Business continuity is all about ensuring that the business is in a fit state to survive any disasters that might occur. Given the number of things that can go wrong in today’s highly connected business environment, it’s not surprising that business continuity is being seen by executive teams and boards as more and more important.
In fact, the expanded responsibilities that King III and the new Companies Act place on directors actually mean that ensuring business continuity is required, and that failing to do so could make directors personally liable.
Two important points need to be made:
- The threats a business face are multi-faceted and of varying degrees of probability.
- Business continuity isn’t an event, it’s a mindset and a process of continuous cultural improvement.
Business continuity management (BCM) is an holistic process that seeks to identify all the threats a business faces, rate them, and then put plans in place to mitigate them. Most important of all, it creates an ongoing process for constantly assessing the threats—Have the probabilities changed? Are there new threats?—and testing the plans for effectiveness.
BCM also works to embed the business continuity mindset into the way the organisation operates. Without this mindset change, there’s always the risk that the business continuity plans may remain theoretical and for these reasons, executives and boards should be sitting up and taking notice of the maturity of their own business continuity programmes. The audit committee will also have a vested interest in identifying and mitigating high impact risks associated with BC.
Putting a BCM programme in place can create a competitive advantage and generate a real return on investment because it means the company is committing itself to assessing the risks it faces regularly, and to taking corrective actions. These actions would include putting contingency plans in place but also changing business processes and practices that previously contributed to risk. In this way, it can fairly be argued that BCM helps to make a company more organisationally resilient over time. For this reason, not is it featuring on executive and board agendas—auditors are also paying close attention to how effective a firm’s BCM actually is.