All organisation should have some form of Business Continuity Management (BCM) in place. This generally involves the following stages:
- Business Impact Analysis – Identifying key processes and critical functions relating to the delivery of products or services need to be identified, generally via a workshop process involving key stakeholders.
- Assess the risks – A risk assessment is then undertaken on the critical functions to identify, in view of the existing controls the organisation has in place (e.g. work-arounds, redundant plant etc.), which of these present the greatest risk to the organisation.
- Develop a Business Continuity Framework and Plans – A Business Continuity Framework should be developed outlining the organisation’s approach to managing business disruption events. This framework is supported by Business Continuity Plans, utilising the data from the Business Impact Analysis to document the processes required to ensure critical functions can be resumed promptly after a disruption event.
- Training – Training should then be conducted to ensure all staff and especially key stakeholders (e.g. The Crisis Management Team) are aware of their roles and responsibilities and have the resources required.
- Testing – In order to determine the level of understanding and preparedness of the implemented BCM Program, a testing exercise of the Business Continuity Plan should be conducted with a selection of key personnel using a simulation-based test of the operation of the BCP, using a plausible scenario.
These steps will ensure Business Continuity is successfully embedded within an organisation.
Many organisations then fail to ensure that these BCM arrangements are effectively maintained. In order to ensure that the BCM arrangements remain up to date and relevant to the organisation, a planned approached to the review should be taken. This should involve considering any changes and potential new risks and ensuring that staff are made aware of its requirements on a planned basis. To this extent it is advisable to develop a review cycle as part of the Business Continuity Framework to ensure that Business Continuity arrangements are reviewed, assessed, amended where applicable, communicated and trained.
For assistance with developing, implementing, maintaining or training relating to Business Continuity Management programs please contact QRMC for more information.
