Five key points to consider when reviewing your business continuity programme

We live in an unpredictable world, where disruptions can impact an organisation at any moment. All organisations must be prepared to respond to an emergency, disaster or crisis and have pre-planned strategies in place that enable them to recover from the effects of situations in as timely a manner as possible.

Business Continuity Management (BCM) helps increase organisational resilience by identifying priority activities, developing suitable strategies and solutions for continuity following disruption and allocating necessary resources to minimise the impact of disruption.

In this article we look at five key points that organisations with BCM programmes in place should consider when assessing their suitability and maturity.

1.Does top management demonstrate their support?

Both the ISO Standard for BCM (ISO 22301:2019) and the Business Continuity Institute’s ‘Good Practice Guidelines’ emphasise the importance of the most senior personnel in an organisation providing appropriate support to BCM efforts. This includes signing off on the organisation’s BCM policy, assigning roles and responsibilities and providing practical and financial support to meeting the BCM programme’s objectives.

2.Have BCM arrangements been developed based on a comprehensive Business Impact Analysis process?

A Business Impact Analysis (BIA) process looks at the impact on an organisation’s delivery of products and services in the event of disruption. It helps to prioritise activities to minimise any adverse effects, and forms the foundation of developing continuity strategies and solutions. Without this process in place it is very difficult for an organisation to focus on its post-incident priorities and be confident its BCM arrangements are fit for purpose.

3.Have you validated your BCM arrangements through a programme of testing, exercising, maintenance and review?

Once BCM arrangements are in place, they need to be validated to ensure, as far as practicable, that they are workable. Various types of tests and exercises should be carried out, ranging from simple discussions through to, potentially, ‘live’ simulations. Regular reviews enable an organisation to keep plans up to date, reflecting changes in delivery of products and services, personnel, processes and technology.

4.Do you update your BCM arrangements in light of your experiences or that of others?

The outbreak of the COVID-19 pandemic in late 2019 led to many organisations referring to their BCM arrangements for guidance on how to respond. Many found that the analysis carried out to develop and document business continuity plans was extremely useful, even if specific continuity strategies for responding to a pandemic had not been considered.

Even organisations that have invested heavily in BCM need to ensure arrangements have been put in place for responding to such events as a pandemic, recognising that many restrictions on normal life and business activity could be imposed by local and national governments. Lessons in improving BCM capabilities can also be learned from having to respond to actual incidents, and from observing the response of other organisations in the event of severe disruption.

5.Is BCM embedded within the organisation?

The key concepts of BCM should be part of the management toolkit in any organisation. This can start with including the subject within induction programmes for new starters, through to ensuring it is fully considered in any change project.

How can Gallagher help?

Gallagher has experienced and qualified BCM specialists within our Risk Management Solutions team who can assist organisations in all aspects of business continuity. This can range from initial business continuity plan development, through various types of exercise, to reviews and gap analyses of mature BCM programmes. Please contact your usual Gallagher representative for more information.

The Major Risks Practice of Gallagher are Associate Partners at Airmic. For more information, please contact Mark Rubidge, Director at Major Risks Practice: Mark_Rubidge@ajg.com.

^{This note is not intended to give legal or financial advice, and, accordingly, it should not be relied upon for such. It should not be regarded as a comprehensive statement of the law and/or market practice in this area. In preparing this note we have relied on information sourced from third parties and we make no claims as to the completeness or accuracy of the information contained herein. It reflects our understanding as at 02.12.2020, but you will recognise that matters concerning COVID-19 are fast changing across the world. You should not act upon information in this bulletin nor determine not to act, without first seeking specific legal and/or specialist advice. Our advice to our clients is as an insurance broker and is provided subject to specific terms and conditions, the terms of which take precedence over any representations in this document. No third party to whom this is passed can rely on it. We and our officers, employees or agents shall not be responsible for any loss whatsoever arising from the recipient’s reliance upon any information we provide herein and exclude liability for the content to fullest extent permitted by law. Should you require advice about your specific insurance arrangements or specific claim circumstances, please get in touch with your usual contact at Gallagher.}

^{Arthur J. Gallagher Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: Spectrum Building, 7th Floor, 55 Blythswood Street, Glasgow, G2 7AT. Registered in Scotland. Company Number: SC108909.}