The subject of business continuity management has seldom been so high profile, with both private and public sectors acutely aware of the potential damage of human and natural disruption. The new standard, BS 25999-1 Guide to business continuity management, is now available to help organisations plan for the worst and enhance productivity and competitiveness. By Nicki Dennis of BSI British Standards.
In the private sector, where the FTSE 250 alone has a market value of more than £260 billion, the challenge of maintaining business security in global markets and against potential human and natural acts of disruption is paramount for organisations and their suppliers. In the public sector, documents and statements produced by various aspects of government, from the National Audit Office to the Treasury, ensure that this issue remains high-profile, particularly in the light of the 2005 Freedom of Information Act.
Yet despite the seriousness of the issue there is still a level of complacency when it comes to being fully prepared. Four-fifths of firms surveyed by BSI British Standards would expect to last no longer than one week before experiencing serious detrimental effects from a disruption or disaster. Less than half (45%) of the firms surveyed have comprehensive supply chain failure plans and just 41% are fully prepared for business relocation*.
Ensuring that an organisation can respond to any event that might disrupt normal operations or damage reputation is about preparation at every level. In its role as the UK’s national standards body, it is the job of BSI British Standards to respond to the market need for standardisation, delivering the highest level of consensus around what is regarded as best practice. We do this across all sectors but it is particularly important in areas of wide management concern such as risk, quality or health and safety.
The importance of being proactive
BS 25999-1 Guide to business continuity management has been developed to assist organisations to make sure that they are prepared. The technical committee responsible for the standard was a broad based group of world-class experts**. The standard establishes the process, principles and terminology of Business Continuity Management (BCM) and provides a basis for understanding, developing and implementing business continuity to offer confidence in business-to-business and business-to-customer dealings. BS 25999 contains a comprehensive set of controls based on BCM best practice and covers the whole BCM life-cycle.
BSI believes that putting BS 25999 in place will not only help organisations with the management of current operations but will also assist with future growth. The research shows that share-price movement for firms that experience a major incident split into two categories – recovery and decline. The common factor of those who recovered is the presence of a fully integrated crisis communication policy, which is integral to a business continuity programme. Other benefits of incorporating BCM into your organization include:
• Lower or held insurance premiums
• realizing that less business interruption insurance is often the result once a full business impact analysis has been completed
• increased confidence in the ability of the business to survive
• demonstrating a duty of care to employees
• a visible method of meeting customer expectations in a wide range of circumstances
• helping to safeguard the reputation of the company.
BS 25999-1 is intended for use by any level of organization, from those with a single site to those with a global presence; from sole traders and small-to-medium enterprises to organisations employing thousands.
BS 25999-2 Specification for business continuity management, is now in its public comment stage. It is a supporting document to BS 25999-1. It is a specification standard that will detail requirements for a Business Continuity Management System (BCMS) and provide organisations with a mechanism to ensure that their partners and suppliers also have appropriate BCM procedures in place.
This does not imply uniformity in the structure of a BSMS but will enable an organization to design one appropriate to its needs and which meets stakeholder requirements. UKAS (the UK Accreditation Service) has begun work on an accreditation scheme which should result in firms being able to offer certification from early 2008. Certification by an independent body offers the advantage of maintaining confidentiality around commercially sensitive information included in the Business Continuity Plans.
Standards support business
There is little doubt that using standards enhances productivity and competitiveness. Robust BCM standards such as BS 25999 can make supply chains more robust, improve enterprise stability, increase job security and ensure the flow of money into communities. Without this there is a significant risk to economic growth and employment, let alone the fortunes of individual companies.
BSI research reveals that for those companies which already implement standards there is an increased confidence and preparedness to manage risks such as IT failure (51% in 2006 compared to 27% in 2005), supply chain failure (45% in 2006 compared to 18% in 2005) and forced business relocation (41% in 2006 compared to 15% in 2005).
Research also confirms that having standards in place not only helps with the management of their current operations but also aids future growth. While 46% of businesses are required by customers to show they have business continuity measures in place, three-quarters now ask their own suppliers to do the same*.
It is in this context and in the knowledge that the importance of Business Continuity Management is increasingly recognized, that BSI developed BS 25999. In many respects, a business continuity management system should be considered as an extension of the organisation’s insurance policy – one which meets a key business need and can maintain brand equity.
Further standards in this related area are also under development. BS 31100, a standard for risk management, is available for public consultation; and a standard for IT service continuity which will link to BS 25999 has just started development. Please contact BSI to keep informed of further activities in this area.
* From the BSI Business Barometer survey
WHO DEVELOPED BS 25999
The BSI technical committee responsible for the development of BS 25999 comprised the following professional bodies:
• Business Continuity Institute (BCI),
• Continuity Forum
• Emergency Planning Society (EPS)
• Association of Local Authority risk managers (ALARM)
• Financial Services Agency (FSA)
• Institute of Directors (IOD)
• Association of British Insurers (ABI)
• Association of insurance risk managers (AIRMIC)
• Federation of Small Businesses (FSB)
• The Cabinet Office – civil contingencies secretariat
• Department of Trade and Industry
• Association of Chief Police Officers (ACPO)
• Many other sector trade bodies
Nicki Dennis is Head of Market Development, Risk, Quality, Fire, Health & Safety, Security at BSI British Standards. Please contact by email at nicki.dennis[at]bsi-global.com
If you would like to see a copy of the public draft version of BS 25999-2 Specification for business continuity management a free copy is available for comment at www.bsi-global.com/bs25999dpc
The articles published here in the Thinking CEO are internet updates of the latest management knowledge and practice, which have been commissioned by Sovereign Publications for their bi-annual magazine, CEO Today, and will appear later in the first 2007 issue of this publication. To contact Sovereign and CEO Today, go to:
http://www.sovereign-publications.com/ceo-art.htm
read all 70 gurus with one feed read all Read all media
