Sands

Table of Contents

Pelican Sands. 1

Table of Content 2

Non-Critiquing Evaluation. 3

Critique Evaluation. 6

Action Plan (Fixing the Problem) 9

References. 12

Pelican Sands

            Often, different executives express different opinions about the same incident. Usually, they all make good points, since they are experienced professionals. This paper will focus on differing executive responses to a critical situation: the wrong dispatch of produce. (Please refer back to the simulation for this incident)

The Wrong Dispatch of Produce

A logistical problem can lead to a wrong dispatch of produce, which then results in an operational crisis that requires immediate attention. Different executives have diverse solutions to this problem.

Observations

Table 1

Opinion from different Executives

Executive	Choice	Resulting Newspaper Story	Cost
COO	Recall some produce and reroute the rest. The best option is rerouting the shipments. Although it may be time-consuming and costly, this is the best way to keep our daily delivery promise. If we accept this idea, I can implement the plan within two hours.	CVN leaves some stores off its routes. Uneven availability at CVN stores leaves customers annoyed.	2.15M
CFO	Allow the franchises to decide. Financially, it is best to trust our franchises and let them decide to sell or withhold the produce. This way, we will minimize our losses without either ruining the delivery schedule or the breaking the promise of freshness.	What’s up at CVN? Why is CVN letting your vendors sell rotten fruit?	0.91M
CRO	Recall the produce. The risk of not recalling the procedure is too large to go through; it would compromise both the promise of daily delivery and the produce’s freshness. This will be expensive, but experiencing one day’s loss is better than compromising our brand image.	No delivery at CVN stores. Empty shelves mock waiting customers.	0.63M
N/A	Do nothing.	N/A	0 M

Analysis

Table 2

Analysis from different Executive Opinion

Executive	Solution	Major Issues of Concern	Strengths of the Solution	Possible or Actual Advantageous Results
COO (0.91M)	Recall some produce and reroute the rest.	Retain delivery promise. Minimize the effort required to implement a solution.	It is easy to implement, and it costs less money than some alternatives. From an operations perspective, our most important concerns are operation effectiveness, the supply chain, and customer happiness.	With this solution, we can still accomplish most of the deliveries, although some will be inconvenient. This solution also tries to mitigate our losses. Although the customers may be slightly upset, they will remain content overall if they still receive their deliveries.
CFO (0.63M)	Allow the franchises to decide.	Reduce losses and save money.	This is the most cost-effective solution. This solution allows timely delivery and could preserve the food’s freshness. From a CFO’s perspective, costs and profits are the most important concerns.	This solution mitigates current losses and minimizes the expenses otherwise needed to respond to the crisis. Consider how much the other approaches will cost and how much profits they will sacrifice. The customers will still be content, because they will still receive their deliveries.
CRO (2.15M)	Recall the produce.	Protect the brand image.	This solution best protects the brand’s reputation. Organizational reputation and product brand name influences overall corporate value (Carroll 2012a). From an integrated risk management point of view, overall brand value is relatively more important than anything else (Barton 2007).	This solution will save the brand. It could even generate positive public relations; customers will think we are willing to sacrifice our earnings in order to protect our brand’s reputation.

The rest of this paper will assess the COO’s suggestion—recalling some produce and rerouting the rest. This solution is easy to implement and relatively inexpensive. Further, it keeps the delivery promise, at least partly, and it avoids wasting food.

 

 

