Managers get wake-up call on disaster management

A survey shows not enough is being done to prepare for potential disruptions. We launch infocast and guideline on 'taking continuity  to the next level' and pandemic planning. By Jasmin Harvey, product development specialist, CIMA Technical Services.

Managers responsible for their companies’ disaster recovery have had a wake-up call. Terrorist attacks and natural disasters over the past five years have highlighted the importance of business continuity management (BCM) in a volatile world.

There are three steps to establishing effective BCM processes:

• define BCM
• identify and classify the key components of a viable BCM framework
• place BCM in the context of organisational risk management.

What is BCM?

The UK-based Business Continuity Institute (BCI) defines BCM as ‘a holistic management process that identifies potential impacts that threaten an organisation. It provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities’.

BCM motivators

The need for BCM capabilities continues to increase because of:

• a rise in interruptions to business
• the growing impact of these interruptions
• the obligation to protect, preserve and build value for shareholders
• the business benefits of effective BCM (such as limited operational downtime, customer and staff retention)
• the generally poor quality of existing corporate BCM capabilities.

The last is arguably the most important motivator of BCM improvement. There are also new regulations and guidelines pertaining to BCM. These include:

• the New York Stock Exchange rule 446, ‘Business continuity and contingency plans’
• the UK publicly available specification 56 on ‘Business continuity management’, sponsored by the BCI and
• the Civil Contingencies Act 2004.

The number of US companies that have developed formal BCM programmes within the past six years has nearly tripled according to a survey by Deloitte & Touche.

More than 83 per cent of 273 survey respondents representing a cross section of industries say they now have formal business continuity plans. Six years ago, it was just 30 per cent. Within the past year alone, 70 per cent of respondents reported having BCM programmes for most, if not all, of their critical business functions. That was up from 41 per cent a year ago.

Steve Ross, a director and business continuity leader at Deloitte & Touche, said: ‘Organisations have accelerated and intensified the development and deployment of BCM programmes. More importantly, BCM programmes are being elevated and extended to the enterprise level.’

In the UK, a survey in May this year by the Chartered Management Institute (CMI), the Continuity Forum and the Civil Contingencies Secretariat within the Cabinet Office, concluded that:

• not enough is being done by many organisations to prepare for potential disruption - only 49 per cent of organisations have continuity plans in place
• most organisations focus their plans on loss of IT and communications. They are less likely to focus on loss of people and skills
• there is little communication of business continuity plans (BCP) beyond central teams. Only 61 per cent communicate to all employees. Only one in 10 organisations with BCPs are communicating these to suppliers and just 19 per cent to customers

Roles and responsibilities

A sound BCM strategy demands involvement of the board, senior management team, corporate finance and the finance function.

Who should own BCM? Organisations are split between IT and finance. As noted by business continuity expert, Brian Zawanda: ‘More progressive organisations have realised continuity planning must be a business issue. One option is championing business continuity through the CFO. The CFO has a good macro view of the organisation and can translate downtime into tangible financial impacts. In many organisations, risk management resides with finance, and the risk manager is a strong possibility for business continuity coordination given this person is constantly thinking in terms of risk mitigation.’

Strategic financial management professionals have a sound understanding of many areas that correspond to the essential capabilities of a BCM function. These include cost-benefit analysis, the alignment of investments with high-level business objectives, and identifying how organisational change affects large investments.

Regardless of whether the finance function owns the BCM function, it has the strategic vision, risk management expertise, financial management discipline and project management skills necessary to make BCM frameworks effective and efficient.

Developing an effective BCM framework

CIMA’s comprehensive BCM Management Accounting Guideline (MAG) explains how to develop an effective BCM framework and helps finance professionals tailor BCM to their organisation. It explains the five steps to developing BCM; places it in the context of risk management;and looks at the future of BCM. 

Management Accounting Guideline – BCM – a new CPD resource

This article has been adapted from the BCM MAG. Members can download it from the My CIMA section of this website. MAGs target issues or challenges faced by accountants in business.

Non-CIMA members can buy a pdf copy of this product from the American Institute of Certified Public Accountants (AICPA) website for US$12.50. This includes a 50 per cent discount for Insight subscribers.

Infocast series

As noted in ‘Risk infocast kicks off new collaboration’, in September Insight, CIMA has joined with the AICPA and the Society of Certified Management Accountants Canada (CMA Canada) to provide exciting initiatives, products and services for its members.

The first of these is a pilot series of infocasts on risk. The next one will be on ‘Taking business continuity to the next level – effective pandemic preparedness planning’ and will be held on 19 October, 5pm UK time. The infocast will help you to:

• identify the steps necessary to develop and/or strengthen your organisation’s BCM framework
• identify how a human flu pandemic (for example one caused by bird flu) differs from the types of disasters and business interruptions addressed in traditional continuity planning, and
• understand the key components of pandemic preparedness planning.

How to participate

For more information on the infocast, including registration, visit the infocast web page between 9 October and 3pm on 19 October. Once registered, you will be sent a confirmation email with log-in instructions.

The final in the pilot series of three infocasts will be on integrating social and political risk into business decision making, held on 16 November, 5pm UK time.

Further resources

Business Continuity Institute. The BCI’s good practice guidance is compulsory reading for any manager involved with BCM.

Deloitte & Touche Business Continuity Survey.

Disaster recovery journal provides free samples of continuity and recovery plans.

'Who owns BCM?', Steve Stanek.

BCM Survey, Patrick Woodman, Chartered Management Institute.

October 2006