Business continuity & disaster recovery: lessons from Palestine

Acts of terrorism and various widespread natural disasters have underlined the substantial risk of major operational disruptions to the financial system. Financial industry participants have common interest in promoting the resilience of the financial system to such disruptions1.

http://www.iaeme.com/IJM/issues.asp?JType=IJM&VType=7&IType=1

Journal Impact Factor (2016): 8.1920 (Calculated by GISI) www.jifactor.com

ISSN Print: 0976-6502 and ISSN Online: 0976-6510

© IAEME Publication

BUSINESS CONTINUITY & DISASTER RECOVERY: LESSONS FROM PALESTINE

Riyad Mustafa Mohammad Abu Shehadeh Research Scholar, RTM Nagpur University

INTRODUCTION

Acts of terrorism and various widespread natural disasters have underlined the substantial risk of major operational disruptions to the financial system Financial industry participants have common interest in promoting the resilience of the financial system to such disruptions1

The Palestine Monetary Authority2 (PMA) being the regulatory authority for the banking system in Palestine has paid great attention to this vital issue due to its importance to the stability of the Palestinian banking system especially in the light of the huge political risk in Palestine resulting from the Israeli occupation and the impact of occupation on all spheres of the Palestinians' life mainly the economic sector

As part of the ongoing efforts of the PMA to preserve the safety and soundness of the banking sector, enhance the confidence of the public in the banks, continuity of the financial services and maintaining the financial stability in Palestine, the PMA has adopted a strategy, plans and processes to mitigate different kinds of risks facing banks, especially in disasters, contingency and emergency cases The business continuity and disaster recovery regulations issued by the PMA to the banking system in 2012 was tested practically during 2014 Israeli war against Gaza

Key words: Disaster Recovery, Business Continuity, Risk Management,

Crisis Management, Alternative Sites (AS)

Cite this Article: Riyad Mustafa Mohammad Abu Shehadeh Business

Continuity & Disaster Recovery: Lessons from Palestine International

Journal of Management, 7(1), 2016, pp 26-41

http://www.iaeme.com/IJM/issues.asp?JType=IJM&VType=7&IType=1

IMPORTANCE & OBJECTIVES

Palestine is a unique country It is not fully independent and does not have full control over its own land, economy and borders This has added more challenges and risks that the banking system had to face, absorb and mitigate The PMA was proactive to adapt its supervisory systems and regulations to the best international practices including in the field of business continuity and disaster recovery The World Bank

(WB) and the International Monetary Fund (IMF) have commended PMA on its experience in the field of business continuity and disaster recovery3 The WB requested the PMA to participate with the group of payment systems development with other central banks and the WB aiming to develop crisis management manual for the payment systems4 This paper aims at highlighting the singularity of the Palestinian experience in this field and the impact of the achieved results on financial stability

BROAD PROBLEM AREA

Palestine is a unique country with unusual circumstances due to the Israeli occupation, incursion, curfews and wars that severely impact banks' business continuity and ability to maintain banking services in stress scenarios Two years after the inception of the Palestine National Authority (PNA) in 1994, Intifada (Uprising) erupted in 1996 and has seriously affected lives of the Palestinians Economy was severely hit The second Intifada erupted in 2000 and it has seriously affected the business continuity of the banking system, in 2008, 2012, and 2014 several wars were started by Israel against northern governorates (Gaza) PMA had to take several measures to coupe up with the results of the wars and its impact on the banking

system and continuation of services to the customers

LITERATURE REVIEW

Basel Committee on Banking Supervision (BCBS)

The issue of business continuity in the financial industry has attracted international

importance To this end a joint forum from BCBS and International Organization of

Securities Commissions (IOSCO) and International Association of Insurance

Supervisors (IAIS) was established and issued a paper titled "High-level principles for

Business Continuity" in 2006 The paper has set the definitions of the alternate site as

"the site that is held in readiness for use during a business continuity event to maintain

an organization's business continuity The term applies equally to the work space or technology requirements Organizations may have more than one alternate site In some cases, an alternate site may involve facilities that are used for normal day-to-day operations but which are able to accommodate additional business functions when a primary location becomes inoperable" The paper has also identified the business continuity as "a state of continued, uninterrupted operation of a business Business continuity management is a whole-of-business approach that includes policies, standards, and procedures for ensuring that specified operations can be maintained or recovered in a timely fashion in the event of a disruption Its purpose is to minimize the operational, financial, legal, reputational and other material consequences arising from a disruption" The high-level principles for effective business continuity management are applicable to both financial industry participants and financial authorities Below are a brief of those principles as set by the (BCBS):