Critique Evaluation

Table 3

Critique from Different Responses

	Solution	Ignored or trivialized considerations that limited or flawed the solution	Ignored or underrepresented risk-related groups and possible impacts	Origins and validity of primary concerns	Flawed perspectives or directions
COO (0.91M)	Recall some produce and reroute the rest (Selected Decision)	- Overall company risk - Marred brand image or reputation - The impact of criticisms from the press and mass media - Loss of food freshness after the reroute - Retention of long-term customer satisfaction	- Market risk - Supply chain - Brand image and reputation - Public relations - Operation silos (not integrated) - Customer satisfaction and loyalty - Overall company value	- Market risk: Freshness and quality are marketing variables - Press or mass media speculation: Exaggerations could ruin the company - Customer satisfaction and loyalty: Customers could feel slighted and refuse to buy the brand anymore	The COO merely considered operational ease, financial factors, and accounting indicators, ignoring the fact that market value and customer satisfaction play important roles in the company’s overall value. The COO emphasized a short-term turnaround, forgetting about the long term.
CFO (0.63M)	Allow the franchises to decide (This decision was not selected, but some of its points are also valid for the selected decision)	- Overall company risk - Operational effectiveness (it is unwise to ask local franchises to execute decisions without centralized facilitation) - Long-term customer satisfaction and retention	- Same as above - Financial silos (not integrated)	- Press speculation: The media could call the food rotten, and the whole company could lose value - Customer satisfaction: People could say the company values its profits over its customers, even compromising product quality - Public respect: People could think the company lies to the public in order to evade problems	The CFO merely considered financial and accounting indicators, ignoring the fact that market value and customer satisfaction play important roles in the company’s overall value. The CFO emphasized a short-term turnaround, forgetting about the long term.
CRO (2.15M)	Recall the produce	- Financial feasibility	- Have taken considerations of financial situations, but still cannot overcome overall company lost - Risks are somewhat integrated	- Responsibility: The company is willing to accept its responsibility, regardless of profits lost when solving the problem. - Customer and service quality: The company cares	The CRO targeted long-term mutual benefits between the company and its customers by accepting a short-term financial loss.

Although Table 3 describes many important points, the following sections will focus on three of its most important concepts.

Enterprise Risks vs. Silos Risks

Each of these organizations (finance, operations) is responsible for a focused risk area, essentially working from the bottom upward. Senior management is responsible, from the top down, for all corporate risk issues. Enterprise risk management (ERM) differs from the traditional, siloed approach to risk; it views risk holistically. ERM incorporates risks from all sources, including anything that could affect strategic objectives, operational goals, and financial targets. It then creates a common risk management strategy, which coordinates individual risk elements into a cohesive approach. ERM is impact-based, targeting a threat against pre-defined objectives (Carroll, 2012b).

Brand Value and Company Reputation

The value of an enterprise has two forms: tangible assets and intangible assets. Intangible assets include expected profits from operations, intellectual property, brand equity, and reputation. These assets are major contributors to the value of the enterprise, and they could be regarded as tangible assets when determining company value (Carroll, 2012a).

To illustrate the importance of reputation or brand equity, consider the impact of brand value on retail value. Customers can buy a two-liter bottle of generic soda for $0.99, but they must pay $1.59 or more for a brand name such as Coca-Cola or Pepsi. This price difference is largely due to the brand’s value and the company’s reputation, not the costs of production. (In fact, the opposite is probably true; Coke and Pepsi products are likely cheaper to produce, considering the companies’ large product volumes, than products of lesser-known brands, which are produced at smaller volumes.) There may be a difference in taste, but, often, this factor alone does not justify the price (Carroll, 2012a).

Brand and reputation equity are paramount for the modern corporation. This axiom has been amply illustrated by the trials and tribulations of the Lehman Brothers, MF Global, Martha Stewart, Marsh, Arthur Andersen, and numerous other companies whose reputations have been dealt severe blows during recent years. Many of these companies have never recovered (Carroll, 2012a).

Marketing Factors

Pelican Sands targets the organic food market. Consequently, marketing segment variables include quality of food, freshness, and organic status. Customers buy Pelican Sands’ products because they think that these products are higher in quality than regular fruits and that eating organic fruits can help them maintain better health. After the crisis, it would appear that Pelican Sands does not, in fact, sell high-quality foods. As a result, the customers would no longer feel that buying Pelican Sands food makes them special. If the company does not handle its public relations carefully and consequently loses its brand value, then customers will turn away from Pelican Sands.

