1 P&G BCP Process SCRLC February 2007 Meeting Craig Babcock, Procter & Gamble Business Continuity Planning Center Of Expertise.

1

P&G BCP ProcessSCRLC February 2007 Meeting

Craig Babcock, Procter & Gamble

Business Continuity Planning

Center Of Expertise

2

Agenda

Introduction

P&G Background

BCP Background

P&G BCP Process

Questions / Comments

3

Introduction

Craig Babcock Business Continuity Planning Manager - Manufacturing,

Purchasing, Contract Manufacturing, Distribution Global Fire Protection Manager 27 Years At P&G

Management Positions In Manufacturing, Warehousing, Technical Engineering, Safety, Fire Protection

Led P&G Industrial Hygiene & Safety Technical Network Current Member of the Health Safety & Environment Leadership

Team for P&G

4

P&G Background

The Largest Household & Personal Care Products Company In The World

#24 On The Fortune 500 List 70+ Billion Dollars In Sales 22 Billion Dollar Brands 3 Billion Times A Day Someone Uses A P&G

Product 180 Brands; 22 Product Categories 140,000 Employees; 80 Countries

5

P&G Background

6

P&G Product SupplyBackground

7

P&G Product SupplyBackground

Organized By Business UnitIncludes Manufacturing, Engineering, &

PurchasingHorizontal Processes In Place To Leverage

Size And Best Practices P&G Makes Most Of It’s ProductsMore Contract Manufacturing Is Occurring

8

BCP Background

Started July 2000 By The Board Of Directors Protect NOS, globalization, consolidation Audit Committee tracking BCP (2001 – present) Global Internal Audit audits BCP as part of General Controls

CIO Is The Corporate Owner Vice Chair provides executive sponsorship VP’s & GM’s on Leadership Council

BCP Well Established Throughout P&G Gillette / Braun / Duracell has strong program Wella acquisition is getting on board

9

BCP Leadership Council Direction, Priority SettingIssue Resolution, MeasurementLink to GLC

BCP Center Of Expertise Methodology, Standards, tools, training, counseling, calibration

Global Process Owners Develop & deploy business unitCBAs (e.g., global EAPs), standards & tools

Business Units Execution of BCP process, Plan ownership, testing, maintenance

BCP Organization

BCP Company Structure

10

BCP Organization

BCP COE

BCP COE (2.25 FTE) IT Disaster Recovery (0.5 FTE) Fire Protection (2 FTE) Workplace Services (0.25 FTE) Internal Controls Consultant (0.10 FTE) Discussion: How Many FTE’s Do You

Have?

11

BCP Implementation

Phase One – 2002 / 2003

Developed BCP Methodology (CBA’s, tools, etc.) Deployed to 87 Plants (sites, suppliers, etc.) Deployed to Global Purchasing Deployed to GBS Service Centers Deployed to Total Order Management Processes Deployed to CS/L Physical Distribution Center

sites Deployed to eBusiness

12

BCP Implementation

Phase Two 2003 / 2004

Deployed to 36 GO Sites Deployed to 23 R&D Sites Deployed to 23 PS Sites Prototyped with Contract Manufacturing

White Strips, Actonel

Many more sites have implemented since

13

BCP Tracking BCP Scorecard

BCP COE tracks overall progress and status Plans maintained and up to date Tested once/year GIA CSA’s completed as scheduled Key Supplier BCP Plans reviewed (i.e. HP, IBM) Next scheduled test Leadership review

Updated 4 times/year

14

Recent Crisis Events

Earthquakes – Kobe, Turkey, Pakistan Hurricane / Tsunami – New Orleans, Asia NA Tornadoes – Jackson, Lima North East US Power Outage Data Center Outages, IT Virus and Worms Civil Unrest / War – Caracas, Manila, Middle East Loss of Key Suppliers Fires and Floods SARS

15

BCP Process

Overview

1. Identify Business Interruption Limit

2. Risk Analysis and Critical Program Review

3. IT Disaster Recovery Review

4. Loss of IT, Site, People Contingency Plans

5. Crisis Management Plan

6. Document and Approve BCP Plan

7. Test / Exercise BCP

8. Maintenance

16

BCP Process

Step 1 - BIL

Determine the Business Interruption Limit (BIL) for each work process Manufacturing Offices

Determine the Recovery Priority for each work processes High, medium, low Strategy for initial recovery Discussion: Does Anyone Use A Similar Step In

Your Process?

