The best in planning for the worst… assuring business continuity

New business continuity standard

Business continuity and reputation topped the list of “most important risks over the coming year” in a recent survey of risk managers (ref.1) and along with the publication of a new Business Continuity Standard (ref.2), is likely to lead to businesses coming under even greater pressure to demonstrate that business continuity risks are managed effectively.

Risktec has recently been engaged by one of the world’s leading consumer packaging companies to support the development and implementation of a Business Continuity Management (BCM) strategy across its business. To facilitate this process, Risktec has developed a risk-based framework for BCM.

Risk-based framework

The first stage is to guide management and operations personnel through a structured risk identification and assessment process. Facilitated workshops have been found to be a very effective means of doing this. The threats identified are assessed using an organisation specific risk matrix taking into account the recovery time objectives for the business.

The next stage is to identify strategies to reduce the risk for the key scenarios identified. The suitability of alternative strategies is assessed against the output of the risk assessment and, if necessary, the cost-benefit of alternative strategies is analysed.

Using a list of key risks as guidance on the type of events which the business may need to respond to, the final stage is to develop the business continuity plan (BCP). The BCP brings together the actions to be taken at the time of an incident, the persons involved in managing the incident and how they are to be contacted. It should also interface with other key plans for the business (e.g. crisis communications and PR, safety and emergency plans, etc.).

Documenting the BCP is one part of the overall BCM programme. Its success, however, relies upon the development of a risk-aware culture across the business, regular rehearsing and testing of the BCP and reviewing of the key risks and BCM strategies.

Conclusions

Risktec’s approach is believed to be unique in that it focuses BCM on the threats which present the greatest risk to the business, not just the worst-case impact, as is often the case with conventional business continuity or disaster plans. Business continuity is now recognised as being a key area of any overall risk management strategy.

Ref. 1 Association of Insurance and Risk Managers, June 2003.
Ref. 2 PAS 56 Guide to Business Continuity Management, British Standards Institute, December 2003.
Ref. 3 The Journal of the Institute of Risk Management, November 2003.

This article first appeared in RISKworld Issue 5.