At each stage of the business continuity management (BCM) life cycle process, opportunities arise to create and enhance the organisation's BCM culture. These opportunities do not always come from the experts, but from employees as they become aware of processes involved in embedding BCM into their everyday activities, and the exchange of information arising from their experiences.
Money without complete support will never see a BCM plan succeed.
Derek Taylor is business development manager for ContinuitySA.
As the BCM message is taught throughout the organisation, each element carries a component of both gathering and sharing information. This exchange of information contributes to the overall understanding and awareness of BCM within the organisation, as well as its necessity. It also keeps the topic top of mind, which is crucial to the preparedness of staff.
During the roll-out, it is important to note that BCM is never a one-size-fits-all approach or solution. More importantly, it does not have to be, and some would say should not be implemented on an enterprise-wide scale in one massive project. It should be implemented in controlled, well-tested phases that follow an organised plan. So how does the process work?
1. Understanding the organisation
Initial discussions are held and questions asked during the business impact analysis (BIA) process. This will present the directors with the opportunity to identify the target audience within the organisation and assist in identifying what the benefits of BCM will bring to each part of the organisation.
A discussion around the impacts of disruptive events will not only provide the input required for a wider BCM programme, but may well be a catalyst for the change required within the organisation around issues of operational resilience and recovery capabilities.
A risk analysis (RA) should also be conducted. This must outline all potential risks that face the business as a whole, as well as the different parts that make up that whole. During this phase, the question to ask is “what if”, not “when”. Preparing for an event at any time - even if it is deemed unlikely - makes embedding BCM throughout the organisation much less difficult.
2. The BCM strategy
Management at all levels in the organisation are generally responsible for the delivery aspects of the business's key products and/or services. It is therefore important that the BCM strategy is endorsed by all of them and driven by the company directors responsible for the organisation's wider objectives and budget.
I find it is more important for the directors to agree and assist in the development of BCM strategies than it is for the board to find the budget. Money without complete support will never see a BCM plan succeed.
3. Developing and implementing a BCM response
Depending on the size of the organisation, it will need to find the appropriate incident management teams across the company during the development and delivery of the incident management and business continuity plans. Once set up, it is important that these teams' response skills and competence be developed through practical training, active participation and simulation exercises. Reading the manual won't help in a real disaster.
4. Exercising, maintaining and reviewing
Exercise, rehearse and test the company's teams and plans. Realistic, simulated and physical testing is far better than simply having a documented plan. The simple truth is that business continuity plans are only as good as the last time they were tested. Plan rehearsals, reviews and updates to ensure these plans are up to date, relevant and fit for purpose should the company need to fall back on them.
5. BCM programme management
It is important to continually ensure that the company's BCM programme is aligned with what the business actually requires, and that the objectives and deliverables of the programme are realistic. This is why the BIA and RA are crucial in discovering the most important elements of the business that will need to be up and running in the shortest time possible, and those that are less urgent.
And as a parting thought, I can't stress enough how important it is to engage at the right levels with those who recognise the importance of BCM and are ready to support the roll-out, in other words, the directors.
Share