Business Continuity and Contingency Management

What is business continuity management?

Business continuity management is an ongoing process of risk assessment and management with the purpose of ensuring that the business can continue if risks materialise. These risks could be from the external environment (over which you have no control, such as power failure) or from within your organisation, such as deliberate or accidental damage to systems. Business continuity is not just concerned with disaster recovery; it addresses anything that could affect the continuity of service over the long term, such as staff shortages in specialist areas.

Why is it important?

You must be confident that your organisation could continue to deliver its business objectives if things go wrong. You need to have contingency plans to cope with disasters such as system failure; you also need to look to the longer term and consider issues such as:

• skills requirements
• provider lock-in
• technology obsolescence.

Who is involved?

A member of the board or Executive should be given overall responsibility for the process. This ensures that the process is given the correct level of importance within the organisation and a greater chance of effective implementation.

An overall business continuity management (BCM) co-ordinator should report directly to the board or Executive member responsible for BCM. This person is ideally someone who understands the business structures and people, there may also be a need for good programme management, communication and interpersonal skills and be a good team leader. The support of BCM analysts, lower level/ regional teams and appropriate administrative staff.

Principles

Business continuity management centres around a business continuity plan (BCP), which must be endorsed by senior management and subjected to rigorous testing.

BCM is about understanding the business and establishing what is vital for its survival. If a mission statement and key supporting aims exist these indicate where the organisation is focused. It is on mission critical activities that BCM has to focus.

Your organisation has many dependencies, both internally and externally, that support the mission critical process and functions. These can include providers, customers, other stakeholders, IT systems and manufacturing processes, which must be identified at an early stage. You should involve representatives from these key dependencies will add value to the process.

There must be a cultural readiness to accept BCM. There should be an education and awareness programme to ensure organisation-wide understanding and adoption of the plan, covering internal and external stakeholders.

Process

The stages of BCM are:

• understanding your business
• formulating continuity strategies
• developing a response
• implementing a continuity culture
• testing the plan, maintenance and auditing.

Understanding your business
This stage is about the analysis of the business and is critical. It provides the basis upon which all subsequent BCM policies and processes are based. You should:

• identify mission critical processes and functions
• identify key internal and external dependencies upon which these rely
• identify external influences that may have an impact on critical processes and functions.

There are four basic questions to be asked:

• what is this business about?
• when are we to achieve our goals?
• who is involved, both internally and externally?
• how are the goals to be achieved?

Carry out a risk assessment to identify the threats to these processes. Whatever risks the organisation faces, there are relatively few effects, for example: loss of critical system(s), site or personnel or denial of access to systems and premises, all of which produce similar disruption. You should focus on essential business elements rather than a global risk-specific analysis. The process will also take into account the time sensitivity of each business function/ process to disruption, and this information will determine the recovery objectives.

You should:

• determine impact on the business if mission critical process/functions are lost
• ensure involvement of appropriate functions
• apply rating, including time dependencies
• obtain sponsor's approval to business impact assessment output
• determine the threats to critical processes/functions
• examine existing risk strategies/analysis
• apply scoring system to risks identified
• produce combined business impact and risk assessment
• obtain sponsor's approval to business impact and risk assessment

Formulating continuity strategies
You must decide on the approach to be taken to protect the business. This decision must be taken at board level.

Your options include:

• do nothing - in some instances the board may consider a risk acceptable from a business perspective
• changing or ending the process - deciding to alter existing procedures must be done bearing in mind the organisation's key focus
• loss prevention - tangible procedures to eliminate / reduce risk
• business continuity planning - an approach that seeks to improve organisational resilience to interruption, allowing for the recovery of key business and systems processes within the agreed recovery timeframes, whilst maintaining the organisation's critical functions.

You should:

• identify possible business continuity strategies
• ssess suitability of alternative strategies against the output of the business impact and risk assessments
• prepare cost / benefit analysis of various strategies
• present recommendations to sponsors for approval.

Developing the response
For crisis management, you should develop a detailed response to a potential incident and formulate plans that support that response. Emergency response and operations covers the development and implementation of procedures for responding to and stabilising the situation following an incident, including establishing and managing an emergency (or crisis) operations centre. You must establish a procedure for command and control of the incident, to include:

• opening the emergency operations centre and its security arrangements
• the management and operations of the centre
• closing down of the centre when the crisis has ended.

You should also determine the actions to be taken in the area of salvage and restoration.

You must develop a business continuity plan . This document brings together the actions to be taken at the time of an incident, who is involved and how they are to be contacted. The plan or plans must reflect the current position of the organisation and all it stakeholders. A business continuity plan should be designed to provide recovery of the organisation within the recovery time objectives established during the business impact assessment process. A procedure should also be established to shift from the emergency response plan to the business continuity plan.

Implementing an action plan

• Ensure that the culture of BCM is embedded in your organisation. All those associated with the organisation need to have confidence in its ability to manage in a crisis. You should:
• assemble Emergency Management/ BCM/ Crisis and Recovery Teams
• implement relevant training programmes for each team dependent upon task, including crisis communications/ media training as appropriate
• establish/ equip emergency and crisis centres
• establish internal and external contractual arrangements/ service level agreements
• implement back-up and off-site storage arrangements
• distribute plan documentation as appropriate
• conduct internal and external awareness programmes
• prepare crisis communication statements for all stakeholders

Testing the plan, maintenance and auditing
A business continuity plan is unreliable until it is tested and has been proven workable, especially since false confidence may be placed in its integrity. A minimum requirement should be to test every 12 months. You should:

• prepare a representative and suitably detailed disaster scenario. Include aspects such as date, time, current workload, political and economical conditions, accounting period end, concurrent activities.

You must keep the plan up to date to reflect changes in the business. You should:

• define plan maintenance scheme and schedule for the plan
• monitor activities
• update the plan as required
• distribute under formal change control procedures
• carry out regular tests.

The plan should be audited ideally by an independent auditor - to ensure objectivity. The audit should be conducted on a minimum of an annual basis. You should:

• set audit objectives and scope
• assess and select the audit method
• audit the administrative aspects of the BCM process
• audit the plan's structure, contents and actions sections
• audit the plan's documentation control procedures
• submit to the sponsor.

Detailed step by step gudiance can also be found in the Contract Management Workbook and Risk Management Workbook.

Further information

See the related briefings on risk management; see also the document outline for a business continuity plan. For detailed advice, see OGC's guide Business Continuity Planning; see also the commercially published Management of Risk : Guidance for Practitioners

Business Continuity Management. This assessment was developed by the Business Continuity Institute. The programme will allow you to select your answers and save them for a later date until you can complete the task.

The completed details can be sent to us by post or e-mail. We can then analyse your responses against a non attributable database.

To enable organisations to understand Business Continuity Management and to enable effective implementation, the business continuity, risk management and insurance industries have collaborated to produce  The BCI Good Practice Guidelines.