Action Plan (Fixing the Problem)

Table 4

Convince Executives to Take Risk Management Approach

Choice	How would you convince senior management that they are not out of the woods as yet and in fact may be in deeper?	What evidence would you use to bring this forward?	How would you explain the success(es) cited in #1?
Recall some produce and reroute the rest (Selected Decision)	I would enumerate all possible risks and their impacts. What if the press said, “CVN leaves some stores off its route; uneven availability at CVN stores leaves customers annoyed”? Or, what if the press said, “What’s up at CVN? Why is CVN letting your vendor sell rotten fruit”? What if the supply chain problems continue happening on a recurring basis? Even though the company did not violate any laws, the public might accuse the company of dumping substandard produce. Customers will not be satisfied, and sales will decrease over the long term. Some people might even suspect a conspiracy. Consumers on the street may continue to be wary of CVN for some time.	Brand and reputation equity are paramount for the modern corporation, as demonstrated by the trials and tribulations of Lehman Brothers, MF Global, Martha Stewart, Marsh, Arthur Andersen, and many other companies that have marred their reputations during recent years. Many of these companies have never recovered (Carroll, 2012a). I would emphasize that the current tactic is focused only on the short term; it does not provide any strategy for the long term. I would gather and cite past studies, stories, lessons learned, and experiences.	I would note the sales figures of similar case studies after a brand image has damaged. The sales may rise in short run but will decrease in the long run. I would, again, emphasize that the current tactic is focused only on the short term; it does not provide any strategy for the long term. I would hire an external expert to convince the others that we need to do more. I would collect public opinions about the company’s image after the crisis. I would gather and cite past studies, stories, lessons learned, and experiences.

Table 5

Action Items

Action	Description	Target Goal
Create a public administration program	When a crisis strikes, it is important to maintain consistent communication from the affected organization to the public. The corporate communications department should document all communications to outside parties (e.g., the press) and should disseminate this information to every individual in the organization, thereby ensuring a consistent message.	Reverse and supplement
Fix the supply chain	The supply chain bears the initial costs of any shipment mistakes. We need to avoid repeating the same mistakes. At the very least, we should ensure that similar mistakes will not reoccur often.	Prevent
Ask the franchises to dump all the food	It is too late to ask the end retailers to return the delivered food, but you can tell them to dump the food themselves. Ask them to dispose of any foods that have known or visible problems. If they cannot determine whether certain foods have problems, they should dump them as well.	Reverse

Public Relations Program

Crisis media training best practices. The public administration program described in Table 5 needs further elaboration. To run the program successfully, the communications personnel should follow a few public-relations best practices (see also Lerbinger, 1997; Feran-Banks, 2001; Coombs, 2007).

1. Avoid the phrase “no comment”; people think it means the organization is guilty and is trying to hide something

2. Present information clearly by avoiding jargon and technical terms. A lack of clarity makes people think an organization is purposefully confusing its customers in order to hide something.

3. Appear pleasant on camera by avoiding nervous habits, which people often interpret as signs of deception. A spokesperson needs to maintain strong eye contact, limit disfluencies such as “um” and “uh,” and avoid distracting nervous gestures, such as fidgeting or pacing. Coombs (2007) reports that speakers will be perceived as deceptive if they avoid eye contact, use many disfluencies, or display nervous gestures.

4. Brief all potential spokespersons on the latest information about the crisis, focusing on the key message points that the organization wants to convey to its stakeholders.

Public relations program composition. Most organizations, of all sizes, have public relations or corporate communications persons or teams to address public-relations issues. Absent this, someone—typically a senior manager—should be deemed a liaison to the public. After this spokesperson is selected, no one else from the organization should communicate on behalf of the organization, in any form. In fact, no one should communicate publicly at all; whatever is communicated will be interpreted as representing the viewpoint of the organization. Consequently, this is a role best handled by professionals.

This endeavor requires significant planning, which is the responsibility of the continuity professional. The company should establish a formal communications program that identifies internal and external organizations, agencies, and media groups. This program should craft a defined crisis-communications plan for all communications with authorities (local, regional, etc.) and with those affected by the organization's success during the crisis (e.g., employees, customers, and shareholders).

