Business Continuity Management

IntroductionDespite the way in which IT developments can facilitate the decentralization ofbusiness functions and activities, there has been a reluctance to decentralize. Theapparent benefits of concentration in terms of cost – for example, the savings ontravel and subsistence payments and on minimizing duplicated functions – havebeen to the fore.Since September 11 some large organizations have looked again at the processof decentralization and of reducing the concentration of staff in individuallocations. Technologies such as video-conferencing that facilitate the dispersal ofstaff have been given a further boost. E-work also falls into this category. Theprovision of effective remote access to IT systems is now seen as a priority bysome organizations. With a reasonable level of investment, the capability toenable staff to work from home and to be able to switch quickly to access ITfacilities at an alternative location in the event of a crisis is highly desirable. A byproductof providing such facilities is the ease with which employees can be keptfully informed of how a crisis is being dealt with via a confined website.BCM IS A PRIORITYBefore September 11, the need for comprehensive business continuity plans wasbeing stressed by external auditors – and internal auditors – and this has nowbecome stronger.The insurance industry was badly hit by the tragic events. In addition to rises inpremiums, insurers are increasingly seeking evidence not just of the existence ofan appropriate plan but confirmation that there is a process that has fullmanagement support and that plans have been adequately tested.Good management demands that BCM is a priority. It is a requirement of goodcorporate governance that there is a BCM programme in place. This has beenemphasized by the Turnbull Report, and board members are increasingly awareof their liability. This is the source of much of the pressure to have proper businesscontinuity plans, as managing risk has been explicitly highlighted as a key boardresponsibility.Despite these pressures there can be a tendency to pay lip service to BCM or tohave a token BCM project. Responsibility may be given to someone withoutsufficient authority and without full executive support.When the project is mooted, or when the work starts, there are always thefamiliar excuses:■■■It will never happen to us.I’m sure that we could cope.You can’t plan for the unforeseen.xvii