|
|
The
Importance of
Managing Business Continuity
By Priti Sikdar
Business Continuity has long been
a lurking issue for most organizations.
It is often a neglected issue as
far as precedents go. This is due
to the fact that organizations have
a false sense of security that once
they get their assets insured, they
are protected. Also till date there
is no mandatory standard in force
to move organizations towards planning
their business continuity. Though
incidents like the 9/11, the tsunami,
natural calamities like Katrina
are eye openers towards the need
to assure security and continuity.
Now BSI has launched the world's
first British standard for managing
business continuity.
The new BS 25999 Code of Practice
will help organizations to minimize
disruptions and demonstrate their
ability to cope with major threats
to their operation. By helping to
put the fundamentals of Business
Continuity Management in place,
BS 25999 is designed to keep organizations
going during even the most difficult
and unexpected circumstances while
protecting staff, preserving reputation
and providing a license to trade.
BS 25999 establishes the process,
principles and terminology of Business
Continuity Management. It also provides
a comprehensive set of controls
based on "best practice"
that will help organizations to
develop and implement a business
continuity plan. The standard can
be used as a framework, so that
those organizations without business
continuity plan can quickly establish
one, and those that already have
a plan can ensure it meets best
practice.
BS 25999 is being developed in two
parts with Part One, the Code of
Practice being followed by a Specification
which is targeted for publication
in the middle of 2007. The Specification
will detail requirements for a Business
Continuity Management System and
will provide organizations with
a mechanism to ensure that their
partners and suppliers also have
the correct BCM procedures in place.
Currently it is difficult to determine
whether organizations are adequately
prepared for disruptions but the
Specification will allow for an
audit process and certification
- meaning that organizations will
be able to clearly demonstrate to
others that they are meeting the
standard and therefore BCM best
practice.
There is little doubt that using
standards enhances productivity
and competitiveness. Robust BCM
standards such as BS 25999 can make
supply chains more robust, improve
enterprise stability, increase job
security and ensure the flow of
money into communities. Without
this there is a significant risk
to economic growth and employment,
let alone the fortunes of individual
companies. Regulation & legislation
has been a motivator for spurring
action on standards. The major obstacle
in the implementation of Business
Continuity Management has been a
lack of guidance towards how to
implement continuity measures. The
evolution of Emergency Planning,
IT Disaster Recovery, Security,
Risk Management and Civil Contingencies
has contributed to the professional
practice of Business Continuity
Management. BS25999 is intended
for those responsible for "business
operations and the continuity of
such operations"
Before the design of this standard,
PAS56, was a publicly available
paper published in 2003, partly
for comment. Now the development
of BS 25999 will bring into force
two standards:
1. BS25999-1 Code of Practice; it
is a code or best practices and
recommendations.- BS 25999-1:2006
Code of Practice for BCM. It provides
a basis for understanding, developing
and implementing business continuity
within an organization; it provides
confidence in B2B and B2C relationships
2. BS25999-2 Specification for business
continuity management is a part
against which certification will
eventually be available. It specifies
the requirements for "establishing,
operating, monitoring, reviewing,
maintaining and improving a documented
BCM system within the context of
an organization's overall business
risks", and for the implementation
of continuity controls customized
to the needs of specific organization.
- BS 25999-2:2006 A Specification
for BCM.
The BCM lifecycle is viewed as follows
(from PAS56):
Resilience to disaster and disruption
is the true goal of every organization.
A resilient organization is one
that is culturally and operationally
able to predict and avoid disruptions,
or if disruptions do occur, to minimize
their impact. Obtaining certification
to BS 25999 will be effective only
if it is embedded in business practices.
The first link is to understand
your own business needs and to weave
business strategies closely with
business continuity strategies so
as to enable them to evolve along
with business and give the status
of going concern to the organization.
Business continuity should not be
seen as a project, or a separate
activity dealt with by consultants
or specialist managers. Rather,
it should be 'embedded' within the
business so that everyone in it
carries out business continuity
as part of their day-to-day activities.