Written plans are essential; they provide a guideline or structure for ensuring that the public relations program addresses all parties consistently. However, any given crisis may require distinct and specific communications activities, depending on the situation; hence, following a written plan exactly is not always optimal. Nevertheless, a plan provides a framework that can be adjusted for each situation. Without a pre-established plan, the public relations personnel are unprepared, and they must make up the process as they go along.

Like all dimensions of continuity planning, this area should be tested, either as a separate and distinct crisis test activity or as part of an overall continuity and recovery test. Commonly, organizations test their public relations plans via mock crises that actually escalate into full-blown business continuity and disaster recovery tests.

Supply Chain

A flaw in the supply chain is one of five threats that could destroy a company (Vinas & Jusko, 2004). When facing a problem in the supply chain, a company must consider what can and cannot be controlled. The company can control what products it makes, where it stores those products, and how the products are shipped, for example. To operate properly, an organization must be competent in these areas. For example, it must maintain its inventory well, keeping the right products in stock at the proper levels and at the right times. Making the wrong products, shipping products late, or sending products to the wrong markets will obviously have a negative impact.

References

Barton. (2007). Making enterprise risk management pay off.

Carroll. (2012a, spring). 01 MET AD 610, week 1 lecture notes.

Carroll. (2012b, spring). 01 MET AD 610, week 2 lecture notes.

Coombs, W. T. (2007). Ongoing crisis communication: Planning, managing, and responding (2nd ed.). Los Angeles: Sage.

Fearn-Banks, K. (2001). Crisis communications: A casebook approach (2nd ed.). Mahwah, NJ: Lawrence Erlbaum.

Lerbinger, O. (1997). The crisis manager: Facing risk and responsibility. Mahwah, NJ: Lawrence Erlbaum.

Vina and Jusko. (2004). 5 threats that could sink your company. Industry Week, 253(9), 52. ABI/INFORM Global.

Eric Tse, Richmond Hill, Toronto
Tse and Tse Consulting -Security, Identity Access Management, Solution Architect, Consulting 
http://tsetseconsulting.webs.com/index.html
http://tsetseconsulting.wordpress.com/
http://erictse2.blogspot.com/

CISSP:

CISSP:  CISSP:  Choose/identify a regulation, standard or certification that has ‘potential’ business continuity ramifications. Write a structured, detailed, well-researched and well supported synopsis on how this requirement came about and where this applies (and doesn’t apply). Eric Hiu Fung Tse- AD 610- Week5 -  Assignment

 

Table of Content

CISSP: 1

Table of Content 2

CISSP (Certified Information Systems Security) 3

What was the catalyst or need identified that gave rise to this requirement? What agency or body monitors or oversees this?. 3

Is it direct or indirect (or both)? If indirect, what makes it necessary or applicable?. 4

What is the risk associated with non-compliance?. 5

What is the potential impact or limitations associated with this requirement?. 6

Potential impact 6

Limitations. 6

What are the cost factors associated with compliance or non-compliance? Where do you see this going in the long-term (other industries, countries, etc.)?. 8

Reference. 9

CISSP (Certified Information Systems Security)

I would like to talk about CISSP certification. It is one of the certificates related to my profession.

What was the catalyst or need identified that gave rise to this requirement? What agency or body monitors or oversees this?

Certified Information Systems Security Professional (CISSP) is an independent information security certification governed by International Information Systems Security Certification Consortium (ISC)². (ISC)² is a self-declared Non-profit organization ((ISC)², 2009) but is not a Charitable Organization under the applicable Internal Revenue Service Code.

