Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

embedding business continuity management

By Ian Charters, FBCI.

The intention of this article is to give you some idea what an embedding programme could look like in the brave new world of ISO 22301 – but it should be just as relevant if you have no intention of certification as it still a vital part of the overall business continuity management programme.

An entire chapter of BS 25999-1 and a significant section of 25999-2 are entitled ‘Embedding BCM into the culture of the organisation’. However this title does not appear in the new ISO 22301 international business continuity management standard – so do we no longer have to embed our BCM practices – or is there no longer a culture to embed into?

If you look more carefully into ISO 22301 there are headings such as ‘Competence’, ‘Awareness’, ‘Communication’ and the various requirements to conduct maintenance at regular intervals. You will also find a requirement to ensure the integration of business continuity management system (BCMS) requirements into business processes. So all the elements of embedding are there! The main reason why the requirements have become dispersed was the obligation to use the new standard ISO Management Systems structure.
In addition, the requirement to ‘improve the BCMS’ implies a need to create an environment in which BCM can thrive and become ‘the way we do things around here’.

To create this business continuity-friendly environment we will have to:

  • Create support by changing attitudes and behaviours;
  • Improve capabilities by developing skills;
  • Ensure plans, strategies and other BCM elements stay up to date whilst making best use of our limited business continuity resources of time and budget.

We may need to change attitudes to business continuity within the organization so that plans, maintenance and exercises are done willingly and with understanding of their purpose. We can often create awareness most effectively through appealing to the personal goals of individual staff to gain the necessary buy-in so we will need to vary the message to gain the interest of different groups. For example:

  • Top management – we should relate our BCM message to the organization’s strategic objectives, future financial results and increased certainty of delivering on them.
  • Middle management – we should tie our message to the individual’s performance evaluation where this requires involvement in response and recovery planning and point out the peace of mind they will gain from being confident that disruptions can be managed effectively.
  • Sales and marketing – we should get them to see that BCM can create new market opportunities through being able to offer greater resilience to customers, possibly with higher returns (and increasing their own bonus).
  • All staff – we should sell it to staff as a protector of their well-being and their jobs.

Some ways we can get the message over to all staff are:

  • Include the business continuity messages - such as incident response procedures, bad weather policies and the importance of maintaining contact information – as part of induction or on-going training.
  • Encourage employees to apply business continuity principles to their home and family – perhaps by putting together a home ‘grab bag’ in case they are evacuated and taking copies of vital documents and spare keys to a safe location (a relative’s house perhaps).
  • Timetable a focus during Business Continuity Awareness Week – and take advantage of the materials available on the BCAW website.

We can learn a lot from marketing here. We should view the organization as a set of customers and find out what makes them want to buy then make it interesting and attractive. Helen Sweet, MBCI, used to publish topical doggerel verse to catch the eye – I remember the Christmas one about Santa having his sleigh clamped by a traffic warden – with the hope that he had a recovery plan as the festivities were approaching fast. A couple of years ago, at the Christmas meeting of the Business Continuity Institute’s NE England Forum, we played a team game on the same subject – Santa’s little helpers had to manage the continuity of present distribution with their chosen recovery strategies – with Lapland news broadcasts delivering the bad news of Arctic Skuas bringing down power lines; reindeer flu interrupting distribution; and wrapping paper shortages. This sort of event could go down well at a team briefing rather than a straight BCM presentation.

We need to develop competences throughout the organization, both in business continuity programme development and in response and recovery.

This may include:

  • Training – ensuring that individuals and teams have the required skills for specific business continuity programme or response roles such as undertaking a BIA, decision making, salvage techniques or effective chairing of a team.
  • Experience – we should ensure they can apply the knowledge and skills acquired. For example media training could be practiced in the context of an incident management exercise.
  • Education – to extend the BCM team’s knowledge via forums, diplomas, online learning or conferences so they stay current with developments in the discipline.

We also need to try to integrate business continuity maintenance into the processes of the organization – so it is done as a matter of routine.

These could be:

  • Scheduling a strategic BIA discussion as part of the Executive’s discussion of the organization’s strategic plan.
  • Setting a policy that a BIA and business continuity strategy planning / exercising forms an integral part of the development and testing of the launch of a new product or service.
  • Ensuring that a review of the business continuity impacts is included into change control procedures for IT or production upgrades.
  • Checking that business continuity procedures become part of the department’s procedure documentation and are maintained at the same time.
  • A business continuity exercise being scheduled as a follow-on from a regular fire-evacuation exercise.

So we need a planned programme because all of these activities are related in the following ways:

  • Resource planning – we need to ensure the business continuity resources are available to undertake the various events.
  • Date availability – we need to ensure the availability of staff and required resources such as rooms and equipment.
  • Interrelationships between all these activities – we need to ensure that skills training precedes events in which those skills can be practiced.
  • Interrelationships with other programmes and training – we may take advantage of programmes run by other parts of the organization such as induction, other related training and staff events to put over a BCM message.
  • Integration with maintenance and review cycles already within the business.

So an ‘embedding programme’ - an annual calendar and project plan - is suggested that pulls together all these elements and enables the deadlines and resource requirements to be identified and managed.

Despite this plan, we should always be prepared to take advantage of opportunities. We sometimes throw the planned programme away because something has happened that provides an opportunity of increased awareness – in the way that the threat of a pandemic caused many organizations to develop contingency plans for staff loss.

Having delivered our programme how do we measure its outcomes? Of course, we will need to decide what we are going to measure and establish a baseline to measure against at the beginning of each programme period.

We can measure individual’s competence through:

  • Appropriate training and exercises attended;
  • Records of personal development such as the Business Continuity Institute’s CPD;
  • In-house testing or assessment of experience;
  • Appraisal against job description and objectives;
  • External qualifications earned.

We can measure the success of the embedding programme in developing the organization’s capability through:

  • The evaluation of exercise outcomes or response to real incidents;
  • The currency of response and recovery plans;
  • Surveys of staff – to assess awareness and knowledge of the BCM policy and their role in incident response;
  • Achievements against the business continuity objectives set by management – such as the completion of programme milestones.

It should go without saying, though, that there are requirements in ISO22301 that the competencies of staff and other measures are appropriately documented.

I would commend to you the new version of the Business Continuity Institute’s Good Practice Guidelines coming out in March 2013, which has been expanded and the embedding section reorganised along the lines I have been following in this article.

So I suggest you should develop an annual programme for embedding business continuity, coordinated with the exercise programme – as this provides a useful way to structure and coordinate many of the business continuity programme management activities and to ensure that they are delivered in the most effective way.

We should also attempt to measure the effectiveness of our programme or event, whilst always remembering that not everything worthwhile can be measured.

The author
Ian Charters, FBCI, is a consultant in all aspects of business continuity management with a client profile covering many sectors and organization sizes. He is a skilled training presenter and has delivered courses in the UK and the Middle and Far East. He is a member of BSI’s BCM/1 Committee and a UK expert on ISO TC223. Contact Ian at ianc@continuity.co.uk

This is an expanded version of a paper first presented at the BCM World Conference 2012.

•Date: 13th Dec 2012 • UK/World •Type: Article • Topic: BC general

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here