Business Continuity
Raising the Standards
A major shake up is set to revolutionise the field of Business Continuity Management (BCM) within the next coming year when a new UK standard comes into force.
Current levels of Business Continuity Management are believed to be poor in the UK and more incentives to improve this are required.
- The insurance industry has pledged to reward compliance with premium reductions.
Another voice condemning the lack of BCM among UK business is Zurich Risk services strategic risk consultant Tim Astley, who says:
"Business interruption losses represent a significant proportion of claims and yet companies often pay less attention to understanding interruption risks than they do on establishing property asset values".
"…Insurers will also offer discounts for compliant firms, people that work towards the standard will have a better risk profile, and this will lead to better rates for insurance." - Industry Quote
The major question with compliance, therefore, is whether firms will have the resources to fully meet its requirements. A key criticism of BS25999 is that it is so arduous that many firms will be unable to reach the goals set out.
Too often, firms believe it is the major events such as a terrorist attack or natural disaster that will affect their business, when things like electrical problems, faulty IT servers and smaller incidents can be just as disruptive and more common.
The oil blaze in Buncefield, Hertfordshire, last December was another event that severely tested companies readiness for operational interruption. Many local businesses closed, even if their premises were completely untouched and not directly affected because staff were not allowed near the disaster area.
The scale of the interruption even forced fast food giant McDonalds to experience major disruption brought on by bread shortages because one of its suppliers was located near the site and was unable to distribute to its usual array of restaurants in the region.
"Buncefield woke people up to the notion of events beyond their control, it costs firms a lot because people could not get anywhere near the site and it was not conventional. It emphasised the need for organisations to look at the effect of disasters beyond their control and that is what BCM needs to deal with." - Industry Quote
Mr Leighton insists that during the first year of BS25999 before firms can be formally accredited as compliant, it will be up to suppliers at the top of the 'food chain' to ensure the rest of their 'network' of firms are meeting the required standards if they claim to be.
"People are finding that key customers are asking for evidence of business continuity. BS25999 will be how businesses judge each other, it could be the difference between getting a contract and not." - Mr. Leighton
BS25999 is expected to come into force in early 2007.
A survey in April by consultancy firm Arup found that 52% of UK firms have not taken measures to prepare for disruption of their businesses that a terrorist attack would cause. In addition, research conducted this year by the Continuity Forum, a not-for-profit organisation that helps firms develop continuity strategies, uncovered similar findings to the to the Arup research about the lack of Business Continuity Management in place.
It also revealed that organisations are failing to rehearse Business Continuity plans as often as they should.
37% of those with plans test them at least once a year, compared to 52% in 2005.
Furthermore, where rehearsals take place, 79% have short comings.
September 2007