Principle 1: financial industry participants and financial authorities should have

effective and comprehensive approaches to business continuity management An organization's board of directors and senior management are collectively responsible for the organization's business continuity

Principle 2: financial industry participants and financial authorities should

incorporate the risk of a major operational disruption into their approaches to business

continuity management Financial authorities’ business continuity management also should address how they will respond to a major operational disruption that affects the operation of the financial industry participants or financial system for which they are responsible

Principle 3: financial industry participants should develop recovery objectives that

reflect the risk they represent to the operation of the financial system As appropriate, such recovery objectives may be established in consultation with, or by, the relevant financial authorities

Principle 4: financial industry participants and financial authorities should include in

their business continuity plans procedures for communicating within their organizations and with relevant external parties in the event of a major operational disruption

Principle 5: financial industry participants’ and financial authorities’ communication

procedures should address communications with financial authorities in other jurisdictions in the event of major operational disruptions with cross-border implications

Principle 6: financial industry participants and financial authorities should test their

business continuity plans, evaluate their effectiveness, and update their business continuity management, as appropriate

Principle 7: business continuity management should be reviewed by the financial

authorities Financial authorities should incorporate business continuity management reviews into their frameworks for the ongoing assessment of the financial industry participants under their jurisdiction

PMA's Business continuity regulations

PMA has developed a road map keeping in mind to maintain soundness, stability and resilience of the banking system in Palestine Since 2006 it started to update the entire required legal infrastructure to meet these objectives including revisiting laws, regulations, instructions and circulars meant to enhance banking supervision5 The business continuity instructions no 2/2009 that the PMA issued to the banks was a milestone in this direction Business continuity management in banks is considered an important risk management tool Due to the nature of the political and security situation in Palestinian that is characterized by instability and volatility, additional risks resulted that banks in Palestine have to mitigate in addition to the operational risks and risks of natural disasters So, the PMA required banks to develop and have a predetermined business continuity plans In brief the PMA instructions to the banking system covered the following main areas:

Definition of business continuity management

The business continuity management means "standardized methods set for the operational continuity of the business in any bank in emergency situations It also includes policies, standards and procedures to be taken to ensure continuity of operations in emergencies and/ or restore normal operations in a timely manner, in order to reduce the operational, financial, legal and reputational risks and other substantial effects of business disruption and emergency cases" All banks in Palestine were instructed to follow pre identified steps to maintain business continuity in the event of risk The business continuity management plan should be defined, written

and a comprehensive action plan which sets out the procedures, processes and systems required for the continued restoration of operations at the bank in cases of disruptions and emergency

The plan should be determined according to the needs and the vision of each bank for the business management in emergency situations and risks

The risks and threats faced by banking system

Banks face different risks and each of them requires a different mitigation measures Banks being deposits takers can suffer a huge lose in case of business disruption since

it has a severe impact on the customers confidence Some of the risks that banks may face are fraud, theft, extortion, armed robbery, human errors, terrorist operations, civil disobedience, riots, internal disturbances, strikes and wars Banks may as well face natural disasters including fire, flooding, bad snow storms, heavy rains and tornadoes Banks may also face air pollution and chemical spill, earthquakes, volcanoes, epidemics and infectious diseases Banks are also subject to technical disasters like communications outages, blackouts, deficiencies in equipment, and shortcomings in the software

The scale of the disaster

The scale of the disaster might include one room or set of rooms, entire floor, the whole building, the entire facility, entire industrial or commercial sector or the entire State

The objectives of developing business continuity plans

In addition to the goal of protecting the reputation of the bank through development of the business continuity plan, there are many other objectives that include reduction of impact of losses or injuries among individuals and fixed assets and information systems, promptly and effectively respond to the threats and risks, flexibility and management capacity in the abnormal conditions characterized by significant imbalances, enhancement awareness of the banks' staff about the importance and purpose of business continuity, recovery of the critical processes and the costs, compliance with the legal requirement of the contracts and relevant laws as well as maintaining the integrity and quality of business continuity plan and keep readiness through regular review and update

The relationship between business continuity management and risk

management

The risk management process is associated with the business continuity plans and they complement each other as business continuity is integral part of operational risk management

The period covered by business continuity management plan

Developing business continuity plan must be made keeping in mind that it should run

to a period not exceeding one month If the event or the risk continues more than a month then it becomes an integral part of the environment in which the bank operates and therefore the bank should develop and have in place working procedures for the event and not a contingency plan

Responsibilities of the Board and senior management

The responsibilities of the board of directors and senior management include:

1 Adoption of the business continuity plan and any amendments thereto, and the development of appropriate policies to improve the ability to work in the event of irregular operating business

2 Establishment of a special committee to handle business continuity management

3 Approval of a working team

4 Ensuring that there is a policy of risk management processes, developed and constantly updated and to make sure their application

