Introduction to Business Continuity Management

Understanding risk

We live in an unpredictable world. No matter how effectively a business protects itself through insurance, there are always some risks that cannot be anticipated. With appropriate insurance, an organisation whose business has been interrupted by fire, flood, environmental damage, denial of access or terrorist action can always expect to recover part of the costs –typically the shortfall in gross profits for a specified period following the incident. However, insurance can never provide cost-effective security against the long-term or permanent loss of:

Customers

Brand value

Share price

Markets

Quality

Employee loyalty

The only effective protection against serious disruption of your business is the preparation of a Business Continuity Plan. This guide is designed to help you to:

Understand what happens during an incident;

Understand how Business Continuity Management can alleviate the effects of an incident;

Present a case for Business Continuity Management within your organisation;

Identify the personnel who will be involved;

Develop a plan tailored to the needs of your organisation.

What is Business Continuity Management?

Business Continuity Management applies the risk management mantra of ‘identify; evaluate, eliminate, transfer and control ’ to its logical conclusion by providing the ability to restore business-critical functions and processes if the unimaginable happens, thus ensuring the customer retention and the survival of the organisation.

“Business continuity is not just about physical assets - it’s also about customer loss, goodwill, key employees, reputation...and more.”

Business Continuity Management is about ensuring the highest possible level of resilience to interruption, optimal damage mitigation arrangements and recovery procedures and facilities that provide timely reinstatement or replacement of business-critical processes after a disruptive incident. A well-formulated Business Continuity Plan will identify all the key actions, personnel and services needed to manage the incident and the recovery process. How much of the plan you will need at the time clearly depends upon the nature of the incident and the size and complexity of your business.

Why do we need Business Continuity Management?

All organisations have a responsibility to their stakeholders, be these shareholders, customers, vendors or members of staff. The directors of business organisations have a responsibility to ensure: continuity of income, service, production, supply; payment of employees, vendors, shareholder dividends; capital generation -all this to support stakeholder needs. Any interruption to operations can threaten the financial stability of the organisation. In many cases liquidation is the only recourse.

Business interruption is not necessarily the result of a large and obvious physical disaster. Many people believe that disasters only come in the ‘big bang ’variety and believe that they are immune from such events. They may consider that the non-controversial nature of the activities of their organisation, or to its location, may render it immune to acts of terrorism or other direct action. This may or may not continue to be the case into the future.

Statistically, the causes of a disaster are as likely as not to be fire, flood or windstorm. However, interruption equally could be caused by denial of access to the site, or key facilities where there is no physical damage to the premises.

Consider the impact of the consequences of staff being unable to reach their place of work for an extended period. More often, disasters start small and appear apparently insignificant. ‘Creeping crisis ’, gradual system failures that start with a small hiccough and then escalate; often these can be the most insidious and invidious. How will you know when an escalating system failure is beyond recovery and that business-critical processes are beginning to become affected to an unacceptable degree?

Only by conducting a Risk Assessment and Business Impact Analysis can you ensure the highest level of resilience and, if your best risk control and loss prevention measures have failed, determine the recovery criteria.

The identification of the recovery timeframe and crisis thresholds is paramount to the formulation of recovery planning, and provides a stable and cohesive basis that provides the confidence that your business would survive. Only by understanding the risks and dangers that could befall your company and putting in place the means of applying a pre-considered strategy to mitigate those risks,can you ensure that your organisation would withstand the onslaught of a disaster.

First steps

We have assumed that if you are using this guide you have the responsibility for implementing Business Continuity Management in your organisation. For the purpose of this important exercise, we shall refer to you as the Business Continuity Co-ordinator.

Please start by studying the guide carefully. It provides an overview of the requirements of Business Continuity Management and advice on the various elements that make up the process.

This guide to Business Continuity Management is designed to explain more than just concepts and is intended to simplify and de-mystify what many have thought to be only understandable within the minds of experienced consultants. Specifically, there are many ways of implementing Business Continuity Management, yet for most people, the process of understanding the concept of the planning cycle remains clouded, confusing and unattainable. By taking this journey with us through the project cycle, you will be able to develop, implement and maintain a complete Business Continuity Management process, tailored entirely to you and the needs of your organisation.

This core module of Foresight contains a number of elements. The main guidance is provided in ten sections, each of which represents one of the Ten Units of Competence 1 that embody the standards of the Business Continuity Institute. These sections are supplemented by a number of helpful appendices, including a glossary of the common terminology of Business Continuity Management.

Finally, and most importantly, Foresight includes a planning template upon which to build your own living Business Continuity Plan.

Crisis management

Crisis may arise as part of a physical disaster; equally there may be no physical impact - whatever the scenario, the business impact could be just as devastating. Crisis may involve:

Allegations/demands;

IT-based threats;

Product contamination;

Public outcry;

Regulatory authority action;

Customer concern -and there almost certainly will be intense media interest.

Project initiation and management
Risk assessment
Business impact analysis
Developing Business Continuity Strategies
Emergency response and operations
Developing and implementing Business Continuity Plans
Awareness and training
Public relations and crisis co-ordination
Co-ordination with public authorities
Maintaining and exercising Business Continuity Plans

There are circumstances for which crisis management pre-planning would provide considerable benefit; including :

Strikes

Hostile take-over approach

Environmental damage

Loss of key personnel

Actual or threatened extortion

Kidnap

Product contamination

Public image threats

Careful pre-planning is required to mitigate the potential effects of crisis; this to include:

Resilient communication capabilities

Product trace-ability and recall procedures

It is not recommended that Crisis Management Plan(s)and procedures are added as appendages to the Business Continuity Plan, rather that they be developed independently. However, whilst Foresight is not intended to address these issues, there is considerable commonality in the methodology and output from the process. Examples include risk assessment, business impact analysis; strategy development; formalised planning; internal and external communication.

To summarise

By providing summary as well as detailed information, it is our intention to give you all the facts and help you will need along the journey to completing the project cycle of Business Continuity Management. To gain most benefit from this product, it is recommended that you follow each unit of competence in sequence beginning with Project Initiation and Management.