1 Medtronic’s Practical Approach to Creating a Resilient Organization Discussion Outline • Company Background – Establish Context • Medtronic’s Risk Mgmt Strategy & Evolution • BCM at Medtronic • Our Methodology, Process and Tools • What We’ve Gained from BCM Medtronic: Driven By Our Mission The world leader in medical technology Focus on treating chronic disease Every 5 seconds, someone in the world benefits from Medtronic technology
15
Embed
Medtronic’s Practical Approach to Creating a Resilient ... · Approach to Creating a Resilient Organization Discussion Outline • Company Background ... operations through crisis
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
1
Medtronic’s Practical Approach to Creating a
Resilient Organization
Discussion Outline
• Company Background – Establish Context
• Medtronic’s Risk Mgmt Strategy & Evolution
• BCM at Medtronic
• Our Methodology, Process and Tools
• What We’ve Gained from BCM
Medtronic: Driven By Our Mission
The world leader in medical
technology
Focus on treating chronic disease
Every 5 seconds, someone in the world benefits from Medtronic technology
2
We’re a High-Tech, High-Growth Company
19%$2.41$0.17EPS*
20%$2.8 Billion$180 MillionNet Earnings
17%$1.2 Billion$120 MillionR&D Expenditures
16%$12.3 Billion$1.2 BillionSales
37,0008,000Employees
CAGR20071992
• Stock split adjusted
Strong financial position allows us to be self – insured.
Our Products Treat Diverse Medical Conditions
Parkinson’s Disease Essential Tremor Dystonia
Spasticity Chronic Pain Cranial Surgery
Irregular Heart Rates Heart Failure Cardiac Surgery
Unexplained Syncope Heart Valve Disease
Coronary Vascular Disease Peripheral Disease
Aortic Disease Spinal Deformities Herniated Disc
Degenerative Disc Disease Acute Tibial Fractures
Diabetes Urinary Incontinence
Gastroparesis Benign Prostatic Hyperplasia
Meniere’s Disease Ear and Sinus Infections
We Have a Strong and Growing Global Presence
37,000 Employees120 Countries270 Locations
44 Manufacturing Sites 25 R&D Centers
23 Training Facilities
3
Operations are Complex & Highly-Regulated
Implications to BCM Strategy
• Must support the Mission
• Must be proactive vs. reactive
• Focus must be on creating:– Agility
– Flexibility
– RESILIENCE!
Discussion Outline
• Company Background – Establish Context
• Medtronic’s Risk Mgmt Strategy & Evolution
• BCM at Medtronic
• Our Methodology, Process and Tools
• What We’ve Gained from BCM
4
Self-fund all losses through fronted insurance
Ensure quick and effective response and recovery to major disruptions to operations through crisis management processes and business continuity plans
Recent
Crisis Mgmt
PREPARE
Ensure continuity of operations at minimum acceptable levels through common risk strategy and standardized business continuity management process
Current
Crisis Management
BCM
PREVENT
Ensure successful achievement of companyobjectives through broader risk management scope
Build strategic risk management into companypractices, culture and strategic planning process
? Year Vision
ERM
Business Continuity Mgmt
Crisis Management
EXPAND
Self-manage key exposures to loss
Self-fund normal operating losses
Insure against catastrophicevents
Manage losses strategically
Historical
Insure
TRANSFER
How we manage BI loss exposure has evolved…..
Risk Management Strategy
BCM is One Part of ERM
Typical Enterprise Risk Management Categories
Developed Market Growth
Global Focus and Reach
Competition
Regulatory
Clinical Evidence
Customer Relationship Disruption
Company-Wide Growth Portfolio
Talent
Quality & Product Reliability
Financial
Intellectual Property
Legal/Compliance
“…the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.”
BCM Focuses on Operational Risk
OperationsOperations
Operational Risks Span the Value Chain
SupplierOperationalProcesses
Distribution Customer
• Supplier Selection/Development
• Supplier Interruption
• Supplier Mgmt
• Quality Issue
• Outsourcing
• Process Failure
• Facility Damage
• Utility Outage
• Equipment Failure
• IT Failure/Sabotage
• EH&S Compliance
• Record Destruction
• Key Person Loss
• Labor Shortage
• Workplace Violence
• Terrorism
• Health Epidemic
• Customer Service
• Customer BusinessInterruption
• Carrier Interruption
• Transportation Channels Unavailable
• Import/Export Compliance
They are not limited to physical disasters!!
5
Discussion Outline
• Company Background – Establish Context
• Medtronic’s Risk Mgmt Strategy & Evolution
• BCM at Medtronic
• Our Methodology, Process and Tools
• What We’ve Gained from BCM
Business Continuity PlanningStrategies and plans that ensure an organization
can continue to operate to a pre-determined
minimum capability/service level and meet
demand.
Crisis Management & Mobilization
Overall coordination of an
organization's response to a
crisis. Must be effective and
timely; Goal - avoid or minimize
impact to the organization's
employees, reputation, or ability to
operate.
IT Response & RecoveryPlans and actions designed to respond to
network/technology incidents and recover the
applications and infrastructure that support
business continuity.
Emergency ResponsePlans and actions to ensure human
health and safety, protect physical
assets and limit environmental
impact. Includes pre-planning for
localized events and notification and
interaction with local authorities in
emergency situations.