5 Allocation of the necessary resources, including financial and qualified human resources

6 Receiving reports regarding the progress of the of business continuity, including the results of the implementation and examination of the plan, and the errors found in the application process of the plan

7 Ensuring review of the plan by an independence party such as internal or external auditor

The use of historical data and databases

All banks must prepare and create a detailed database of all operations and functions

in the bank and that the data include:

1 All the detailed operations and functions in the bank and the time to complete them as well as the required number of needed staff

2 Detailed customers data and the nature of the services provided to them and their addresses

3 Detailed data on staff and their skills and the processes and functions

The review and update of the plan

The plan must be reviewed and updated periodically , based on the following:

1 Examination results

2 Change in the plan for the team, and employees of an organization that affects the plan

3 Use of new technology that affects the work environment

4 Introduction of new banking services or abandon of other services

5 Opening of new banking branches, closure or shifting of branches/offices

6 Adoption of a new marketing policy

Plans of business continuity management

Business continuity plans vary from one bank to another depending on the nature of the business, the size, the geographical spread of its operations and the environment in which it operates But it is proposed to divide the business continuity management plans to the three main components:

1 Business Continuity Plan for departments and branches It should contain

establishment of the business continuity team and choosing representatives of relevant departments on the command center in charge of branches and departments

business continuity Contact details of the chosen team members should be clearly written Substitute for each member should also be identified The critical functions, how to restore them in case of disaster and the required staff to do so need to be clearly identified Required budget need to be arranged and the plan need to be tested

on regular basis

2 Disaster recovery plan (DRP): this plan aims to restore all operations relevant to

information technology in a quick and efficient manner in case of risk and threat It includes going back to the normal conditions after overcoming the disaster situations This plan works consistently with the business continuity plan of the departments and branches This plan makes available to the business continuity plan the needed physical needs required for the business continuity in the departments and branches

3 Crisis Management Plan: this plan comes to complete the previous two plans as the

first plan describes the necessary written procedures that need to be taken as to face the expected risks and threats, whereas the second plan is aims to preserve the information technology environment that the bank works within And ultimately preserve the bank's information that is considered to be critical for the bank maintain operations, whereas the third is crisis management plan that accomplishes business continuity plans as a whole and it depends on how to deal with the risk or threat when

it happens and the required procedures from all the staff and providers to seal with those risk The main reason to develop disaster recovery plan is to preserve lives and health of the staff in addition to the aims meant to achieve through business continuity plans

4 Business continuity measure taken by the PMA:

Implementation of an effective business continuity management at the PMA

He PMA being the regulator of the banking system has developed its own business continuity plan and the (AS) to ensure the continuity of its operations in case of disasters and crisis PMA has taken several steps to put in place an effective and efficient business continuity plan for its own operations Those steps are listed below:

1 Develop Strategies and business continuity policies within the PMA

2 Surveyed all the PMA departments aiming to defining critical operations within the PMA

3 Defined the PMA's necessary staff that is needed to perform all the defined critical operations

4 Made ready the business continuity plan

5 Made ready the needed logistics

6 Trained and qualified the staff assigned to follow up the implementation

7 Information technology

8 Premises and (AS)

9 Conducting periodical tests to ensure viability

10 Review the procedures and steps in light of recent developments in this field issued

by the regulatory bodies' i.e Basel Committee

The PMA processes adopted for the implementation of an effective

program for business continuity management at banks:

PMA has taken many steps to build up and enhance its' capabilities in the field Following are the most important steps taken by the PMA:

1 Training and qualifying of the staff assigned to follow up the implementation of business continuity management program

2 Developing the business continuity and information technology supervision unit within the Supervision and Inspection Department (SID) that follows up the banks' commitment to implement an integrated program for the business continuity management and audit of information technology in the banks

3 Issuing instructions to the banking sector to prepare a comprehensive business continuity programs and preparation of the (AS's)

4 Development of several pre requisites that should be available in the banking premises prior to granting the necessary licenses to start the banking business The most important criteria was the presence of emergency exits and first aid equipment, doors, windows, safes, and manual and automatic fire extinguishing equipment, and providing multiple sources of energy licenses (alternative electricity generator and a central UPS), as well as providing a stockpile of fuel, which is enough for a month

5 Centralization of the banking operations: executing the large banking operations centrally, rather than through branches have many advantages i.e providing the adequate supervision and the alternative procedures from other sites to implement in the emergency situations

6 Alternative sites: in addition to centralization of the banking operations, the PMA has required the banks to provide alternative working sites located at least 50 kilometers from the main head office so as to run the main operations through the (AS) when necessary The (AS’s) have been tested to guarantee its smooth functioning at emergency and crisis time

