Most Business Continuity Plans (BCP) include consideration of the Critical Functions within the organisation, including the need to identify them together with the necessary resources required to perform these critical functions and any available workarounds.
Two key issues to consider when formulating a BCP are:
- Is the definition of a Critical Function clearly understood by all stakeholders?
- Are Critical Functions prioritised when developing the BCP?
Most people have an inherent belief that what they do at work is important and adds value to the organisation they work for. This is especially true when it comes to Leaders, Directors and Managers. Often though, there is a lack of understanding of what is truly ‘critical’ to the organisation, and if non critical functions are incorrectly categorised, the resourcing and proper management of truly critical functions can be compromised.
During Business Impact Analyses exercises, it can be useful to avoid using the terms ‘Critical’ and ‘Non Critical’ functions, and instead use the terms ‘Critical’ and ‘Key’. This less confronting terminology allows participants to concede that whilst they may perform a key function for the organisation (e.g. strategic planning), it may not necessarily be critical to quickly restore following a disruption event.
Once the separation of functions is complete and the organisation has carefully identified its Critical Functions, these are usually included in a BCP ‘en masse’ without any real consideration of priority. In order to prioritise these Critical Functions, it is vital that they are assessed in terms of their risk to the organisation following a disruption event, given the effectiveness of existing work arounds. A Business Impact Analysis exercise is thus incomplete without a risk assessment component that facilitates the prioritisation of Critical Functions to enable the prioritised resumption of activities after a disruption event.
Using a risk methodology based on the organisation’s Enterprise Risk Management requirements, the prioritisation of Critical Functions becomes an objective exercise with each Critical Function being assigned a risk rating that facilitates prioritisation.
Please contact QRMC for more information.
