Stabilizing businesses

With more focus falling on BCM strategies, LRQA’s Denis Ives explains why these systems are so important to financial services.

FST. Why is an effective approach to BCM essential for financial services industry? Do you think enough is being done in this area?
DI. Financial systems are of central importance to the health of the UK economy. A disruption of a part or all of the UK financial systems would have a major impact on many other companies and organisations. The importance of promoting and ensuring BCM within the financial services industry is recognised by the Bank of England, Treasury and the FSA with a tripartite initiative having been established to monitor and promote improvement of BCM within the financial services sector.

The recent tripartite Resilience Benchmarking Project report in June 2008 show ed continued improvement in the financial sector resilience , although areas for improvement are identified around human resources and ensuring that major operational disruption (terrorism, pandemic flu) continue to be assessed as significant risks. The wider introduction of independent BCM auditing and certification will help to increase organisational awareness of BCM and validate an organisation’s BCM arrangements.

FST. What are the main challenges currently facing the successful implementation of BCM measures and are there significant differences for large and smaller organisations?
DI. In common with the implementation of many other management systems, the biggest challenge often faced in the successful implementation of a BCM system is ensuring top management sponsorship, commitment and responsibilit y. Without this support, the implementation of a BCM system will always be an uphill battle , especially when attempting to justify the time, resources and financial budget necessary. Many organisations recognise the need for business continuity plans. Fewer recognise the need for other elements necessary to implement an effective BCM system such as exercising, reviewing and improving the BCM arrangements on a regular basis.

Based on the resilience report, we know many larger organisations do recognise the importance of building resilience into their operations and often use their geographical diversity to achieve this by building in the ability to switch operations between locations. There is limited information on the resilience capabilities of smaller organisations within the sector. However, an increased focus on business resilience from the FSA and supply chain is likely to force all organisations to demonstrate they have robust BCM arrangements in the future.

FST. Do you think there is a general lack of understanding as to what BCM actually is? How would you define it and what needs to be done to help industry understand exactly what it entails?
DI. BCM understanding is increasing within all industry sectors as many organisations begin to realise how dependant they are on ever more complex and extended supply chains. This has led to the creation of the BS25999 series of British Standards to help organisations both implement BCM and also to provide a specification against which an organisation can be assessed and certified. Organisations are now beginning to move from understanding BCM as just the generation of disaster recovery plans , to a formalised system comprising of a structured review of the business, identification of critical process, risk assessment and definition of mitigation approaches, exercising and improvement activities which form the basis of a modern BCM.

The introduction of BS25999 part one, provides organisations with guidance about how to implement an effective BCM. Organisations wanting to demonstrate they have a robust system can also choose to be independently assessed against the requirements of BS25999 part two. The certification process and subsequent regular visits by an accredited provider, such as LRQA provide valuable confidence that the ongoing management of the system continues to be effective.

FST. Aside from quick recovery from adverse events, does a good BCM approach have the power to offer value and competitive advantage to an organization?
DI. With organisations becoming more aware of their dependence on outsourced processes and their supply chains for their own success there is going to be an increased focus on ensuring these activities are resilient in the event of disruption. It is therefore likely that, over the next few years, organisations that can demonstrate they have effective BCM systems as part of their service offering will gain competitive advantage when tendering for contracts. In the long term it is likely that BCM certification will become a prerequisite requirement on many contractual specifications and organisations that cannot demonstrate this will be excluded from tendering.

Denis Ives, LRQA Business Centre Manager, is responsible for LRQA operations throughout the UK and Ireland. Having worked for the Lloyd’s Register Group since 1993, Ives has been key in driving forward LRQA’s business continuity training, assessment and certification solutions. A registered Lead Auditor, Ives holds Associate Membership of the CQI and IEMA and is a Member of the IET.