Business Continuity Management
Floods, fires, flu pandemic, flu epidemic, cyber-threat, hacking, loss of key service provider / supplier / customer, power outage, heavy snow, terrorism, and who knows what else.
Think what is the likelihood of these – or any other hazard or threat - happening to your business. Then, think about the impact to your business… your stakeholders, your employees, your community, your business’s future if you can’t continue to keep delivering your key products. How much have you invested in your business? Isn’t it worth planning for the unexpected? You never know, it may bring some surprising benefits.
So what are the benefits?
- Assurance for yourself and your staff – Business Continuity Management (BCM) may even be a Regulatory requirement.
- Assurance for prospective clients. More and more businesses want to know that you can continue to deliver your products in the event of a disruption – having BCM arrangements helps to provide this Assurance. So it may make your business more marketable and increase profit.
- Assurance for clients / customers. As above, your customers and clients want to know that you can continue to deliver your product. BCM provides Assurance - it may keep you profitable.
- Resilience in the event of an internal disruption or external emergency affecting your business.
- Enhanced reputation of the brand as a resilient business.
- Optimizes business opportunities from incidents or emergencies – your business may be best placed to pick up where others could not continue.
- Greater understanding of your business, by identifying your business essential functions and what resources they need to continue, you might identify potential for streamlining processes.
NB BCM Assurance may be a legal requirement of your customer
What is Business Continuity Management?
BCM aims to ensure your essential business functions can continue during a disruption and helps you return to a normal level of operation as quickly as possible. The International Standards Organisation (ISO22301) defines Business Continuity as the, “Capability of the organisation to continue delivery of products or services at acceptable predefined levels following disruptive incident”.
There are several stages in the formal process (and it’s, of course, recommended you follow the more rigorous process in line with the ISO standard), but to cut to the chase you need to:
- Understand your organisation - identify what activities are absolutely essential to continue (or recover) for your business to survive, the timeframes for this, what would be the impact if you don’t continue a particular activity.
- Confirm which essential business activities you are going to focus on.
- Identify what resources your essential activities require to continue (think People, Premises, Equipment, Information, Communications / IT, Suppliers / Contractors).
- Think about how you can continue these specific activities in the event of the consequences of hazards / threats (see below).
- Collate this all into a plan – stating who does what, when, where, with what, how etc. Don’t forget contact information. Make sure it ties up with your emergency procedures, such as fire evacuation.
- Make sure your staff know what they need to do…and practice.
- Learn lessons from experience, whether in those practice sessions or from actual incidents affecting you – or others… and revise your plans accordingly.
To help, you don’t need to plan for every possible hazard or threat. Most hazards or threats will result in a limited number of consequences and you need to plan for those consequences. So, plan for:
- Loss of staff
- Loss of Premises
- Loss of electricity
- Loss of communications (landline / mobile)
- Loss of IT (software, hardware)
- Loss of transport network
- Loss of fuel / oil
- Loss of key service provider / supplier
- Loss of other utilities – water / gas
- Loss of retail banking system.
Think for each essential business function, “What would happen if I was faced with this situation and how would I get around this? Who would do what, where etc?”. The answer is part of your plan.
The Government have also provided the “National Business Resilience Planning Assumptions”.
For more information on threats you can look at the:
Look at the 10 minute assessment to see what arrangements you may already have in place.
Visit the Business in the community website for a different 10 minute assessment and other advice, from the Business Emergency Resilience Group.
For more information, contact the Business Continuity Institute.
Last updated: 5 April 2017