Business Continuity Management System
BCM is a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.
Business Continuity Management System also involves the management of recovery or continuity in the event of an incident and management of the overall program through training, rehearsals, and reviews, to ensure the Business Continuity Plan stays current and up-to-date.
Purpose of BCM is to provide a basis for understanding, developing and implementing business continuity within an organization and to provide confidence in business-to-business and business-to-customer dealings.
- To maintain the ability of the organization to function continuously even during an incident or disaster
- To deliver product or service on time always, the organization will decide the allowable delays
- To comply with moral and social responsibilities
- The Statutory duty to undertake BCM in many countries if exporting their products
Benefits of an effective BCM Program
The benefits of a BCM program are that the organization:
- is able to proactively identify risks to its operation, and have in place a capability to mitigate and manage those risks;
- maintains an ability to manage uninsurable risks, such as risk to reputation;
- has in place an effective response to major disruptions;
- is able to demonstrate that the program is credible through a process of exercising and auditing;
- may have a competitive advantage, conferred by the demonstrated ability to maintain customer service, profitability and employment of its staff; and
- is able to demonstrate that the program is iterative and is embedded as good business practice.
SCOPE OF SERVICES
Phase I: Understanding the Organization
A BCM understanding of the organization comes from:
- identifying the organization’s objectives and stakeholder obligations through Business Risk Assessment;
- requiring senior management to identify critical products and services that support these objectives and obligations (which determine the BCM scope);
- identifying the activities, assets and resources that support the delivery of these products and services;
- assessing the impact and consequences over time of the failure of these activities;and identifying and evaluating the perceived threats that could disrupt its activities.
The Approach in this Phase will be to have a brainstorming session at all levels of the organization including Top Management.
This will include various training sessions on the importance and requirements of BCM for all levels.
The outcome of this Phase will be Business Impact Analysis (BIA).
Phase II: Determining BCM Options
Selection of BCM option to ensure the following:
- provide continuity for the products or services of the organization following an incident, and
- implement appropriate measures to prevent incidents occurring, and/or reduce the potential effects of those incidents;
- take due cognizance of the resilience and countermeasure options already present within the organization, in order to avoid the development of duplicate controls.
Based on the Business Impact Analysis, available resources and future business requirements, various options will be selected with the support of Top Management and policies will be documented.
Phase III: Developing and Implementing a BCM Response
Preparation and execution of
- Incident Management Plan
- Business Continuity Plan
As an input to this Phase, various policies developed in Phase II will be deployed through various plans and procedures. Plans / Procedures need to be developed by Cross-Functional Team at all levels.
Onsite support shall be provided to ensure smooth implementation.
Phase IV: Exercising, Maintenance, Auditing and Self-Assessment of BCM
In this Phase, personnel will be trained in carrying out the Self-Assessment and Internal Audit. This stage is of utmost importance to continue the BCM.
Phase V: Embedding BCM in the Organization’s Culture
Creating and embedding a BCM culture within an organization can be a lengthy and difficult process that might encounter a level of resistance that was not anticipated. An understanding of the existing culture within the organization will assist in the development of an appropriate BCM culture program.
All staffs have to understand that business continuity management is a serious issue for the organization and that they have an important role to play in maintaining the delivery of products and services to their clients and customers.
BCM will be embedded in the culture of the organization through ongoing education and information program for existing and new staff.