term)

Normalization (medium-long term)

Disaster Recovery Contingency Plan Continuity Plan

Risk Management Crisis Management Business Continuity Management

Threat and its Probability ofhappening

ResidualVulnerability

Consequence= Impact on Company business if hypothesised threat/risch do happens

Attach -<>-Crisis

Post CrisisImmediate short term

Post CrisisMedium- Long Term

Respond with Contingency Plan

RestorePrimaryOperations

PreventMitigate

RecoveryNormalize Operations

PreparationPlanning

Dal Risk Management alla Business Continuity, passando per la gestione delle Crisi



Matrix SWOT Matrix SWOT I n t e r n a l A n a l y s I s

WeaknessDebolezze

Strengths

Punti di Forza

Threats

Minacce

Opportunities

Opportunità

Brainstorming & Risk Identification techniques

SWOTSWOTapproachapproach

External

Analysis

Minacce e Minacce e Punti di DebolezzaPunti di Debolezza

Irrobustire i Irrobustire i Punti di Debolezza Punti di Debolezza esposti alle minacceesposti alle minacce

Minacce e Minacce e Punti di ForzaPunti di Forza

Sfruttare i Punti Sfruttare i Punti di Forza per di Forza per contenere le contenere le minacceminacce

OpportunitOpportunitàà e e DebolezzeDebolezze

Ridurre le Ridurre le debolezze debolezze per cogliere per cogliere nuove Opportunitnuove Opportunitàà

OpportunitOpportunitàà e e Punt di ForzaPunt di Forza

Sfruttare i Punti Sfruttare i Punti di Forza per di Forza per cogliere le cogliere le OpportunitOpportunitàà

Opportunity &Opportunity &StrengtsStrengts

Take advantageTake advantageof Strengthsof Strengths

to pick upto pick upopportunityopportunity

Riducre weaknessRiducre weaknessto pick up newto pick up new

opportunityopportunity

Threats &Threats &StrenghtsStrenghts

Threats &Threats &WeaknessWeakness

Take advantageTake advantageof Strengthsof Strengths

to shut down to shut down threatsthreats

Fortify weaknessFortify weaknessexposed to exposed to

threatsthreats

Opportunities &Opportunities &WeaknessWeakness

Know your Dominion &Environment



2

La Ruota del Risk Management

3

4

51

18/04/2008 Copyright 2008 Claudio Pantaleo South Europe Security Manager

5

1.1.2

RISK MANAGEMENT – BUSINESS CONTINUITY PROCESS

Area: 1.1.1 Risk Management Process : Business Risk Database (BRD)

4

31 2

Ref ’s . Corporate Procedure: - Risk Management Team- Crisis Management Team - Business Continuity Guidelines- Risk Management Process Guide

Riskmapping Functional

Risk ManagementTeams

Riskowners

Company RMT > Defines Risks byTypology&Severity

> Appoint Risk Mgrs

Riskowners

>Develop RiskCountermeasures>Responsible for implementation & tests

Riskmanagers

Risk Disposition

> Analyse

Security

StoredRisks doc’s

Business RiskDatabase

held by SecurityAvailable to Audit,RMT, CMT (+ntk)

Security

If necessaryUpdatesBusiness ContinuityPlans

Security

Security

BRD Annual Review:

Strategy ReviewBudget Review

TwiceA year

Business ContinuityPlans and/orAfter IncidentReview

Process Mgmt

Risk Countermeasure

1.1.2

AuditEH&S……



In the Crisis Management appears 3 Main Moments

PreparationPlanning

Recovery andNormalization

BEFORE….Phase of

WHEN…. Phase of

AFTER ….Phase of

Restore andManage

Emergency PlanningBusiness Impact AnalysisBusiness Continuity PlanningBusiness Recovery PlanningCrisis Management Planning

Emergency ManagementCrisis Management

Business Recovery ManagementBusiness Continuity Management

Post Incident Review



EMERGENCY PLANNINGCrisis Management Team (CMT)

Organizzation

Offices Bari

Warehouse Bari

COUNTRY CMT

Local CMT

Local CMT

Local CMT Local CMT

Local CMT

Local CMT

Local CMT

Main Location / HQ

Florence: Manufacturing

Bologna: Offices

Milan :Education Centre Rome: Offices

Palermo:Warehouse

Escalation Process and Emergency-Incident reporting

Other Countries CMTREGION CMT

WHEN…. Phase ofRestore andManage

18/04/2008 Copyright 2008 Claudio Pantaleo South Europe Security Manager

Individual

1.1.1

Top Risk7

Top Risk 1

BC Plan 7

BC Plan6

Area: 1.1.2 Risk Management Process : Business Continuity Plans

Don’t stop thinking about tomorrowYesterday is gone Flow chart - Security Process - tomorrow.mp3

Business Risks Batabase

Ref ’s . Corporate Procedure: - Crisis Management Team- Business Continuity Guidelines- Risk Management Process- Business Continuity Plans- CMT callout

IT unavailability

Alternative site - location

AlternativeSuppliers

MANDATORY BCPs

Business Continuity Plans

AdditionalLOCAL

BCPs

Environmental

Terrorism

ProductionStops

Civil unrest

Crisis Management Post IncidentReview

UpdateBRDatabase

SubmitTo Risk ManagementTeam

Crisis Management Team

INCIDENT

Country

Risk

Management

Team

Risk Owners

SecurityManager

EHS Manager

General Services

Others If necessary

Player

key

any other

AdditionalRisk

Managers

1.1.1

CRISIS

RISK MANAGEMENT – BUSINESS CONTINUITY PROCESS

Risk Managers

+Key

PositionPlayers



Interfunctional ...

Flexible ...

Adaptable to needs ...

Operative for all crisis duration and following phases of business continuity and return to normalize business activities

In the Crisis Management appears 3 Main Moments

But a unique Crisis Management Team



Security Process: Risk Management & Business Continuity

Don’t stop thinking about tomorrowYesterday is gone

BEFORE AFTERDURING

PreparationRisk management

CrisisManagement

BusinessContinuity

Governance & Dynamics



We need to be preparedWe need to be prepared

•• It couldnIt couldn’’t happen to met happen to me

•• It couldnIt couldn’’t happen to my Companyt happen to my Company

•• It couldnIt couldn’’t happen to my familyt happen to my family



””What couldnWhat couldn’’t t happen happen …………………………………………

HAPPENS !!HAPPENS !!””

unfortunately



On 14th April 1912, On 14th April 1912, RMS Titanic sank, RMS Titanic sank,



NoNoèè cominciòcominciò a a costruirecostruirell’’arcaarca prima prima cheche cominciassecominciasse a a pioverepiovere !!!!

Noah started to build the Ark Noah started to build the Ark before it start to rain !!before it start to rain !!

Thank You for your timeThank You for your time

daldalrisk management risk management risk · pdf fileauthor: pantaleoc created date:...

Documents