When approaching the implementation of a Business Continuity plan early stage thinking should be around setting
- A Policy
- A Program
The BC policy of an organization provides the framework around which the BCM programme is designed and built. Organization and governance are essential prerequisites for developing a successful programme. These are set out in the BC policy document, which is owned by Top Management and demonstrates their commitment to it.
The purpose of issuing a policy statement is to communicate to interested parties the principles to which the organization aspires. As its primary purpose is communication, it should be short, clear, precise and to the point. A long complicated BC policy statement will be a barrier to communication.
In many organizations, a high-level assessment of the threats to the organization’s strategic objectives will have been undertaken as part of the business planning process. The output of this can provide a useful input when setting the overall policy for the BCM programme. In some regulated environments, a formal risk assessment is a mandated activity – although the precise methods used are not normally mandated. Once a BC policy has been agreed, a project or series of projects should be initiated to enable the organization to undertake the activities required to implement it through a BCM programme.
The BC policy should include the scope of the BCM programme both in terms of what it is designed to protect and the maximum extent of damage, loss or interruption the organization can realistically survive.
The purpose of setting the scope is to ensure clarity regarding which areas of the organization are included within the BCM programme, defined by identifying which products and services fall within it. This focuses on the key success criteria of most organizations – the delivery of products or services. An understanding of the organization’s strategy, objectives and culture is required before the scope of the BCM programme can be fully determined and choices confirmed.
The BCM programme is a continually evolving process, allowing an organization to initially implement a BCM programme in some parts of the organization, while anticipating that it will be extended to the whole of its operations in time. Such an approach overcomes the problems of complexity, cost and scale in implementing a BCM programme in large organizations.
The choices available to the organization to protect its delivery of products and services and how and why it might select various products and services for its initial implementation are critical. These choices will define the scope of the BCM programme.
Examples of products and services include:
• A manufactured product or range;
• Waste collection (for a municipality); or
• Telephone support (for a software organization).
Decisions on which products and services to include within the scope may be prompted by one or more of the following factors:
• A customer requirement;
• A legal or regulatory requirement;
• Perceived high-risk location due to proximity to other industrial premises or physical threats such as flooding;
• Product generating an overwhelming proportion of organizational income.
For more information please contact 0845 0523945