Questions/Answers

The Department of Culture and Tourism - Abu Dhabi drives the sustainable growth of Abu Dhabi’s culture and tourism sectors, fuels economic progress and helps achieve the UAE capital’s wider global ambitions. Our collaborations with multiple stakeholders, enable us to nurture and cultivate a community that celebrates, preserves and promotes local heritage and values, attract national and international investment across our tourism segments and stimulate growth by building an appealing yet distinctive tourism and cultural destination. In order to manage our corporate risk, ensure that the organization is resilient, minimize business interruptions and adopt global best practices, we have deployed an integrated Enterprise Risk Management(ERM), Business Continuity Management(BCM) and Crisis Management frameworks aligned with global and National standards ISO 31000, COSO 2017 and NCEMA 7000. An unmanaged crisis may damage the Emirate's reputation and consequently affect the organization’s efforts to promote culture and tourism, resulting in a negative impact on demand and tourism arrivals The main objectives of the initiative and program is as follows;  Integrating risk management into DCT’s departmental activities and processes across the organization.  Establish clear accountability and ownership of risk assessment and mitigation at an organization level  Instill increased confidence in DCT’s corporate governance and ability to deliver on Abu Dhabi’s Tourism and Culture mandate  Enhance and support the achievement of DCT’s objectives through appropriate risk mitigation measures  Provide all employees with an understanding of DCT’s position on risk-taking and managing risk  To implement, maintain and continuously review of BCM framework and ensure an effective and timely response to disruption.  To ensure that business recovers with reasonable compliance to the minimum business continuity objectives.  Minimize the impact of interruption to normal DCT activities to levels below the impact tolerance level stated in this policy

The initiative was fundamental in ensuring that the organization prepared for different potential crisis scenarios and responded to the COVID-19 pandemic that has affected over 50 million people globally. The implementation of integrated ERM and BCM framework allowed the entity to define risk strategy and appetite, structure the governance by defining the roles and responsibilities of the “three lines of defense,” and implement a robust and structured approach to assessing, identifying potential impacts from threats, and for developing response plans. Potential gaps and mitigations were identified, and plans were tested to ensure BCM teams were prepared for a crisis.

The organization has implemented six principles of the tourism sector sustainability framework and conducted reporting through the Global Reporting Initiative (GRI), a global standards organization that impacts issues such as climate change, human rights, and corruption. Our integrated risk management and business continuity framework support the below sustainability development goals(SDGs) and targets as noted below;  16.6 Develop effective, accountable and transparent institutions at all levels  17.19 By 2030, build on existing initiatives to develop measurements of progress on sustainable development that complement gross domestic product, and support statistical capacity-building in developing countries  17.17 Encourage and promote effective public, public-private and civil society partnerships, building on the experience and resourcing strategies of partnerships Leading into the SDGs and targets, the Government of the Emirate of Abu Dhabi issued the Abu Dhabi Accountability Authority Law #1, 2017 and Law#19, 2020 which emphasize “effectiveness of internal controls” and “Integrity and transparency” at Government entities. We ensure compliance with these regulations through audits by global audit firms and deployment of comprehensive ERM program. Oversight on our compliance with the laws is done by the third line of defense namely Internal Audit and Abu Dhabi Accountability Authority auditors.

The organization activated our Crisis Management Plan at the onset of the COVID-19 pandemic. Our response included activating a tourism task force to work closely with the tourism sector to assess requirements and identify solutions. Also engagement with the Department of Health, the Abu Dhabi local operations center and other relevant government entities to drive regulations to protect the health and safety of the community and our visitors. Multiple actions were taken from deploying a virtual control center, activating work from home protocols, hygiene practices to help sector cope with the negative social, economic and environmental impacts.

