Business Continuity Management

A report on
Business continuity
management
Business continuity management
Is the process of planning, preparatory and related activities which are
intended to ensure that an organization’s critical business functions will either
continue to operate despite serious incidents or disasters that might otherwise
have interrupted them, or will be recovered to an operational state within a
reasonably short period.
Main objective:
The objective of business continuity management is to counteract any

interruptions to business activities and to protect critical business processes
from the effects of major failures or disasters.
Framework, model and International standard
Step1: Risk Identification and Business Impact Analysis
Identify threats (hazards) to core business function continuity and the

processes, systems, information, people, assets, outsource partners and other
resources that support or rely on them;
1) Systematically analyze the likelihood and consequence of disruption

and rate using the consequence ratings in the risk management
framework.
2) Evaluate which disruption-related risks require treatment.
3) Identify treatments commensurate with BC objectives and in
accordance with the organizations risk appetite.
Business Impact Analysis
To identify the impacts resulting from disruptions and disaster scenarios that
can affect the organization and techniques that can be used to quantify and
qualify such impacts. Establish critical functions, their recovery priorities, and
inter-dependencies so that recovery time objectives can be set.
Step2: Identify and define response options
Determination and selection of strategy is based on outputs from the BIA and
built upon the Maximum Acceptable Outage (MAO) identified for each
critical process. Determine appropriate business continuity option and strategy
to:
 Protect the core functions and critical business processes.

 Stabilize, sustain, recover and restore functions, services, critical
processes and their dependencies and supporting resources.
Response options and strategy will be informed by approved time frames for
recovery of critical processes (Recovery Time Objectives -RTO). This is the
target time for resuming delivery of an operation before MAO is breached and
objectives are affected. Where required, strategy will also address the
restoration target or Recovery Point Objective (RPO) for the integrity and
availability of data (electronic and paper).
Step3: Develop Business Continuity Plans
Each critical process should have its own continuity strategy, which can be
invoked individually, or en-masse as required, whilst all assumptions made
through the planning lifecycle will be captured and validated to ensure
appropriate capabilities will exist if/when required.
The BC Plans will set out (as relevant):
1) Critical processes to be continued/recovered.

2) Defined roles and responsibilities and contact details for people and
teams having authority during and following a disruptive event.
3) A process for invoking and escalating the response;Resources required
to support the response.
4) A communication strategy.
5) Interdependency relationship details.
6) Critical supplier/vendor details and alternate arrangements.
7) A list of relevant vital records, storage and access details.
Step 4: Develop a Communication Strategy
A key part of managing any disruptive event is to develop a clear and

effective communication and consultation strategy. The strategy must be
deployed in a manner that reflects the magnitude of business consequence.
Procedures should be established, implemented and maintained to:
1) Detect a disruptive event.

2) Regularly monitor an event.
3) Manage internal communication within the organization and receive,
document and respond to communication from interested parties.
4) Assure availability of the means of communication during an event.
5) Facilitate structured communication with emergency responders.
6) Record vital information about the event, actions taken, and decisions
made.
Step 5: Training, Testing and Maintaining Plans
Education and training are necessary components of the BCM process and
require commitment from organization personnel involved in planning,
response and recovery operations.
Testing as a critical indicator of success, all BCPs should be tested (rehearsed)

and evaluated on a regular basis, results documented, and improvements
implemented.
Maintaining a schedule for the ongoing maintenance of the BCP must be

established and reported against as part of a quality assurance process.
Step6: Activation and Deployment of Plans
When a disruptive event occurs and results in the activation of BC procedures,

key personnel involved shall undertake a post-event debrief and record the
observations and recommendations to inform subsequent action planning
ISO 22301 is the international standard that helps organizations put business
continuity plans in place to protect them, and help them recover from,
disruptive incidents when they happen. It also helps you to identify potential
threats to your business and to build the capacity to deal with unforeseen
events.
BS 25999-2 Business Continuity Management—Part 2: Specification (the first

standard in the world referring to operational continuity maintenance during a
serious catastrophe or accident as well as any unwelcome event; it serves to
minimize disturbances which occur in any area of an organization);
Relationship between business continuity, risk, crisis and

disaster management:
Risk management focus on calculated and estimated risks related to certain

events before they happen. If this risk not well treated it may lead to crisis
management activation which in turn if not well handled may lead to disaster
management activation, in all cases Business Continuity Plans are required
when responding to a business continuity incident.
Conclusion:
The most comprehensive solution an organization can adopt is to undertake,

and integrate, all four methods, which will work in a complimentary fashion
to one another. A continuous cycle whereby Risk Management identifies
potential disruptions or incidents, Disaster and Crisis Management consider
not only the risk or probability of an event but also incorporates the actions
necessary during and after such an event, and all sets of information are
utilized to update Business Continuity plans and improve the quality of
Business Impact Analysis (BIA) data, which is regularly tested and findings
fed back into Risk Management, Crisis Management and Disaster
Management to revise the BCMS, is the optimal way in which organizations
can provide the most effective protection against disruption.
References:
Edward S. Devlin 2007 Crisis Management Planning and Execution [e-book].

SI: USA Auerbach publications. Available at:
https://books.google.com.eg/books
Jonathan Bernstein with Bruce Bonafede 2011 Manager's guide to crisis

management [e-book] SI: international McGraw-Hill. Available at:
Edmund H. Conrow Effective Risk Management: Some Keys to Success, 2 nd

editition [e-book] SI: Virginia AIAA Inc, Available at
Antonio Borghesi and Barbara Gaudenzi 2013 Risk Management How to

Assess, Transfer and Communicate Critical Risks SI: Springer-Verlag Italia
Dominic Elliott, Ethne Swartz and Brahim Herbane 2002 Business Continuity
Management A crisis management approach [e-book] SI: London and New
York Routledge. Available at https://books.google.com.eg/books
W. Nick Carter 2008 Disaster Management. A Disaster Manager’s Handbook

SI: Philippines. Asian Development Bank.

Business Continuity Management

Uploaded by

Copyright:

Available Formats

Business Continuity Management

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Business Continuity Management

Uploaded by

Copyright:

Available Formats

A report on

The objective of business continuity management is to counteract any

Framework, model and International standard

Step1: Risk Identification and Business Impact Analysis

Identify threats (hazards) to core business function continuity and the

1) Systematically analyze the likelihood and consequence of disruption

Business Impact Analysis

Step2: Identify and define response options

 Protect the core functions and critical business processes.

Step3: Develop Business Continuity Plans

The BC Plans will set out (as relevant):

1) Critical processes to be continued/recovered.

Step 4: Develop a Communication Strategy

A key part of managing any disruptive event is to develop a clear and

1) Detect a disruptive event.

Step 5: Training, Testing and Maintaining Plans

Testing as a critical indicator of success, all BCPs should be tested (rehearsed)

Maintaining a schedule for the ongoing maintenance of the BCP must be

When a disruptive event occurs and results in the activation of BC procedures,

BS 25999-2 Business Continuity Management—Part 2: Specification (the first

Relationship between business continuity, risk, crisis and

Risk management focus on calculated and estimated risks related to certain

The most comprehensive solution an organization can adopt is to undertake,

Edward S. Devlin 2007 Crisis Management Planning and Execution [e-book].

Jonathan Bernstein with Bruce Bonafede 2011 Manager's guide to crisis

Edmund H. Conrow Effective Risk Management: Some Keys to Success, 2 nd

Antonio Borghesi and Barbara Gaudenzi 2013 Risk Management How to

W. Nick Carter 2008 Disaster Management. A Disaster Manager’s Handbook

You might also like