4 October 2011

Companies recognise the importance of a working and relevant business continuity plan

So are there reasons why you should be concerned about BCM and if so, what are the key stages that form part of any BCM?

Obviously, there is the option for a company's management to put its head in the sand and hope that nothing bad will happen to the business. However, as recent fires at business premises have shown, not having a good BCM is not a plausible option.

Statistics show that a high proportion of companies fail within two years of a major disruption - even if the company has an appropriate insurance policy. With changes to the actions that fire-fighters can take with commercial buildings, it is now more important than ever to have a workable and comprehensive BCM. Fire, although an obvious and frequently cited cause of business disruption forms only a fraction of the potential problems than can impact upon your business.

Preparing a BCM
In line with the best practice guidelines and BS25999, there are actions that need to be carried out with the preparation of the BCM plan.

Top management need to be involved and committed to the project, to making informed decisions and to continuous improvement. As such there should be someone with suitable seniority to be responsible for the BCM and it should be an agenda item similar to H&S and HR.

Understanding your business
Stakeholder analysis is needed to identify continuity solutions based on their expectations. Clients are clearly key stakeholders but these also include employees, suppliers, shareholders, banks and insurance companies.

After this identification, prioritise the key products and services that if disrupted would have the greatest impact on your business and stakeholders. This will help you develop your ‘business impact analysis' - the greater the impact the higher the priority. To do this calculate the maximum time period that your stakeholder may manage without the product, and remember that this may be seasonal, so adjust your analysis accordingly. Then map your processes. This will enable you to have a clear view of what is needed to get these high priority services and products delivered to your stakeholders as soon as possible.

Risk assessment
What are the possible risks that may actually disrupt the key processes of your business? These may range from fire, staff illness, loss of access to premises, loss if ICT etc. Like any risk assessment management, decisions need to be proportionate to the level of action required, ranging from planning of continuity to accept the risk with no action required.

Developing the BCM
The preparations and actions mentioned above are an essential start to the BCM process. It is only when these are clearly qualified can the business move on to the development of the plan. It will show the resource needed and prioritise the areas of the business that are going to require specific and comprehensive back up. No business can mitigate against all the potential risks that it may face, but by creating actions and implementation plans, you can be confident that you will be covering the most important areas.

Training and continuous improvement
Drafting the BCM is only the start of the process - you need to continually improve your company's BCM through review, testing and training. This will ensure that the plan is frequently updated and remains relevant to the business, otherwise there's little point having it.