Business continuity program management – a critical and often overlooked aspect

Get free weekly news by e-mailBy Mark Prentice

Organizations invest heavily in establishing the plans, checklists and supporting components that comprise a business continuity management (BCM) program. The activities performed as part of the establishment of the program often include, but are not limited to:

• Risk analysis – where are we exposed?

• Business impact analysis – what is the impact?

• Resource analysis – what resources are required to sustain our activities?

• Strategy development – how do we best match the needs of the business against the capabilities of our providers and the available budget, while minimizing the impact of an interruption to the entity?

• Plan development – how do we integrate the emergency response, crisis management, business resumption and technical recovery plans into one overall integrated framework that also provides us with the ability to return to ‘business as normal’?

• Validation and awareness – how do we confirm that the program will work and ensure that our people know what to do and when?

A number of organizations see the effort and cost expended to establish a business continuity management program as a once-off activity. Although they may achieve the ‘tick in the box’ to satisfy the requirements of corporate governance or regulatory bodies, the ongoing commitment for the program is often reduced as they move on to the next issue.

Once the program is established there are a number of activities that protect the investment and sustain the program in line with the needs of the organization, its stakeholders and the environment within which it operates.

These activities are known as ‘program management’ and include but are not limited to:

• Maintenance;
• Validation of the framework and supporting elements;
• Awareness;
• Metrics and reporting;
• Resourcing.

Failure to address any of these activities jeopardizes the program and the ability for an organization to respond to an interruption in an appropriate manner. Each of these activities is discussed briefly below.

Maintenance of the program
A maintenance protocol is used to assist in ensuring the currency and integrity of the overall program. A key aspect of this protocol is to ensure that the organization’s priorities and the triggers used to implement the framework are re-confirmed on a regular basis. A number of business continuity plans failed when invoked because the priorities agreed when they were established had changed. A common area where maintenance is overlooked relates to changes of personnel.

Validation of the framework and supporting elements
Just as the organization’s priorities need to be re-confirmed regularly so does the capability of the supporting elements outlined in the strategy. Given the breadth of activities covered by the framework of plans and checklists, there is a need to employ a variety of techniques. Often rehearsal activity focuses on the emergency response or crisis management activities only. Exercising of business resumption and the return to business as normal does need to be undertaken, otherwise the organization may well become just another statistic.

Awareness of the program
Employees often have the knowledge and experience required to establish strategies that will work and they will be called on to implement the framework of plans and checklists when an incident occurs.

Individuals in key positions need to understand their roles and responsibilities as many plans implement organizational structures that are different to the day-to-day mode of operations. Just as the people fulfilling these roles need to be aware of what is expected of them, so the remainder of the organization needs to be aware of the protocols that are to be implemented and why.

Metrics and reporting
Most organizations employ metrics in one form or another to establish how well they are operating. Similarly with the business continuity management program there is a need to establish a series of metrics and then report on these.

Attributes such as:

- Currency of requirements and capability;
- Confirmation of capability by way of validation;
- When the last awareness session was conducted; and,
- How many areas have been involved in rehearsal activity

should be considered and measured.

Reporting of its status is integral to the integrity of the program. Some organizations are required to report the status to regulatory bodies. Others report to board committees. As a minimum there should be executive sign-off in relation to the current requirements and capability of the entity. Some organizations use the reported metrics to determine bonus payments.

Resourcing the program
Often, once established, the program can be sustained with a relatively small internal complement of personnel. When combined with appropriate liaison with external organizations (such as providers, authorities and fellow practitioners) provides the organization with a degree of integration with external parties that are often involved in incidents.

The primary objective of a business continuity management program is ‘to allow the executive to continue to manage their business under adverse conditions, by the introduction of appropriate resilience strategies, recovery objectives, business continuity and crisis management plans in collaboration with, or as a key component of, an integrated risk management initiative.’ [1]

In order for the business continuity management program to be effective and achieve the objective above, there is a need for program management activities that will assist to sustain the program in a state of preparedness for the organization.

Mark Prentice is the President of BCMIE-Australia Inc, an affiliate of DRIE. Mark has been working in the BCM arena since the early 1980’s in the banking sector and since 1990 has been consulting to a wide variety of clients throughout North America , Australia , Asia , Europe and South Africa . Mark may be contacted at

1) BCM Fact Sheet 1 – Business Continuity Awareness Week 2006BCAW2006: ‘ synergy to achieve a common goal – global resiliency’

This article is one of a series being published in relation to the Americas & Australasia Business Continuity Awareness Week 2006.

Date: 11th May 2006 • Region: Various Type: Article •Topic: BC general
Rate this article or make a comment - click here

Copyright 2010 Portal Publishing LtdPrivacy policyContact usSite mapNavigation help