Whilst the standard is to be welcomed,
effective implementation raises
a number of challenges and questions.
They are as follows:
• How can the application
of the standard incorporate the
flexibility needed to support a
changing environment? Adherence
to a rigid structure will not support
currency of data, resources and
expertise.
• If the standard is applicable
to all businesses; particularly
those classified as micro businesses
(1-9 employees) where the standard
may be seen as too complex and burdensome.
• Implementing the standard
will not necessarily result in a
more resilient organization, since
implementation may encourage a prescriptive
or 'tick box' mentality.
• Business continuity is often
seen as a 'project' and therefore
not necessarily linked to management
disciplines systems and procedures.
In spite of the myths and complexities
surrounded round the standard, we
have to enlist the manifold benefits
on account of implementation of
the standard:
• It provides a common framework,
based on international best practices,
to manage business continuity.
• It proactively improves
your resilience when faced with
disruptions to your ability to achieve
key objectives.
• It provides a planned and
tested method of restoring your
ability to supply critical products
and services to an agreed level
and time frame following a disruption.
• It delivers a proven response
for managing a disruption.
• It helps protect and enhance
your reputation and brand.
• It gives a competitive edge
by opening new markets and helping
you win new business.
• It enables a clearer understanding
of how your whole organization works
and can help identify opportunities
for improvement.
• It demonstrates that applicable
laws and regulations are being observed.
• It creates an opportunity
to reduce the burden of internal
and external BCM audits and may
reduce business interruption insurance
premiums.
While you are planning and implementing
the BCM, there is need to study
the requirement of the standard
and use it as a measure to examine
the current health of your organization.
Gap Analysis can help you understand
to what extent you must adhere to
BS 25999 as well as help identify
those areas where there is variance.
You can do this by a structured
interview process or combined workshop.
The identification of gaps by examining
current policies and procedures
will enable you to identify areas
where you can focus your efforts
to meet the requirements of BS 25999.
It will identify the key issues
and activities that will form the
basis of your implementation strategy,
and begin to build the business
case for adopting BS 25999.
Adopting a business continuity plan
suitable to your business and nature
of organization and making it a
part of the organizational culture
is a mammoth responsibility. While
the major responsibility of introducing
the plan lies with the Board and
executive management, the rolling
out of the plan is the individual
duty of every member of the organization
and this philosophy needs to be
entwined with the day-to-day operations
routine of the individual employees.
The concept of business continuity
is not limited to IT and data issues;
it is an enterprise wide initiative!
Business continuity should not be
seen as a project, or a separate
activity dealt with by consultants
or specialist managers. Rather,
it should be 'embedded' within the
business so that everyone in it
carries out business continuity
as part of their day-to-day activities.
Also there are a series of interdependencies
as given in the diagram above.
When we talk of organizing business
continuity, issues of loss of telecommunications,
internet connectivity, physical
premises, machinery and equipment
or critical people - all of which
is possible continuity risks come
to mind. And while business continuity
planning is not the same as disaster
recovery planning, the two are closely
related. Hence the commencement
of the initiative must be in the
form of a business impact analysis
(BIA) where individual assets would
be matched against the exposed risks,
the probabilities of occurrence
and the impact on occurrence would
be listed. A process of prioritization
of risks based on business impact
analysis would enable you to arrive
at an acceptable level of risk and
to ensure that strategic risks for
which you do not want to accept
a gamble would be covered either
by mitigation measures or by transfer
of that risk through proper and
adequate insurance.
Redundancy is a desired characteristic
especially in the context of data
and telecom continuity. Adoption
of different carriers, redundant
servers, offsite transfer of backup
data electronically are some of
the means of ensuring that data
is available and availability of
telecommunication networks is unhampered
by failures or disruptions. Planning
restore measures in times of failure
forms part of ensuring telecommunications
continuity planning. Organizations
such as National Stock Exchange
(NSE) have a fully ready and redundant
mirror site to start functioning,
if any failure is experienced at
the primary site.
