How to Successfully Optimize Your BCM Program

Business continuity management (BCM) is the development of strategies, plans and actions that provide protection or alternative modes of operation for activities or business processes which, if they were to be interrupted, might otherwise bring a seriously damaging or potentially fatal loss to the enterprise.

BCM is a companywide process consisting of three primary components:

• Crisis management (to include crisis communications)
• Business process recovery planning
• IT disaster recovery planning

BCM is not the continuity and/or recovery of all business processes and functions simultaneously. Only critical business processes that have a material impact on the company should be planned for and recovered within a realistic recovery window. BCM is a process rather than a one-time event. As such, plan updates should take place annually or when significant business process change occurs, whichever is sooner.

Strengthening the Process

In an optimized organization:

• BCM is advertised internally and externally as a competitive advantage. BCM drives strategic goals and internal efficiencies.
• Comprehensive, organizationwide BCM processes are strategically aligned with objectives and customer expectations. World-class process performances are in place.
• BCM operates as a core business function, chartered with clear accountability and responsibility. Personnel are well-trained regarding their roles and duties.
• Relevant key threats and impact information are readily available. Continuity reporting is a normal part of operations.
• BCM analysis is improved continuously and systematically. Continuity risks are analyzed in relation to strategic decisions.
• The BCM program is aligned with enterprise systems in real time. New technologies are pursued to ensure BCM success. The BCM program leverages enterprise data to improve BCM.

When evaluating the strength of the BCM process, consider the following questions:

• Does the business consider business continuity planning (BCP) in the overall business strategy?
• Does the organization have a defined business impact analysis (BIA), which identifies all business processes critical to the organization and the resources that support those processes? Critical processes are those that management decides are so significant to the mission of the business that the business can’t afford to operate without them after a given period of time.
• Has the organization defined strategies for recovering the IT resources that support critical business procedures? Are proper IT policies and procedures in place?
• What is management’s assessment of the company’s ability to resume business operations in the event of a disaster?

Long-Term and Short-Term Benefits

BCM delivers performance benefits throughout the organization, improving the following aspects:

• The availability of infrastructure, facilities, equipment, critical IT applications, data and communications
• The security of facilities and IT assets and processes to ensure that all and only authorized personnel have access to facilities and information assets consistent with their legitimate business needs
• The continuity of critical business processes and IT systems

Business continuity and disaster recovery processes may lower insurance business interruptions and insurance premiums, reduce the personal liability of executive management and the board of directors, and identify antiquated controls that are no longer useful or cost-effective. Although it is difficult to quantify, business continuity plan team members become extremely knowledgeable about key business processes throughout the organization, thereby facilitating interdepartmental communication and cooperation.

The business continuity process may highlight inefficiencies and redundant processes that can be improved or eliminated, therefore reducing operating costs. It may also provide ideas for new revenue-generating avenues. In specific industries, such as telecommunications, a well-managed continuity or high-availability product offering can be sold as an additional service to corporate customers. The product offering may give the organization a unique edge in the marketplace.

You can read more on this topic by exploring these tools on KnowledgeLeader:

Business Continuity Management Capability Maturity Model (CMM)

Business Continuity Management Methodology

Business Continuity Management Guide

Business Continuity IT Process Questionnaire