Business Continuity Management (BCM) helps increase organisational resilience by strategically identifying key activities, developing solutions for continuity and allocating the necessary resources to minimise the impact of disruption.
In this article we look at five key points that organisations with BCM programmes in place should consider when assessing their suitability and maturity.
1. Does top management demonstrate their support?
Both the ISO Standard for BCM (ISO 22301:2019) and the Business Continuity Institute’s ‘Good Practice Guidelines’ emphasise the importance of the most senior personnel in an organisation providing appropriate support to BCM efforts. This includes signing off on the organisation’s BCM policy, assigning roles and responsibilities and providing practical and financial support to meeting the BCM programme’s objectives.
2. Have BCM arrangements been developed based on a comprehensive Business Impact Analysis process?
A Business Impact Analysis (BIA) process looks at the impact on an organisation’s delivery of products and services in the event of disruption. It helps to prioritise activities to minimise any adverse effects, and forms the foundation of developing continuity strategies and solutions. Without this process in place it is very difficult for an organisation to focus on its post-incident priorities and be confident its BCM arrangements are fit for purpose.
3. Have you validated your BCM arrangements through a programme of testing, exercising, maintenance and review?
Once BCM arrangements are in place, they need to be validated to ensure, as far as practicable, that they are workable. Various types of tests and exercises should be carried out, ranging from simple discussions through to, potentially, ‘live’ simulations. Regular reviews enable an organisation to keep plans up to date, reflecting changes in delivery of products and services, personnel, processes and technology.
4. Do you update your BCM arrangements in light of your experiences or that of others?
The outbreak of the global COVID-19 pandemic in late 2019 led to many organisations referring to their BCM arrangements for guidance on how to respond. Many found that the analysis carried out to develop and document business continuity plans was extremely useful, even if specific continuity strategies for responding to a pandemic had not been considered. Even organisations that have invested heavily in BCM need to ensure arrangements have been put in place for responding to such events as a pandemic, recognising that many restrictions on normal life and business activity could be imposed by local and national governments. Lessons in improving BCM capabilities can also be learned from having to respond to actual incidents, and from observing the response of other organisations in the event of severe disruption.
5. Is BCM embedded within the organisation?
The key concepts of BCM should be part of the management toolkit in any organisation. This can start with including the subject within induction programmes for new starters, through to ensuring it is fully considered in any change project.
How can Gallagher help?
Gallagher has experienced and qualified BCM specialists within our Risk Management Solutions team who can assist organisations in all aspects of business continuity. This can range from initial business continuity plan development, through various types of exercise, to reviews and gap analyses of mature BCM programmes. Please contact your usual Gallagher representative for more information.
The sole purpose of this article is to provide guidance on the issues covered. This article is not intended to give legal advice, and, accordingly, it should not be relied upon. It should not be regarded as a comprehensive statement of the law and/or market practice in this area. We make no claims as to the completeness or accuracy of the information contained herein or in the links which were live at the date of publication. You should not act upon (or should refrain from acting upon) information in this publication without first seeking specific legal and/or specialist advice. Arthur J. Gallagher Insurance Brokers Limited accepts no liability for any inaccuracy, omission or mistake in this publication, nor will we be responsible for any loss which may be suffered as a result of any person relying on the information contained herein.
