1. Suffolk BC forum Willis BC/DR Experience 6 th December, 2013

2. 1 Risk Appetite - BC Need to set own risk appetite to give clear indication on scope eg :  We plan for the loss of Ipswich office  We plan for the loss of London office  We don’t plan for the loss of both at the same time  Mumbai operation have gone from single office to : ‒ three offices in different parts of the city ‒ contracted third party recovery site ‒ improved home working capability  We don’t plan for the long term loss of all three office and recovery site at the same time

3. 2 Risk Appetite – IT DR Critical IT systems centralised  Operational efficiencies – maintenance, support, upgrades etc  Data resilience – infrastructure, management, etc  Recovery – backup systems, data replication etc. Recovery plans  Applications have published recovery objectives  Three tier approach for recovery – High/Med/Low  Email increasingly seen as needing faster recovery given global nature of our business

4. 3 Willis BC/DR experience Have well developed and tested BC/DR plans for major global offices Contracted or designated recovery sites for all offices Major offices have annual recovery site exercises Automated messaging system (SMS, voice, email) with annual testing Annual IT DR recovery site exercise Large scale remote working capability  Sized for 2000 concurrent remote users  Largest test (for London Olympics) 1009 concurrent remote users  Daily average 100-150 in UK  Over 500 concurrent users on Mon 28 Oct for storm – had sent emergency message out on Sunday night to all UK Associates.

5. 4 Willis BC/DR experience Requirement to update BIAs to reaffirm our recovery plans/capability Previous BIAs indicated 24-48 hrs recovery – no financial trading systems like banks or call centres for High St insurance companies BIAs confirmed recovery sizing  No. of seats at recovery site  Remote working capacity  Reaffirmed overall recovery period  BIAs confirmed desire for faster email recovery Fitted with other IT projects for data centre and Email upgrades  Fully fault tolerant – no SPoF systems, infrastructure, building/ environment  Resilient - system capacity, fail over, hot swap etc  Data replication to provide full recovery within hours.

6. We are looking to avoid this……

7. Business Continuity in Action?