The organization aims to establish the Emirate of Abu Dhabi as a leisure and cultural destination of distinction by operating the organization at the highest level of safety, business resiliency, and risk management and ensuring continued compliance to the regulatory requirements NCEMA7000:2015 standard through our values and behaviors. Furthermore, the organization strives to safeguard its reputation as a reliable and resilient Government service provider and to ensure that business following any disruption is not adversely affected and recovers with proper compliance to the minimum business continuity objectives and below the tolerance levels as defined in the policy. The organization broadly serves the community and domestic and international visitors of the Emirate alike across multiple domains such as regulating and licensing the tourism and culture sector, delivering leisure and culture events and festivals, access to libraries, cultural education programs, and workshop, tours of museums and cultural sites to name a few. In the current COVID-19 crisis and to demonstrate our resilience and capability as an organization, we delivered a gamut of digital activities, for example, Hosted major Livestream programs such as Culture Summit, Virtual Seminars, Concerts, and virtual tours of museums, art collections, and culture sites.

The organization empowers its female employees and engages them in the establishment, delivery, training, exercises, and maintenance of emergency/crisis management activities and operations, including readiness aspects, including response activities on an on-going basis. Crisis management is a conduit for driving a change in an organization's working practices by promoting “remote working,” which can play a big part in providing female employees with a better balance between office and managing their family, especially in the current COVID-19 crisis. Additionally, the organization has put a “Womens’ Council” to activate Emirati women's role in supporting the development of the country.

The initiative entails working closely with two main target groups; 1. The internal stakeholders inline with our “three lines of defense”. The engagement takes place with senior management, risk and business owners and Internal Audit. The activities that implemented include activating the Business Continuity teams, training and awareness, risk assessment, business impact assessments, exercises and monitoring and follow-ups. We have developed covered risk registers and business impact analysis for 31 departments, engaged 28 risk owners and 80 employees, identified 308 risks, assessed 78 critical processes and certified 21 employees in crisis management. Additionally, we monitor the closure of recommendations raised in the reports by the Internal Audit department and noted improvement in risk profile of the organization. 2. In terms of external stakeholders, we engage with the Abu Dhabi Local Operations Center, the Department of Health, Department of Economic Development and other government entities as well as private sector hotels, malls, tourism and cultural attractions to name a few. Multiple initiatives were implemented to include deploying Thermal cameras, vaccination of front line staff, Hygiene certification (Go Safe) to raise the confidence with the Health and hygiene practices in the sector. Impact was improved hotel guests numbers as compared to competing destinations.

The integrated ERM and BCM framework and program implementation occurs in two main streams; A. Enterprise Risk Management- a. Formalize the program by issuing an ERM policy statement from the Chairman of the organization to empathize with the top-down commitment b. Develop and implement the ERM framework and manuals c. Conduct awareness and training sessions to risk owners and their teams d. Develop in conjunction with senior management the risk appetite statements and tolerance limits e. Conduct risk assessment to include identifying risk, causes, controls, mitigations, and evaluation of the risk and deliver risk registers f. Prioritize top risk and related KRIs g. Develop risk reporting and continuous monitoring B. Business Continuity and Crisis Management a. Formalize the program by issuing a BCM policy statement from the Chairman of the organization to empathize with the top-down commitment b. Develop and implement the BCM framework and manuals c. Identify and formalize the business continuity teams to include the Senior Leaders Business Continuity team, the Crisis Management Team, the IT Disaster Recovery team, Crisis communications team, and emergency coordinators. d. Conduct awareness and training sessions for business process owners and their teams e. Conduct business impact analysis to identify critical activities and dependencies f. Complete the Business Continuity risk register g. Complete the Business Continuity Strategy, Business Continuity Plan, Crisis Management, and Communications Plan. h. Testing and exercises to ensure that the plans are effective and team are aware of their roles and responsibilities The program is closely monitored through monthly and quarterly reporting that includes the follow-ups on the closure of risk mitigations identified in the risk assessment stage. The program is updated at the beginning of every year to reflect on changes in the business.

The program was initially conducted manually using word and excel. This was not the most efficient way to accomplish risk assessments and deliver the risk registers. In order to enhance the efficiency and effectiveness of the program, a Governance Risk and Compliance tool implemented and automate the risk assessment and business impact processes.