When we plan continuity for business
operations, the most critical aspect
we most commonly overlook is planning
for human resource continuity. Many
times we observe that the most critical
functions is carried out by one
key employee and no one else is
trained to do that job. Obviously
in the event of the person not available,
things just do not work, people
get confused and there are inordinate
delays. Cross training is an integral
part of the human resource continuity
planning so that proper assurance
is there that the activity will
be carried out without interruption.
For the last stage in the BCM lifecycle,
there has to be good testing strategies
and a proactive approach to moulding
the BCM strategies in response to
changing environment and business
requirements. Regular audit of Business
Continuity plan and testing of the
efficacy of the BCP are vital to
the success of operation in the
event of disaster. Keeping the plan
current is most important as an
outdated plan may foil the business
continuity planning and fail in
the face of disaster.
A sound risk management will ensure
that risks are covered by appropriate
controls and you have successfully
reduced the extent of acceptable
risk to a bare minimum. BCM is considered
right from planning business location,
housing of information assets, their
safeguarding measures, and the security
of the data, to the proper backup
plans to support successful storage,
retrieval and archiving of data.
Business Continuity being wider
in scope than Disaster Recovery
have to provide for financial risks,
operational risks, IT risks and
all other risks that hit the business
and the failure of which may affect
the very existence of the business.
Resilience is the desired way to
achieve the objective of perpetual
existence.
The BS 25999 standard provides a
good reason for companies to adopt
it and go for certification. The
method to achieve this certification
would be as follows:
1 A Client seeking certification
to BS 25999 Standard will apply
to a Certification Body (CB);
2. The application will be reviewed
to ensure that it is within the
scope of the CB's accreditation.
The CB will assemble an audit team
to match the Client's industry specific
and technological environment;
3. If the proposed certification
is within the CB's scope of accreditation
and an Audit Team matching the Client's
requirements can be fielded, the
CB will submit aquotation to the
Client;
4. If the quotation is accepted,
the CB will carry out the Stage
1 audit (also called the initial
assessment or desktop review) of
the documented BCP(s) and IMP to
determining whether they meet the
requirements of the standard. If
the documentation fails to meet
the required standard, the Client
will be required to address the
outstanding matters before the next
stage, a Stage 2 (also called the
Conformance Audit or Certification
Audit), can start;
5. When the outstanding matters
have been addressed successfully,
a date for the Stage 2 Audit will
be arranged with the Client.
6. The Stage 2 Audit will examine
evidence that the implemented BCP(s)
and IMP conforms to the Client's
documented BCP(s) and IMP. The Client
will be advised of the findings
and outcome of the audit.
7. If the results of the Stage 2
Audit indicate that the requirements
of BS 25999 Standard have not been
met, the Client will be required
to agree to a Corrective Action
Plan (CAP) to address the weaknesses.
Once the client has addressed the
weaknesses a further Conformance
Audit will be carried out;
8. If the outcome of the further
Stage 2 Audit is successful, a recommendation
will be made for certification.
The audit report will be forwarded
to the BS 25999 Certification Manager
for final review and subsequent
issue of the certificate.
9 Even after the certificate is
obtained by client, there is a system
of periodic monitoring of the BCP(s)
and IMP, known as Surveillance Audits.
This process is designed to ensure
that the Client Organization's BCP(s)
and IMP continue to conform to the
requirements of BS 25999.
Continuous resilience is to be certified
and building a robust infrastructure
is primary concern for every organization.
Operational risks, financial risks,
natural disasters, internet related
risks are to be addressed in the
planning process since they all
can affect business continuity of
an enterprise. Security measures
have to be interlinked into the
culture and routine activities performed
by the employees. Prioritizing on
critical processes and risk mitigation
measures helps reduce extent of
risk and promotes the going concern
ideology.
(Author belongs to Business Risk
Services division of Grant Thornton.
E-mail pts@wc-gt.com) |