In the mid-1980s a need arose for a standardized certification program that provided structure and demonstrated competence. In November 1988, the Special Interest Group for Computer Security (SIG-CS), a member of the Data Processing Management Association (DPMA), brought together several organizations interested in this. The International Information Systems Security Certification Consortium or "(ISC)²" formed in mid-1989 as a non-profit organization with this goal. (Harris, Shon, 2010)

 Talking about Cultural BCM differences, there have been a number of specialist areas incorporating business continuity into their own disciplines. The first to do this was information security, which led to confusion between business continuity and IT backup and recovery. This confusion was formalized to some extent by its inclusion in the BS 7755 Information Security Standard, which eventually became the ISO 27001 standard. As this standard has been widely adopted in such places as India, Japan, and Korea, the first references to BCM many people experienced came as part of information security. This misconception then became incorporated into many education and certification programmes such as CISSP. (Hiles, 2007)

Is it direct or indirect (or both)? If indirect, what makes it necessary or applicable?

The below describes the outline of business continuity and disaster recovery planning knowledge domain. It would give us a better idea on how this requirement came about and where this applies. (Miller & Gregory, 2010)

1.      Defining Disastrous Events	1.1 Natural disasters 1.2Man made disasters 1.3 How Disasters affect
2.      How BCP and DRP Work Together	2.1 COOPeration is the key.
3.      Understanding BCP project Elements	3.1 Senior management support 3.2 Senior management involvement 3.3 project team membership 3.4 who brings the donuts
4.      Determining BCP Scope
5.      Conducting the Business Impact Assessment	5.1 Perform a Vulnerability Assessment 5.2 Carry out a Critically Assessment 5.3 Determine the Maximum Tolerable Downtime 5.4 Establish recovery targets 5.5 Determine resource requirement
6.      Identifying the Elements of a Business Continuity Plan	6.1 Emergency response 6.2 Damage assessment 6.3 Personnel safety 6.4 Personnel notification 6.5 Backups and off-site storage 6.6 Software escrow agreements 6.7 External communications 6.8 Utilities 6.9 Logistics and supplies 6.10 Fire and water protection 6.11 Documentation 6.12 Data processing continuity planning
7.      Developing the BCP Plan	7.1 Making your BCP project a success 7.2 simplifying large or complex critical functions 7.3 Documenting the strategy
8.      Implementing the Business Continuity Plan	8.1 Securing senior management approval 8.2 Promoting organization awareness 8.3 Maintaining the plan
9.      Disaster Recovery Planning – Developing a Disaster Recovery Plan	9.1 Preparing for emergency response 9.2 Notifying personnel 9.3 Facilitating external communications 9.4 Maintaining physical and logical security 9.5 Personnel safety
10.  Testing the Disaster Recovery Plan	10.1 checklist 10.2 structured walkthrough 10.3 Simulation 10.4 Parallel 10.5 Interruption (or cutover)

           

What is the risk associated with non-compliance?

BCP and DEP work hand in hand to provide an organization with the means to continue and recover business operations when a disaster strikes. BCP and DRP exist for one reason: Bad things happen. Organizations that want to survive a disastrous event need to make formal and extensive plans – contingency plans to keep business running and recovery plans to return operation normal.

So the risk associated with non-compliance is, if the company does not following the rules and procedures, they may not be able to keep their operation running or return operation normal when disasters happen. They do not have all the documented procedures and processes, or those procedures and processes are not tested, practices, assessed carefully etc.

I am wondering if there is any legal risk involved. There are other regulations such as SOX that operations have to follow. I am not sure if CISSP would directly related to legal regulations, but many enterprise security policies and mandate are quite similar with this. 

What is the potential impact or limitations associated with this requirement?

Potential impact

The CISSP business continuity framework provides a concise view of what IT security professional has to do with business continuity. Comparing the breadth and depth of the content against the ``Definite Handbook of Business and Continuity Management``, the CISSP BCP scope is like the tip of the iceberg. Of course business continuity is only one of the many topics in information security that they cannot be as comprehensive as the ones with BCI (Business Continuity Institute).

For the positive impact, CISSP BP does recover concepts like project initiation and management, continuing visible support, risk evaluation and control etc.

Limitations

For the limitations, CISSP BCP assumes all the BP works are done by a team CISSP professionals. BCI methodology is much more comprehensive. They assume there are separate internal multi-disciplinary organizations and people.  They have a two modes paradigm. They have an extensive corporate recovery team. They have HR interactions.