• DCT has played a major role in developing and embracing the concept of sectorial resilience and the end-to-end transformation of the initiative into a digital, online and virtual practice which enables the effective management of risks through online channels, the continuity of services and operations through digital channels and the navigation of disruptions and crisis situations through virtual control rooms • Innovation is also considered in evaluating responses and recovery strategies, through the innovation framework followed in DCT • DCT is committed towards rewarding sector-wide innovations, also covering the scope of the initiative

• The Abu Dhabi government is committed to replicate successful and scalable business initiatives and best practices across government entities through mandatory submissions of the internal “Best Practices” report for consideration by senior committees, which considers scalability among the key criterion • The advancement experienced in implementing this initiative has been considered a local benchmark, which attracted global consultancy firms and other local government entities to assess the maturity of their practices against DCT’s initiative and practices • The initiative’s success is also apparent in participating and competing in global and local awards

Developing and embracing the concept of sectorial resilience and end-to-end transformation of the practice into a digital, online and virtual practice through use of online, the continuity of operations through digital channels and the navigation of disruptions through virtual channels: • Implementation of a GRC solution enabled digitization and automation of the programme • Virtual Control Rooms implemented as digital channels to enable crisis management teams in responding to incidents and crisis scenarios • Technology is key to further digitization and automation, considering the implementation of sector-wide crisis communication and media response platform, virtual control rooms and a collaboration and knowledge sharing platform

 Advanced foundation and preparing for, responding to and recovering from business interruptions; while ensuring scalability (across DCT sites, related entities, the government and across subject entities within the tourism and culture sectors) to expand the scope of the programme to support addressing sector-wide crisis scenarios, and align business continuity and crisis management practices (through monitoring and using common methodologies and joint response plans, joint testing and exercising etc). Government entities response and tourism sector’s response to crisis scenarios is aligned to DCT, under governance and implementation of Emirate-wide joint crisis management plans, such as the Abu Dhabi Pandemic Response Plan  DCT sends notifications and early warning signs to tourism establishments to prepare for certain disruptive scenarios (such as upcoming storms and adverse weather conditions). Also DCT ensures consistent quality and alignment of hotel emergency plans to requirements  DCT collects and analyzes incidents occurring across DCT as an organization, as well as across tourism establishments  DCT developed and managed several sector wide business continuity and crisis management initiatives such as the implementation of ‘Go-safe’, a programme designed to promote hygiene standards and rebuild the visitor confidence in visiting hotels, private and public beaches, museums, theme parks and tourism attractions and malls

 DCT is looking to implement the concept of sectorial resilience and the end-to-end transformation of the Business Resilience practice into a digital, online and virtual practice across the tourism sector, which enables the effective management of risks through online channels, the continuity of services and operations through digital channels and the navigation of disruptions and crisis situations  DCT will leverage on the existing Virtual Crisis Control rooms at DCT, in order to roll out Joint Virtual Control Rooms, aiming to support the activation and collaboration of sector-wide committees and business continuity teams across the tourism sector, to promote business continuity  DCT’s GRC solution is scalable to allow deployment across the tourism, leisure and culture sectors in the future  Testing of plans and exercises will include hotel establishments in the future, to ensure joint preparedness and aligned response to crisis scenarios  A crisis communication platform is being considered for implementation across the hotel establishments and other government entities to facilitate the coordination and media response during crisis  A platform will be implemented for collaboration and knowledge sharing, to allow hotel establishments to seek advice, seek support on business continuity practices, and to benefit from best practices across the sector

 Abu Dhabi government commitment towards implementation of the initiative is clear, through the continuous investment in the initiative over the past few years, such as funding the implementation of a GRC solution and the emergency funding of the COVID-19 support packages  Currently, there are 5 individuals tasked in planning and overseeing the implementation of the initiative, along with a team of 30 business champions across departments and cultural sites, as well as champions across tourism establishments  Tools, IT solutions and linked initiatives and projects are in place to support this initiative and to ensure its effectiveness

 The Business Resilience strategy relies on a financially sustainable model, particularly through the implementation of the shared services model (that serves DCT head office, related entities, cultural sites, and tourism establishments) and with the support of business champions and industry champions

Yes

The Business Continuity maturity and practices are evaluated on a yearly basis by independent internal and external parties:  Yearly evaluation by independent internal and external parties:  Internal Audit reviews by DCT’s Internal Audit Team;  Maturity Assessment conducted by KPMG based on KPMG’s Business Continuity Maturity Model;  Self-evaluation based on NCEMA’s standard;  assessment by the Abu Dhabi Executive Office based on Business Continuity criteria defined under the Abu Dhabi Excellence Award

