What is the Business Continuity Management Lifecycle?

What is Business Continuity?

1. Policy and Programme Management

The first step when designing your Programme is to develop your Business Continuity Policy. This sets the direction for the Programme and must include the scope, objectives, and roles and responsibilities in relation to the Programme. It is fundamental at this stage that leadership demonstrate their ongoing commitment to the Programme. This can be done by approving the Business Continuity Policy, providing resources, or supporting continual improvement initiatives.   

2. Embedding

Here,  the focus is on integrating business continuity into BAU activities within the organisation. Changing the culture and mindset of stakeholders is crucial and can be achieved through effective ongoing communications, training, and awareness activities. To ensure the right message is gotten across, it is important that the audience is taken into account when delivering any communications. It is also important to ensure that those who have responsibilities in relation to crisis and incident management have the necessary level of competence and skill to perform their duties correctly.

3. Analysis

The analysis phase is all about determining an organisation’s business continuity requirements. 

The main technique used for the analysis of an organisation for business continuity purposes is the Business Impact Analysis (BIA).  The BIA identifies the urgency of each in-scope activity undertaken by the organisation by assessing the impact over time caused by any potential or actual disruption to this activity on the delivery of products and services. 

There are a number of important outputs from the BIA process, including: 

• Maximum Tolerable Period of Disruption (MTPD)
• Recovery Time Objective (RTO)
• Recovery Point Objective (RPO)
• Minimum Business Continuity Objectives (MBCO)

Different types of BIAs exist (Initial, Product and Service, Process, and Activity) to allow organisations to collect differing levels of information.

Organisations may decide to combine different types of BIAs to meet their own business continuity objectives.

A risk and threat assessment should be conducted at this stage so that risk treatments can be identified in the Design phase of the lifecycle. Horizon scanning is used to forecast potential threats that may lead to a possible disruption in the future and identify where mitigations may be required. 

4. Design

Taking into account all of the data gathered in the first three phases, the Design phase is used to develop the Business Continuity Solutions that will be used to help the organisation achieve the predefined RTOs. These solutions may involve diversifying and/or replicating existing processes or resources, as an example. The shorter the RTO, the more reliable the solution must be. However, with greater reliability comes greater financial costs typically. Regardless of what solution is chosen, it is important that it is approved by top management. 

5. Implementation

During implementation, organisations implement the solutions agreed during the Design phase through the development of Business Continuity Plans. These plans must help the organisation achieve their agreed business continuity requirements (MTPD, RTO etc) within the agreed timeframes or else their ability to recover from a disruption will be greatly reduced.

The Business Continuity Plan should:

• Be a clear checklist of tasks that must be completed in the event of a crisis or incident occurring to achieve the RTO
• Use clear and concise language
• Only contain information that will support the response to and recovery from a disruption
• Be drafted by those involved in the crises/incident management process
• Not be scenario specific where possible

The implementation phase also includes the development of an Incident Response Structure that defines the necessary roles, authority, and skills required to manage an incident. An organisation’s response structure should be flexible and capable of dealing with many types of disruption. 

6. Validation

Validation is used to confirm that the Programme meets the objectives set in the Policy and that the plans and procedures in place are effective. Here, exercise programmes are established to help organisations assess, practice, and improve their business continuity capabilities.