According to Business Continuity Methodology (BCM), the internal organization responsible for development, oversight, etc. of all business continuity planning should follow the plan (Organization chart) as above.

1) Two modes: development and operation (maintenance)

There are two effectively two areas of business continuity, one is the development or implementation teams, the other one is operation support teams. Since they belong to enterprise risk management and they have to be visible enough to get enterprise support, they are reported to CRO (Chief Risk Officer), who is reported directly to CEO or board of directors.

2) Extensive corporate recovery team

Corporate recovery teams: During recovery from a disaster or event, the business units within an organization will need to concentrate on restoring their own environment and become productive again. The technology support staff within an organization will be focused on providing a restored technical environment so that the business units can access their systems and data and become productive again. Therefore it will be necessary to create overall corporate recovery support teams that are activated during recovery procedures, These teams are comprised of company’s decision-makers who have the authority to declare a disaster status on behalf of the organization, as well as the authority to declare a disaster status on behalf of the organization, as well as the authority to release funds from the organization, deal with insurance companies, the press and process any employee personal claim or pay issues. (Hiles. 2007).

HR involvement

The human resources/personnel/training department of an organization must play key roles in installing appropriate training programmes for employees of an organization.

3) Interactions with External Organizations

For most organizations this is one of the weakest areas in the planning process (but it is getting better). In general, coordination between the private and public sectors has been a real challenge. This has improved significantly since 9/11, but there is still room for major improvement.

Procedures need to be in place for informing and communicating with public authorities during a crisis. Typically this involves the fire and police departments, but may involve other organizations, such as the Federal Emergency Management Agency (FEMA) and others. Plans should identify key contacts within these organizations and procedures for informing and communicating with these groups. Exchanging business cards or home phone numbers shouldn’t be an activity during time of crisis.

It isn't enough, though; simply to know who the local authorities are and inform them of the situation. Depending on your situation, environment, etc. there may be specific agencies (e.g., EPA) or laws that govern your situation. The process and requirements for communicating with these agencies should be clear. Management needs to conform to these requirements. There are an untold number of cases where the proper authorities were either not informed or not informed on time during a crisis. The results for the organization can be devastating.

External agencies can and often do assist with actual exercising/testing. This is highly recommended, since it validates your actual processes and provides for a better public/private partnership. Agencies are typically very willing to become involved in organizational exercises and can often bring a level of credibility and realism to any exercise. Like any exercise, results should be logged with actions and dates for resolution agreed.

What are the cost factors associated with compliance or non-compliance? Where do you see this going in the long-term (other industries, countries, etc.)?

When you implement the Business Continuity department using projects, there are costs incurred for with compliance. You may think about being non-compliance can save you a lot of money. But if you spend this money, it would greatly increase your business to keep operating or recover to operations when disasters happen. Imagine how much money if you are going to lose if your operations are down or not running. How much money per each hour?

Although the CISSP BCP is not as comprehensive as BCI methodology (BCM) for now, I can see things will get converge together in the long term. The (isc)?2 will incorporate the knowledge body of BCP from BCI since they are the expert. Eventually, the gap would be narrowed.

 

Please identify all sources (minimum 3) for your work.

(Note: Feel free to select from the list provided or research your one on your own, but make sure your choice is not a topic we have already addressed in course (i.e, don’t do HIPAA, Sarbanes, etc – recommend you check with your facilitator before starting).

Reference

(ISC)². 2009. "About (ISC)²", Retrieved November 23, 2009.

Harris, Shon (2010). All-In-One CISSP Exam Guide (5 ed.). New York: McGraw-Hill. pp. 7-8. ISBN 0071602178.

Hiles. (2007). The Definitive Handbook of Business Continuity Management 2^nd edition

Miller & Gregory. (2010). CISSP for Dummies 3^rd Edition.

 Eric Tse, Richmond Hill, Toronto

Tse and Tse Consulting -Security, Identity Access Management, Solution Architect, Consulting 

http://tsetseconsulting.webs.com/index.html

http://tsetseconsulting.wordpress.com/

http://erictse2.blogspot.com/