7 Disaster Recovery Sites (DRS): running operations through the DRS makes it easier

to control, fulfils better security requirements and provides public safety

8 The formation of liaison groups (PMA & banks) to follow up and better manage any crisis on timely basis

9 Rationing banks working hours to ensure the continuity of financial services during the crisis

10 Intervene in the arrangements of transporting banks employees in Gaza in ambulances during and after the war and during the truce

11 Facilitating availability of hundreds of thousands of liters of the needed fuel through coordination with fuel stations to keep Gaza banks operational

12 Green energy: the PMA encouraged the banking system to utilize the green energy to help overcome shortage of electricity

13 Efficiently managed the available liquidity with the Gaza banks to avoid liquidity crisis

14 Helped and facilitated cash shipments amongst banks to feed ATM’s with needed cash during the war

15 PMA managed efficient and effective communication methods including the use of timely mobile messaging system

PROBLEM STATEMENT

How to enhance banks' ability to continue providing banking services during crisis?

Hypothesis

H1: The PMA's regulation in the field of disaster recovery & business continuity

enhanced banks' ability to continue banking services during war time in 2014?

RESEARCH METHODOLOGY

Taking into consideration the importance of the issue, the researcher adopted

sampling population aiming to arrive at accurate results The researcher has used the

questionnaire tool to collect the needed data and he used Likert scale to measure the

variable (banks' ability to continue banking services during war time in 2014)

A: Target populations and Sample Size

Our target population will be Gaza based banks that operated and provided services to

the customers in Gaza during war time of 2014 The same will be our sample size

B: Source for the data

To collect primary data questionnaire will be distributed to all banks that operated in Gaza during 2014 The PMA reports 2012-2014 relevant to the banking system in Gaza will be used

DATA ANALYSIS

By using SPSS model the results were as follows:

Banks' ability to continue banking services during crisis time

0.4%

8.4%

12.4%

47.5%

31.3%

strongly don’t agree don’t agree abstain agree strongly agree

Banks' ability to continue banking services during war time 2014

RESULTS

1 According to our analysis as shown in the annexure no 2 the hypothesis (The PMA's

regulation in the field of disaster recovery & business continuity enhanced banks' ability to continue banking services during war time in 2014) is accepted

2 There is a huge positive impact for the regulation on the ability of banks to continue

the banking services during crisis as we obtained 78% of the results as strongly agree and agree

RECOMMENDATIONS

We recommend the following:

1 Continue application and development of the regulations online with best practices

since it has a positive impact on the banking system services during a crisis

2 Continue regular meetings of the crisis management liaison group the PMA

established with the banking system

3 Adoption of the Palestinian model of crisis management in the countries facing same

circumstance

strongly don’t agree

don’t agree abstain agree

strongly agree Mean

Std Deviation

Banking services provided by branches are

acceptable during crisis time .0% .0% 2.4% 58.5% 39.0% 4.37 .536 Banking Hours are sufficient during crisis

Types of banking services are sufficient during

Non continuity of banking services during

crisis time did not affect customers' needs 2.4% 39.0% 19.5% 29.3% 9.8% 3.05 1.094 ATM's are distributed in a way that meets

ATM's are operational continuously 2.4% 7.3% 14.6% 31.7% 43.9% 4.07 1.058 ATM's make available continuously all

Cash withdrawals are made per the need .0% 2.4% 17.1% 58.5% 22.0% 4.00 707 Banking services are easily provided during

Needed time to get banking services during

All banking services are provided during

Sufficient staff were present in the banking

There was efficient communication with all

PMA's regulation in the field of disaster

recovery & business continuity enhanced

banks' ability to continue banking services

during war time in 2014

0.4% 8.4% 12.4% 47.5% 31.3% 4.009381 5203535

REFERENCES

[1] www.bis.org

[2] www.fsb.org

[3] www.imf.org

[4] www.worldbank.org

[5] www.pma.ps

[6] M.Rajeswari A Study on Credit Risk Management in Scheduled Banks

International Journal of Management, 5(12), 2014, pp 79-89.

[7] Dr Shivakumar deene, An Empirical Examination of Liquidity Risk

Management with Special Reference To Vijaya Bank International Journal of

Management, 6(11), 2015, pp 01-18.

NOTES

[1] High-level Principles for Business Continuity, 2006 A paper published on

BIS.org

[2] PMA was established as the regulatory authority in Palestine after the peace

process in the early 90's and took charge from Bank of Israel in 1995

[3] Source: PMA reports

[4] PMA, the Banking Anchor issue no 88, December 2015

[5] Source: www.pma.ps