Wolfgang Mahr As with any other ISO management standard, not improving is not an option in ISO 22301. Best results can be achieved if improvements are applied to different aspects of the BCM approach. What improvement area or areas may have high priority is mainly dictated by the actual situation of the organization.
Not advancing is slipping back
A Business Continuity Management (BCM) approach will never be ideal right from the beginning. Various constraints demand conflicting limitations to be observed. In fact, asking for too much right in the beginning is not a recipe for success. The following proposals of practical examples of how to achieve continuous improvement are based on my experience with several BCM projects. As they are independent from each other, they can be applied separately or simultaneously.
Scope: Small is beautiful
The requirements in ISO 22301 ask for limitations in the form of a scope definition. This means that we have to make up our minds in order to define a scope. This limitation might be in the form of focusing on specific processes, locations, or products and services. We really have to focus on the most important resources within the organization to protect. I have found that limiting scope to a somewhat narrow field of view is very commendable. If we start with a narrow, but consciously limited scope, we increase our chances to successfully implement a BCMS (Business Continuity Management System). As we have to come up with a proposed scope before having attempted a BIA, executing the BIA (Business Impact Analysis) is the first opportunity to improve our approach. We will gain valuable information in this process. As we simply know much more about our organization after the BIA and/or risk assessment, we have improved our BCM approach.
Lifelong learning
Also, the experience of our business continuity team members might not be exceptionally good right at the beginning. Having them gain experience, and putting them through appropriate training, also improves our BCMS approach. Similarly, I most often notice the general awareness of all staff to be near zero when initiating a BCM approach. This gives us an opportunity for improvement by enhancing the awareness of our staff. Awareness can be raised through several measures: awareness sessions, information and/or quizzes on the intranet, orientation during exercises, etc. Have a look at the article How to perform training and awareness for ISO 27001 and ISO 22301 to learn more.
These learning initiatives create insights and contribute to continuous improvement of the BCMS by launching initiatives that individuals without training and knowledge would never think of.
Tone from the top
Top management needs to be involved and actually has to drive continuous improvement, as required in ISO 22301. Top management needs to be familiarized with the BCM approach, and its advantages, benefits, and opportunities. As mentioned above, the first attempt to implement a BCM approach might be patchy and incomplete. On the other hand, ISO 22301 specifies the implementation of a BCMS, a fully fledged management system. There is great room for improvement between a first-cut approach and a certified BCMS. Bridging the gap takes time and effort and offers plenty of opportunities to continuously improve our BCM approach. Management has to take up their share of initiating, driving, and supervising the improvement measures.
Let’s have a plan
When implementing a business continuity plan (including the setup of corresponding structures like a business continuity team), usually I can identify the range of opportunities for improvement. Have a look at the article Business continuity plan: how to structure it according to ISO 22301. Typically, I find that the business continuity team is not sufficiently trained to handle incidents, which might escalate into critical business disruptions or even serious crises. This implies conducting training and exercises, crucial for proper handling of business disruptions, to be organized. See the article How to perform Business Continuity exercising and testing according to ISO 22301. A plan that has never been exercised is quite ineffective. In most projects I have to persuade the business continuity team to set up a plan for running exercises, typically starting with simple, riskless, but not very effective exercises. More and more complex exercises need to follow, thus improving preparedness and confidence when actually handling business disruptions. Planning ever more complex exercises is a major contributing factor to improving our BCM approach.
Second opinion
Another tool is having our approach reviewed by a party other than the project team or plan authors, such as internal and/or external audit. These experts are supposed to have a critical look at our approach, finding inconsistencies, missing elements, or other aspects the project team did not address. Their feedback is a major building block for the improvement of our BCM approach.
Catching up
As the organization is developing, we need to make sure that our documentation and plans never fall behind, making them useless when needed. This is especially important for any documentation to be used during a business disruption. In an effort to enhance the usefulness of the documentation, we have to reduce the time between changes in the real world (organizational changes, staff changes, or changes in the configuration of facilities and technology) and the supporting documentation. If we succeed to reduce this time delay, this is a real improvement as opposed to an operational procedure, which calls for an update without any real effort to keep the lag as small as possible.
The takeaway
BCM is following a lifecycle. This means that the above activities are to be conducted periodically. For example, if the organization repeats the BIA for a second or third time, the important information obtained will be of a much higher quality than with the first attempt. The repetition of the above steps will inherently lead to improvements. The above examples demonstrate that continuous improvement is not only a prerequisite of a proper BCM approach, but offers opportunities to add value to the organization by enhancing both preparedness for and reaction to business disruptions. Actually, that’s what BCM is all about.
Check out this free webinar ISO 22301: An overview of the BCM implementation process to learn more about ISO 22301 implementation.