 Internally by the Internal Audit team (based on best practices and NCEMA standard);  Externally through an independent and specialized service provider (based on KPMG’s Business Continuity Maturity Model covering 2018 and 2019);  by a specialized government agency the National Emergency Crisis and Disaster Management Authority (based on NCEMA’s Business Continuity standard);  the Abu Dhabi Executive Office (based on the business continuity criteria under the Abu Dhabi Excellence Award)

DCT demonstrated maturity of the BCM framework and practices in all assessments: 1) Internal Audit review 2020: No improvements suggested; 2) Assessed as “Managed and Measurable” scoring 3.40/4 by KPMG, while subsequently all suggested improvements were implemented, including deployment of a GRC tool and conducting testing and exercises. Current score expected to be 3.8/4 pending the upcoming maturity assessment 3) Scored 99% on NCEMA’s self-assessment without additional improvements required 4) Scored 100% of the self-assessment from the Abu Dhabi Executive Office, while no additional improvements were suggested for implementation

Business Continuity and Crisis Management are government by local regulations and standards from senior government entities, including: 1) an entity considered the highest authority across the Abu Dhabi Government entitled Abu Dhabi Executive Office (previously known as Abu Dhabi Executive Council), which issued circular number 4 of 2014 on Business Continuity Management for compliance by Abu Dhabi Government entities in 2014, and the Business Continuity criteria under Abu Dhabi Excellence Award, where entities are required on their progress in implementing their Business Continuity Framework on a yearly basis and are assessed under the Abu Dhabi Excellence Award 2) the National Emergency Crisis and Disaster Management Authority’s is the leading government regulatory body for the practice of Business Continuity Management, which issued Business Continuity Management Standard AE/SCNS/NCEMA 7001:2015 derived from ISO 22301 standards, for compliance by all government entities. The Authority has established the Abu Dhabi Location Operations Center which conducts active monitoring on the implementation and compliance with the BCM standard; leads in planning and conducting government-wide desktop exercises and tests across Abu Dhabi; and also leads and coordinates closely with entities during emergencies, crisis and disasters, in coordination with the NCEMA head office

DCT has got a Stakeholder Management Framework, which also includes the strategic and key stakeholders that support DCT in its mandate to implement Business Continuity and Crisis Management practices, such as in developing joint crisis and disaster response plans (Pandemic Plan, Red Tide Phenomenon Plan etc), conducting cross-government exercises and testing (testing of scenarios and plans such as an Oil Spill, Pandemic scenario, Environmental Disaster etc), as well as to engage and support in implementing coordinated measures in responding to and for recovering from crisis scenarios (such as the issuance and implementation of regulations and circulars depending on the specialization from each government entity for compliance by entities within their relevant sectors). The relevant stakeholders, along with their detailed roles and responsibilities can be identified within DCT’s Business Continuity Plan, Crisis Management Plan and the joint plans signed with those entities. The Stakeholder Management Framework is also governed through the National Emergency Crisis and Disaster Management Authority that oversees the implementation of joint aspects of Business Continuity Programme across the government

1. GOVERNANCE OF THE CRISIS • Designate a focal point from the entity to coordinate Crisis Management efforts and avoid duplication and redundancy 2. CRISIS PLANNING • Avoid downplaying low-likelihood scenarios • Plan extensively for worst case scenarios • Extensive testing of plans and activities to ensure optimal readiness • Ensure our risks from natural incidents are appropriately and adequately insured • Adequate technology infrastructure is tested to ensure continuity • Active monitoring and assessment of global/regional & local events that may potentially become crisis and caused significant disruptions • Aligning the improvement (process and service automation) and business continuity agendas 3. TACTICAL PLANS IN PLACE TO MANAGE THE CRISIS • Seamless integration of information across BCM, HR, OD, Finance, Events etc 4. REPUTATIONAL MANAGEMENT • Communication teams activated early on and during the crisis especially on site of the incident to manage communication and manage reputation • Continuously assessing the impact of the incident and the impact of possible cancellations due to the incidents 5. BUSINESS DISRUPTION MANAGEMENT • alternative plans to manage vendors and customers during crisis ( eg vendors can no longer travel) • Employees are unable to travel to affected locations