Business Continuity Management - preparing for potential threats

For businesses in our region, the disruption caused by last summer’s floods was for some merely an inconvenience, while for others; they were nothing short of a catastrophe. It is clearly disingenuous to suggest that those firms who had undertaken some form of Business Continuity Management (BCM) were the ones least affected, but at least these were the firms who were perhaps better able to manage the ensuing issues, having prepared at least in part, for them happening. Of course, no-one could foresee the events of late June, but proper BCM can assist a firm to prepare for any number of impacts upon the business, however caused.

BCM is a holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities.

For those firms seeking to build a BCM capability, the following are the key points that need to be considered:

1. Develop a BCM policy - this will provide the framework around which the BCM capability is designed and built. The policy describes the scope of the programme and assigns responsibilities for BCM within the organisation.
2. Understanding your organisation – take time to understand your organisation and the urgency with which activities and processes need to be resumed if they are disrupted and have clear priorities in this regard.
3. Determine BCM strategies – at two levels; A) corporate strategies such as deciding how quickly you wish to resume critical activities. Also, for back-up facilities and data storage, how far away from the main site do these need to be? B) activity level strategies such as thinking about the tactics you will adopt for such things as people, premises, systems/technologies, information, equipment and other stakeholders, partners and contractors.
4. Developing and implementing a BCM response – plan in advance the actions that are necessary and the resources which are needed to enable the organisation to manage an interruption whatever its cause.
5. Exercising, maintenance and review – to have confidence in any BCM initiative, plans need to be tested and the plans need to be maintained in an up-to-date manner e.g. to reflect personnel changes and audited. Take time out to put plans into practice by creating mock scenarios and seeing how the organisation responds.
6. Embedding BCM in the firm’s culture – developing a business continuity culture is vital to maintaining enthusiasm, readiness and effective response at all levels. Ensure that awareness of the BCM initiative goes company-wide and that personnel are educated about what the BCM plans involve and how to respond in crisis situations.

All of the above are discussed in the The Business Continuity Institute’s (BCI) recently published ’The Good Practice Guidelines (2007)’, which describe the key steps in building a BCM capability and follows BS25999-1, the BSI’s standard on BCM.

Of course, implementing a BCM initiative can be a complex task, requiring resource, time and money, all of which means that probably the most important aspect of any BCM initiative is the buy-in and engagement of senior management to ensure that the initiative gets the focus that it requires and deserves. Spending money preparing for something that might never happen is rarely a priority for company executives, but as the events of the summer showed, unexpected things do happen and by being prepared for them, firms can at least mitigate some of the side effects.

Contact details
Email: Jonathan Boulton
Tel: +44 (0)113 288 2080