deloitte proposals template - iia-mali · crisis management vs. business continuity some equate...
TRANSCRIPT
![Page 1: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/1.jpg)
Crisis Management
The Internal Audit Challenge in Assessing Your Organizations
Crisis Resiliency
![Page 2: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/2.jpg)
Introduction
“Only when the tide goes out do you discover who’s
been swimming naked”
Warren Buffett
Crisis in History
Inherent in the Business
Invisible Function
Internal Audit Evolution
Crisis Management & BCM
![Page 3: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/3.jpg)
POLITICAL TURMOIL / WAR
CYBER ATTACK / SYSTEM FAILURE
DISEASE
ECONOMIC
COLLAPSE
PRODUCT CONTAMINATION
FIRE/FLOOD
SYSTEM/PRODUCTIONFAILURE
TERRORISMCrisis
![Page 4: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/4.jpg)
4
![Page 5: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/5.jpg)
5
“we will always need to have the right people in the room who can make these decisions ,
under pressure and in a short period of time, to the best of their capabilities.“
Time & Decision-making
Familiar Situation
Time is of essence
Are we trained for this?
The Decision Maker
![Page 6: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/6.jpg)
6Preparedness & Readiness
“readiness and preparedness needs to be more on resiliency of the organization
to be able to respond to any type of crisis than only to prepared to respond to
the obvious scenarios.”
Scenario Limitation
Mixed Scenarios
Readiness in our DNA
Preparedness
![Page 7: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/7.jpg)
7
“Internal Auditors can help their businesses prepare for the inevitable crisis and move the
organization from crisis aware to crisis resilient — ready to resist, react to, and recover from
major disruptive events.”
Why Internal Audit ?
Functional Flexibility
Risk Mindset
Board of Directors
InteractionBreadth of Skills
Position in
the Organization
Industry and
Process know-how
![Page 8: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/8.jpg)
8Crisis Management Vs. Business Continuity
Some equate Crisis Management with Business Continuity Planning.
Business continuity plans are typically procedural and designed to recover processes
or systems if they fail or are unavailable
Crises are broader, more ambiguous, and cover all areas of potential strategic impact
risk. They demand a high degree of organization, coordination, and communication.
Crisis readiness is about the execution capability of the organization and its
leadership in such circumstances, irrespective of whether an appropriate business
continuity plan exists or not.
![Page 9: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/9.jpg)
A Crisis of Confidence
Forbes Insights on behalf of Deloitte , conducted a survey of more than 300 board members
![Page 10: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/10.jpg)
76%
organization will have
an effective response
to Crisis.
engage in monitoring to
detect trouble ahead
have playbooks for
likely crisis scenarios
engage in crisis
simulations or training.
49% 49% 32%
Feeling Ready Vs. Being Ready
“Fewer than half (49 percent) say they have engaged with management to understand what
has been done to support crisis preparedness“
![Page 11: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/11.jpg)
11
18%
26%
13%
39%
26%
35%
40%
40%
48%
47%
37%
54%
Yes Vulnerable % Yes, have crisis plan %
Terrorism / manmade disasters
Rumors (though false)
Nuclear / Biological / Chemical
Corporate Reputation
Product Tampering
Organizational Malfeasance
Regulatory Actions
Natural Disasters
Cyber-crime
Supply-chain issues
Workplace violence
Liquidity
63%
68%
55%
73%
60%
64%
66%
66%
70%
66%
54%
58 %
Potential Crisis
The Vulnerability Gap
45%
42%
42%
34%
34%
29%
26%
26%
22%
19%
17%
4%
GAP
![Page 12: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/12.jpg)
12Response Planning
Key steps are
present in
fewer than half
of the
companies
What are the
key elements of
your response
planning ?
Clear alert & mobilization
plans
Clearly defined
governance / chain of
command
Clearly defined roles (who
should act in which
instances?)
Clearly defined
coordination /
communication plans
Clear declaration
protocols (this is a crisis)
Clearly defined rules of
escalation (if this happen,
do this..)
Crisis-specific planning (if
‘this’ crisis, take ‘these
'actions’)
Clearly defined ‘freedom
of action’ (in absence of
superior)
Before – the – fact crisis
simulation / “war
gaming”
![Page 13: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/13.jpg)
Crisis Preparedness
What steps have
you taken in crisis
preparedness?
Most go ignored at
half of companies
or more
SWOT Analysis
Engaged multifunctional
teams
Engaged stakeholders in
analysis of specific
scenarios
50%
46%
41%
Evaluated key crisis
scenarios
Identified relevant
stakeholders
Evaluated worst-case
scenarios
50%
49%
43%
![Page 14: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/14.jpg)
49% 18% 33%
YES NO Uncertain
Playbook
Does this organization define a specific set of actions – a distinct “playbook” – for each of its
specifically defined crises scenarios
![Page 15: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/15.jpg)
Lessons Learned
Conduct better pre-crisis planning
Better define the roles / responsibilities
Do more to identify crisis scenarios
Execute a more timely and robust communications plan
Communicate more effectively with customers
Invest more effort in prevention
More closely monitor social media
Improve detection and early warning systems
Communicate more effectively with employees
Communicate better with business partners / alliances
Communicate more effectively with suppliers
![Page 16: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/16.jpg)
16Steps to be taken
Board of Directors
Competence
Job Descriptions
The Crisis Organization
The Specifics
Communication
The Guardian of Reputation
“the ability to lead in a crisis must increasingly become a core competency for CEOs, senior executives, and
board members.
This competency can only come through training, rehearsals, and direct experience of crisis situations”
![Page 17: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/17.jpg)
IIA Poll
![Page 18: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/18.jpg)
50%31%
15%
4%
Have clear, specific crisis
response procedures
Have general crisis
response procedures
Don’t know if
procedures exist
No Crisis Response
Procedures
IIA Poll
How would you describe you organization's crisis response procedures?
![Page 19: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/19.jpg)
The Internal Audit Role
![Page 20: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/20.jpg)
Before the Crisis
Communication Plan
Audit Committee
Involvement
Risk Committee
Involvement
Outside Help
Detailed Crisis
Management Plan
Executive Training
Vulnerabilities & Key
Risks
BoD Crisis Plan
![Page 21: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/21.jpg)
HELP
HELP
HELP
During the crisisDuring the Crisis
Consultancy /
Recommendations
Communication
Crisis Committee
![Page 22: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/22.jpg)
After the Crisis
Root-Cause Analysis
Lessons Learned
Recovery Efforts
![Page 23: Deloitte proposals template - IIA-MALI · Crisis Management Vs. Business Continuity Some equate Crisis Management with Business Continuity Planning. Business continuity plans are](https://reader033.vdocuments.us/reader033/viewer/2022060318/5f0c83b07e708231d435c8f9/html5/thumbnails/23.jpg)
References
A Crisis of Confidence Deloitte www.deloitte.com/acrisisofconfidence
Global Perspectives And Insights Crisis Resilience The Institute of Internal Auditors
Business Continuity Management Practice GuideThe Institute of Internal Auditors