141
07
Operation
OVERVIEW
• This chapter first outlines the essential attributes of understanding the organization.
• It then explains the key characteristics and concepts of a business impact analysis and how to undertake the activity.
• Next, it discusses the key characteristics and concepts of a risk assessment and its key approaches.
• The chapter goes on to introduce business continuity strategy selection and development, and explains the stages, approaches and key resources of establishing appropriate BCM strategies.
• Furthermore, it explains how to establish the business continuity capability, which includes developing the incident management structure and plans.
• Finally, the chapter highlights the different levels of validating the organization’s business continuity capability and explains the key roles in the exercise planning team and exercise programme.
Background
A fit-for-purpose business continuity capability is based on an in-depth review of the organization and its activities. It entails assessment of the impacts to the organization of a loss of its critical operations and determining the resources required to attain their recovery timescales. This is underpinned by a risk assessment that identifies priorities and mitigation strategies to safeguard the key operations.
142
In addition, there should be an appropriate form of corporate configuration for managing incidents, also known as the incident management structure (IMS), to execute command and control in the incident management process. This is to ensure that a coordinated approach is established for communication, decision-making and the implementation of responses during an incident. In its basic form, the IMS comprises strategic, tactical and operational teams, with each assigned to address different types of incidents. However, the exact composition of the corporate IMS is largely dependent on the type, size and complexity of the organization.
In order to provide greater assurance following an incident that critical operations will be recovered as required, there should be planned series of exercises to validate plans and team/individual skills. Broadly, there are two forms of exercise: discussion-based and operation-based, which can develop into five types of exercise, namely, orientation, desktop, drill, functional exercise and full-scale exercise. Each exercise is designed for different levels of BCM maturity and focuses on particular aspects of BCM. Nonetheless, as the exercise activity gains complexity, there should be risk controls to prevent probable threats from developing an exercise into a real incident. In essence, exercises provide the opportunity to identify areas of improvement, which help to drive the continual enhancement of the organization’s business continuity capability.
Understanding the organization
Understanding the organization and its business forms the basis of developing a business-driven BCMS. It comprises the process of identifying the critical functions based on their impacts on the organization’s ability to achieve its objectives and obligations. This is supported by a risk assessment, which ensures that the likelihood (frequency and probability) of critical functions being affected by probable threats is minimized. The findings are then used to determine the recovery priorities and formulate resilience measures to safeguard continuity.
In essence, understanding the organization comprises three interrelated activities:
• Business impact analysis (BIA) – This consists of analytical methodologies that assess the functions whose failure would most immediately threaten product and service delivery and have significant impact on the organization.
143
• Business continuity resource requirements analysis (BCRRA) – This activity forms an integral part of the BIA, which determines the level of resources that each critical function requires at both resumption and return to business-as-usual following a disruption.
• Risk assessment (RA) – This activity identifies potential threats to critical functions and develops risk-mitigation measures to minimize their occurrence and impact.
It is important to note that the activities of understanding the organization is performed before setting the...