17

BCP Process

Step 2 – Risk Analysis

Complete Risk Analysis Identify threats to the Site / Work Processes Determine an overall Risk Rating for each identified

threat

BIL’s help frame the Risk Analysis Short BIL’s create more concerns Longer BIL’s create less concerns

18

BCP Process

Step 2 - Critical Programs

Critical Programs help manage, control and reduce risks to the site

Ensure the programs are current and maintained Review follow-up action steps to see where BCP

exposure exists Use Business Interruption risk filter Examples

• No sprinklers in part of facility

• Lack of critical spares

• Local IT operations (LIM)

• Discussion: Do You Have Separate Risk Mitigation Programs?

19

BCP Process

Step 3 - IT Disaster Recovery

Review Regional Data Center applicationsCritical applications only (see BIL’s)Participate in an IT DR Regional Exercise

Review Local IT DR Infrastructure – WAN, LAN, PBX, etc.Critical applications on local servers

Confirm site readiness

20

BCP Process

Step 4 – Contingency Plans

A Contingency Plan is a set of procedures used to restore the business operation

Loss of SiteLoss of ITLoss of PeopleAny high or medium risk from the Risk

Analysis

21

BCP Process

Step 5 – Crisis Management Plan

The set of procedures used if the Site Leader declares a Crisis

Site/Crisis Team Leader, Team Members, Back-ups Command center location and backup Assessing Crisis and Business Recovery Priorities Invoking contingency plans Linking with Category, Country, Regional Crisis Teams

22

BCP Process

Step 6 – BCP Distribution Crisis Team Leaders - keep a copy at work,

home, and in car (trunk, boot, etc.) BCP Functional Leaders - keep your specific

plans (Loss of IT, Site, People) in a similar manner

Many sites now distributing CD’s and USB memory sticks Still need paper copies though

Use document revision controls

23

BCP Process

Step 6 - Management Approval Typically review with the Site Leader, the Category

Director, and the Manufacturing Director / VP Review and approval required every year Leadership may ask to see your BCP at any point in time,

particularly if prompted by world events The BCP COE should review for content, feasibility, and

standardization Discussion: What Level Of Management Approval Is

Required?

24

BCP Process

Step 7 - Plan Testing

The Site Leader and the Site BCP Owner will determine the complexity and timing of tests The BCP COE can also serve as a resource for

determining scope of testing required

All sites must test at minimum once every year Choose either Loss of IT, Site, or People Rotate scenarios Test Local IT DR annually Update/Test call trees every qtr. Discussion: How Often Do You Test?

25

BCP Process

Step 8 - BCP Maintenance

Ways to maintain Incorporate BCP into change control processes Post BCP Action Plan, Test Results, etc on Activity

Boards / Sharepoint Make BCP part of scorecards and Mgmt. reviews

Site BCP Leader forwards qtr. status to COE Site BCP Leader conducts BCP CSA

26

27

BCP Program

Learnings

This is a big effort across the Company but only 1 to 2 effort weeks per site leader

Well structured CBA disarms ‘too much work’ emotion & provides roadmap to follow

The BCP Process reveals unknown risks within the plant and to suppliers

Role of leadership key, role model behavior and organization will engage

Keeping the BCP updated will require leadership attention or it will fade away

Purchasing was and continues to be a big chunk of the work in PS

28

BCP Program

Learnings

Sites are much more dependent on IT than they were 6-7 years ago.

Finding that some IT applications do not have sufficient contingency plans was an eye opener

Organizations will try to reinvent the wheel - a standard process is key to robust BCP

Auditing for compliance is essentialSome plants are using BCP material for on boarding

new managers because of detail about site capturedExamples of plans are helpfulTests are used to improve the plans

29

BCP Program

Learnings From Disasters

Katrina Expect Rapid Competitive Response Lead, Do Not Manage Need Exceptional HR Resources

JacksonBlue Ash Data Center

Widespread IT Outages Are Very Impactful Our Back-Up Plans Were Not Robust Enough

30