Program Integrates Four Key Disciplines
Based on BCI Definition of BCM
Business Continuity Management is a holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities.
Source: Business Continuity Institute (BCI)
6
Resiliency Defined
• Ability to recover from or adjust easily to misfortune or change.
• Capability to withstand shock without permanent deformation or rupture.
The ability to meet customer
demand in spite of a crisis event.
How Do We Make Medtronic More Resilient?
• Proactively manage our operational risks– Prevent or lessen the impact of a crisis event
– Mitigate single-points-of-failure
– Develop contingencies
• Develop business continuity plans – Ensure organized and quality response
– Reduce time to recover
• Create a risk management culture
Having a Plan is Not Enough
Business
ContinuityPlan
Addresses Responding to aCrisis Event
Risk Identification
and Mitigation
Strategy + Policy
Resources
Leadership + Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Risk Identification
and Mitigation
Strategy + Policy
Resources
Leadership + Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Business Continuity Management
Program
Focuses on Building Operational Resilience as well as Effective Response
7
Discussion Outline
• Company Background – Establish Context
• Medtronic’s Risk Mgmt Strategy & Evolution
• BCM at Medtronic
• Our Methodology, Process and Tools
• What We’ve Gained from BCM
BCM Best Practice Model
Enterprise View
Operational View
Key BCM process areas
BCM structural enablers
Process of identifying risks to critical processes, assessing the materiality / impact and prioritizing appropriate mitigation responses
Process of mitigating identified risks through
modifications to operational procedures
and practices, implementing alternative
business strategies, and developing
continuity and DR plans
Process of educating and training employees, building BCM into strategic planning
process and annually testing and maintaining
continuity plans
Tangible and intangible resources that support (tools, templates, website, etc)
and enable (funding, training, etc) the BCM processes
Organizational resources aligned to effectively support the BCM process as part of their operational responsibilities and accountabilities
Strategy + Policy
Resources
Leadership + Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Leadership commitment and governance mechanisms that clearly define, monitor and ensure accountability for BCM practices
Overarching strategy that defines risk components, e.g. tolerance levels, and
outlines the approach for ensuring business continuity at an enterprise level
*Model provided by PA Consulting.
BCM Program Office
Site Site Site
Site Mgmt
Key Operations
Key Support
Functions
Site Mgmt
Key Operations
Key SupportFunctions
Site Mgmt
Key Operations
Key SupportFunctions
BCM Organization
And 35+ more
Governance
Audit Committee (Annual Report)Senior Executives (Annual Review)Operating Council – VP of Ops (Quarterly)
Organizational Reporting
Part of Risk Mgmt Organization (Corporate Legal) reporting to General Counsel.
8
• establish BCM scope, focusing
on the areas that are critical to business continuity
• develop common assessment of risks and define what risks are
“intolerable”
• prioritize mitigation efforts and
investments
The Materiality Criteria
provides a strategic
framework that helps the business to:
A Common Risk Strategy –
Materiality CriteriaStrategy + Policy
Resources
Leadership+ Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Strategy + Policy
Resources
Leadership+ Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Losses > x% business unit revenue
Losses between x to x% business unit revenue
Losses < x% business unit revenue
Financial
Impedes time to market by greater than x months
Impedes time to market by up to x months
No impact on time to market
Product Time to Market
Major impact, excluded from producing or marketing a key product in a major market
Minor impact, limitations on producing or marketing a key product in a minor market
No impactLegal and Regulatory
Outage for more than x hours/days/ weeks
Outage of x hours/ days/weeks up to x hours/days/ weeks
Outage up to x hours/days/weeks
Operational Capacity
Unable to serve major external customers or > x% of total customers
Unable to serve small external customers or < x% of total customers
No external customer impact
Customer
HighMediumLowType of impact to business unit or
region
Losses > x% business unit revenue
Losses between x to x% business unit revenue
Losses < x% business unit revenue
Financial
Impedes time to market by greater than x months
Impedes time to market by up to x months
No impact on time to market
Product Time to Market
Major impact, excluded from producing or marketing a key product in a major market
Minor impact, limitations on producing or marketing a key product in a minor market
No impactLegal and Regulatory
Outage for more than x hours/days/ weeks
Outage of x hours/ days/weeks up to x hours/days/ weeks
Outage up to x hours/days/weeks
Operational Capacity
Unable to serve major external customers or > x% of total customers
Unable to serve small external customers or < x% of total customers
No external customer impact
Customer
HighMediumLowType of impact to business unit or
region
Risk Identification
and Mitigation
Strategy + Policy
Resources
Leadership + Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Risk Identification
and Mitigation
Strategy + Policy
Resources
Leadership + Governance
People + Organization
Risk identification and impact analysis
Risk mitigation, planning and preparation
Establish culture, exercise and maintainplans
Implementation Follows a Step by Step Process
Implementation Follows a Step by Step Process
Step 1 – Project Planning
Step 2 – Business Impact &
Risk Assessment
Step 3 – Risk Mitigation
Step 4 – BCP Development
Step 5 – BCP Testing
Step 6 – Maintain & Create BCM
Culture
Implementing the Model
Step 2 – Business Impact & Risk Assessment
Process:
• Self-assessment performed by all departments in scope.