| Business Continuity Management (BS-25999)
Business continuity management system (BCMS) is an holistic management process that identifies, in advance, the potential impacts of a wide variety of disruptions to the organization’s ability to function, allowing that organization to tolerate the loss of part or all of its operational capability. BCMS is a business-owned, business-driven process that establishes a fit-for-purpose strategic
and operational framework that:
The term BCMS denotes
the whole management system of providing and proving
resilience and recovery. BCMS will result in the creation
of one or more business continuity plans. A small
organization may have one business continuity plan that
covers its entire operations. A very large organization
may have dozens of business continuity plans, each of
which specifies in detail the recovery of a particular
part of its business. The degree to which BCMS is
implemented in an organization will be proportionate to
its size and scale, and may be subject to such
cost-benefit analysis as the organization deems
appropriate
The key elements of BCMS
include:
- understanding the overall context
within which the organization operates
- understanding the critical products
and services that the organization has to deliver (its
objectives)
- understanding what barriers or
interruptions can be encountered in trying to deliver
these critical products and services
- understanding how the organization
can continue to achieve these objectives should
interruptions occur
- understanding the likely range of
outcomes when controls and other mitigation strategies
are implemented
- understanding the criteria or
triggers for implementing incident and emergency
response, and business recovery procedures
- ensuring that all staff understand
their roles and responsibilities when a major
disruption occurs
- • building consensus and commitment
to the implementation, deployment and exercising of
business continuity
- integrating business continuity as
part of routine “business as usual
BCM Lifecycle
Why should an
organization undertake BCMS?
BCMS forms an important
element of good business management, service provision and
entrepreneurial prudence.
Managers and owners have
the responsibility to maintain the ability of the
organization to function continuously. Organizations
constantly make promises or have a duty to deliver
products and services, i.e. they enter into contracts and
otherwise raise expectations. All organizations have moral
and social responsibilities, particularly where they
provide an emergency response or a public or voluntary
service. In some cases, organizations have a statutory
duty to undertake BCMS, e.g. those subject to the relevant
provisions of the Civil Contingencies Act.
Prudent management
therefore recognizes the need for adequate risk
recognition and risk management. BCMS delivers the ability
to conduct core business and provides the capability to
adequately react to incidents or operational interruption,
whilst protecting staff welfare and safety. In any
organization, all business activity inevitably leads to
risks and to the possibility of adverse circumstances
arising from those risks. In addition to business risks,
there are internal operational risks, such as process
breakdown and technology failure, and external risks, such
as flooding, utility disruption and terrorism.
Progressive
organizations now regard BCMS not as a costly planning
process, but as a key value added improvement process
firmly integrated with risk management.
The benefits of
an effective BCMS program
The benefits of a BCMS
program are that the organization:
- is able to proactively identify
risks to its operation, and have in place a capability
to mitigate and manage those risks
- maintains an ability to manage
uninsurable risks, such as risk to reputation
- has in place an effective response
to major disruptions
- is able to demonstrate that the
program is credible through a process of exercising
and auditing
- may have a competitive advantage,
conferred by the demonstrated ability to maintain
customer service, profitability and employment of its
staff
- is able to demonstrate that the
program is iterative and is embedded as good business
practice
|
