As business continuity starts to take its rightful place on the boardroom agenda, companies need to ensure that they are taking advantage of the standards for business continuity management that have emerged in the past two years.
“The development of robust standards is a sign that a professional discipline is maturing, and that customers can expect to start benefitting from the accumulated wisdom and experience of the top practitioners,” says Pete Frielinghaus, senior BCM Advisor at ContinuitySA. “Industry standards are essentially how the industry’s lessons learned are translated into best practice guidelines.”
Frielinghaus explains that business continuity traces its roots to IT disaster recovery, with which it is still sometimes confused. Over time, as IT became more and more integral to the business processes it enables, companies began to realise that recovering IT systems was not enough. They also needed to understand the impact of any incident – from a fire to a flu epidemic or a power outage – on the business as a whole.
“It’s not very helpful to be able to get your IT systems up after a fire if your premises are unusable. You have to have somewhere for your staff to relocate to,” he explains. “More important still, you need a detailed understanding of how important each process is to your strategy, and thus how much budget you allocate to recovering it. This highly granular understanding of the risks faced by the business, is the essence of business continuity.”
In response to the broadening of business continuity’s scope, the International Standards Organisation developed the ISO22301 standard for business continuity. In support, the Business Continuity Institute published Good Practice Guidelines in 2013. The Guidelines, says Frielinghaus, offer detailed “how-to” instructions that will help companies comply with ISO22301.
For example, the Good Practice Guidelines will help the company to understand the broader context in which it operates, and integrate the impact of disasters suffered by members of its supply chain. As Frielinghaus points out, today’s supply chains are often complex and frequently long – companies need to understand what risks they face when suppliers suffer a disaster. For example, the effect of the Japanese tsunami on component manufacturers affected several prominent technology brands all over the world.
Standards point the way towards best practice, Frielinghaus goes on to say. It’s thus very important that they are embedded into the way the company does business, rather than taken off the shelf and dusted periodically. “You really see the benefits of standards when they become not just the theory, but also the practice,” he says. “In the business continuity world, the Good Practice Guidelines help companies to move beyond just identifying and mitigating risk, to working actively to change business processes to avoid it altogether.
“In this way, becoming standards-focused helps to build an organisation that is much more resilient in itself, and that’s good news when you consider that there’s always something that you never foresee.”
