![]()
CHAPTER 1: BUSINESS CONTINUITY ā WHATāS THAT?
In any organisational endeavour, be it a business, a public body or a not-for-profit organisation, the basic premise is that it does what it does without being interrupted by unforeseen factors. In order to do this, all organisations must continue to have available to them all of the resources and services upon which they depend, and must be allowed to continue doing what they do.
Resources
As they evolve, most businesses and other organisations acquire the resources upon which they depend. If any of these critical resources are lost or are taken away, the organisation is likely to find itself in trouble.
Most organisations have some contingencies for certain resource failures (usually in their IT systems) but these are often patchy and based on an individualās intuitive estimate of what level of resource would actually be required, and when.
Today, virtually all organisations rely upon common resource types, including:
ā¢ IT systems
ā¢ paper records
ā¢ telecommunications
ā¢ people
ā¢ workplace(s)
ā¢ money.
Many others rely additionally on other, more specifically physical, resources, such as:
ā¢ plant and equipment
ā¢ vehicles
ā¢ logistics
ā¢ specialised storage, handling and processing facilities.
Licence to operate
Most businesses are allowed to do what they do provided they operate within the law. On the other hand, many public bodies and an increasing number of businesses (for example, in the financial sector) operate under some form of licence, permission or authority which could, under certain circumstances, be withdrawn.
For many, this can be considered an operational (and therefore a business continuity) risk, particularly where only some of the organisationās activities are licensed or regulated.
Critically, each organisation must decide, as a matter of policy, whether risks associated with its licence to operate should be included within the scope of their business continuity management system.
Policy and scope are described in more detail in Chapter 4.
The key deliverable ā the business continuity plan
Almost anyone can write a document called a business continuity plan (BCP), but there is no purpose in doing so if it doesnāt deliver what is actually required when a disaster or business-interrupting incident or situation occurs.
This pocket guide doesnāt review the many ways in which most BCPs are not actually fit for purpose; the reality is that, in comparison to modern best-practice standards for business continuity management, most organisationsā BCPs will prove horribly inadequate. This guide looks at how ISO22301 can help to ensure that BCPs do actually deliver what is needed; that they are, in fact, fit for purpose and as a result, can deliver some return on the investment in them.
Why does business continuity matter?
Many people regard business continuity as a form of risk management or insurance; a means of ensuring that, if something goes wrong, there is a way of limiting or even eliminating the impact.
This view is largely appropriate; however, there are a number of other important reasons, outlined below, why organisations should have a business continuity management programme.
Competitive edge
As the risk of suppliers letting them down, due to operational issues, becomes more visible to a growing number of companies and other organisations, those organisations are starting to seek formal assurance that their suppliers will be able to continue supplying them in the event of some interruptive incident. This supply chain dynamic is already used in customersā due diligence processes together with other criteria including financial stability, quality management systems and information security.
The existence of a recognised business continuity standard provides a real benchmark against which organisations can satisfy themselves as to their suppliersā operational resilience. For suppliers, this means that having a BCMS that is compliant with, and better still certified to, ISO22301 can amount to a significant competitive advantage.
Licence to operate
The loss of a licence to operate represents a risk that could make significant financial impact, so the existence of a BCMS is increasingly becoming a condition of such licences.
For instance, the UK Solicitorsā Code of Conduct 2007 includes the requirement for all solicitors to provide for absences and emergencies,3 and all Category 1 responders under the UK Civil Contingencies Act 2006 are required to have tested business continuity plans. It is, of course, within the spirit of this legislation that the plans in question do actually work. ISO22301 now provides a truly international basis and benchmark for organisations to demonstrate their operational resilience and builds upon its predecessor, BS25999, which was the first real blueprint for business continuity arrangements.
Insurance
Many organisations have business interruption cover within their business insurance portfolio. This cover will usually compensate the organisation for its loss of profit in the event of an interruption, for a period called the indemnity period. This cover does not, though, compensate for any future business that is lost after this indemnity period, which is often only one or two years.
Business interruption insurance is usually a significant cost; the existence of a BCMS often provides the opportunity to reduce the amount of cover that is needed and, therefore, the insurance premium.
Corporate governance
Corporate governance is frequently referred to as a reason for ādoingā business continuity, but often without a proper explanation of its significance.
The UKās Combined Code on Corporate Governance 2003, the code of Best Practice with which, under The London Stock Exchange Listing Rules, all Stock Exchange-listed companies are required to comply, includes the...
