This is the 4th article in the series “Popular Risk management”. The aim of the series is to describe the main Risk management topics in simple, clear and concise language.
Successful Business Continuity Management explained.
During the last 2 years the economies and companies operate in a crisis environment. Many observers even predict that our society is in some stage of the total collapse of the capitalistic system. This article won’t provide a solution for the global issues, but it describes how to establish a solid Business continuity framework that will navigate your organization in case of emergency. What elements and tools are vital for the solid and successful plan?
Element 1: Set up a solid BCM Programme Management structure
Programme management is at the centre of the BCM process and it establishes the approach to business continuity. The participation of top management is of key importance to ensuring that the BCM process is correctly introduced, adequately supported and established as part of the company’s culture. Programme management includes three steps:
· Assigning Roles and Responsibilities (Governance)
Business unit management is ultimately responsible for the continuity of the business under adverse circumstances and accountable to ensure appropriate processes are implemented in the business unit.
Business unit management must appoint a person with appropriate seniority and authority to be accountable for BCM policy and implementation.
Business unit management must appoint a team to implement and maintain a BCM programme.
· Implementing Business Continuity in the organisation by communication of the BCM programme to stakeholders, arrangement of appropriate training for staff and exercising of the capability tests.
· On-going Management activities must ensure that continuity is embedded in the organisation. Each component and process of the business unit’s capability must be regularly reviewed, tested and updated.
Element 2: Understand your organisation.
The aim of this phase is to establish an understanding of the business through the identification of its key products, services, critical activities and resources that support them. The key activities during this phase are: Business Continuity Risk Assessment; Business Impact Analysis and determination of continuity requirements.
Element 3: Determine BCM Strategy
As a result of the previous analysis, the business unit will be able to choose the appropriate continuity strategies to enable it to meet its recovery objectives.
The following items must be included as part of the strategy:
* Staff
* Premises (alternative working arrangements)
* Technology
* Information
* Suppliers
* Stakeholders
You have to answer the following questions per critical process: how likely is it that a critical asset or process will fail and what are the consequences.
Element 4: Develop and Implement a BCM Response
This phase of the lifecycle is concerned with the development and implementation of appropriate plans and arrangements to ensure continuity of critical and other activities and the management of an incident. An Event/Incident/Crisis (E/I/C) response structure and plan must be documented and in place to enable an effective response and recovery from disruption. Such response plans include Business Continuity Plans, Technology Recovery Plans and Crisis Management Plans
Element 5: Test, Maintain, Audit and Review BCM Arrangements
This phase ensures that the BCM arrangements are validated, that documentation is a reflection of the current business environment and that the plans are up to date. Key activities are:
* Testing and exercising Business Continuity Plans including Call Trees and Crisis Management Plans
* Maintenance of BC Plans (and all BCM documentation match current business requirements)
* Review of, and adherence to BCM Policies & Standards
Element 5: Embed BCM in your organisation.
This phase focuses on the need for business continuity to become part of the regular management effort, regardless of the size or type of Business Unit. Development of a BCM culture is supported by:
* Leadership from management at all levels;
* Assignment of BCM responsibilities;
* BCM Awareness raising;
* BCM Skills training;
* Exercising BC Plans and Crisis Management Plans;
* Ensuring that Business Continuity requirements are included in strategic and investment decision-making.
Effective Business Continuity Management strives to:
* Protect staff and shareholder interests
* Continue operations/services and minimise impact of disruption
* Adhere to Legal and Regulatory requirements
* Maintain company’s reputation
* Embed BCM in business activities
This is achieved through:
* Identification and analysis of business continuity risks
* Assessing the impact of the disruption of business critical processes
* Formulating a BCM Strategy for the recovery of operations
* Timely and effective crisis management
Do you want to learn more about Risk management? Does your organisation require help in setting up and benchmarking of the Continuity Management framework?
Written by Boris Agranovich
Resources:
1. High-level principles for business continuity. Basel Committee
2. BS25999 Business Continuity Management, Code of practice (British Standards Institute)