Business continuity management (BCM) is too often assigned to staff with insufficient credibility or seniority, meaning that too often, business continuity is not taken seriously.
This is according to Tracey Linnell, a senior manager at Pricewaterhouse Coopers. Linnell says BCM is still seen as a 'grudge purchase' like insurance, and is not given the attention it deserves from top management.
"While the risk of natural disasters may be relatively low in SA, there are plenty of other risks to operations and reputation that could seriously impact a business," she notes. "For example, recent events have highlighted the risks to operations and reputation posed by industrial action."
Without an effective BCM programme in place, organisations are unprepared to deal with the effects and longer term impacts of such action.
Linnell says this is an international problem. "While very large enterprises and financial institutions may now be making business continuity a priority and assigning senior staff to manage the programme, too many companies think downloading a business continuity plan off the Internet and checking a few boxes is enough. It isn't."
A business continuity plan is just part of a complete BCM programme, Linnell adds. Meeting the overall International Standards Organisation (ISO 22301 and 27031) requirements for business continuity demands a great deal more than just having a plan. The International Standards Organisation released the latest standards earlier this year and companies are increasingly aligning their programmes to the standards.
She believes a key factor in improving the situation is staging simulation drills and workshops, where senior management is presented with possible scenarios and explore the risks and impacts. Often, they become aware for the first time of the scale of their exposure and the inter-dependencies of departments, says Linnell.
Changing perceptions and growing risk awareness at top level is the first step to improved BCM. Then, the programme needs to be driven by a business continuity manager who has the right levels of experience, seniority and credibility to drive change within the organisation.
We find that often, a process has been started, but not seen through to the end. We need to see a change in the profile and place in the hierarchy of the business continuity manager," she says.
Linnell says companies need to be both reactive and proactive in their planning: "Be reactive to ensure that the BCM programme has been comprehensively implemented and then be proactive to test the capability by finding flaws and adapting the programmes to close the gaps indentified.
"Companies wanting to implement a comprehensive BCM programme should look to follow the ISO standards and obtain guidance from experienced consultants or the BCI Forum in SA, if necessary."
Having the support and commitment of senior management towards the BCM programme is critical and requires the BCM manager to think and operate at the same executive level. This interaction needs to be both strategic and operational, but fundamentally the BCM manager must demonstrate a practical return on investment to ensure that top buy-in will be sustained over time.
Linnell will address the upcoming ITWeb Business Continuity 2012 conference at the Forum in Bryanston on 13 November. For more information about this event, click here.
Share