Business Continuity Management

7. Business Continuity Management: Operational Management

Operational management (stage 4 of the business continuity management process) is the responsibility of the business continuity manager. Activities should include:

  • Reviews
  • Change Management
  • Education and Awareness
  • Training
  • Testing
  • Assurance

Reviews

As organisations can change rapidly, it is necessary to invest in an ongoing review programme. A regular review of all deliverables in the business continuity management process should be undertaken to ensure that they remain current. This will include:

  • A review of business processes
  • A review of the impacts of systems failure on those processes
  • A review of the risks, threats and vulnerabilities to the organisation
  • Revision of the recovery measures as required

The business continuity management strategy should be reviewed, generally on an annual basis, to take into account any changes in business direction, business strategy or IT strategy and to consider any updates to the impact analysis and risk assessment.

Business recovery plans will need to be reviewed and updated regularly throughout the year to take account of personnel changes. Update the IT recovery plan whenever there is a major change to IT infrastructure, assets or dependencies such as new systems or networks, or a change in service providers.

Change Management

Incorporating business continuity management into the change management process will ensure that contingency facilities are established before new systems and applications are implemented. It will also ensure that any changes in the infrastructure are reflected in the contingency arrangements provided by IT or third parties. A member of the business continuity team should attend change management meetings on recovery or resilience requirements. Plans should also be updated following tests and reviews, and in response to day-to-day changes. Inaccurate plans and inadequate recovery capabilities may cause business continuity management to fail. Change management complements the review process and will highlight any issues that have been overlooked.

Education and Awareness

Education and awareness will ensure that all staff are familiar with the implications of business continuity management, and with their roles and responsibilities in a recovery situation.

As a consequence, the ability of the organisation to respond better to an incident will be greatly enhanced. This will range from better evacuation procedures, knowledge of assembly points, familiarity with the desk that a recovery team member should occupy during a recovery, etc.

Training

It is vital that all personnel involved in the implementation and maintenance of business continuity management are fully trained and can undertake their responsibilities effectively.

IT staff need to be trained in the necessary procedures to ensure that they can recover systems and applications quickly and efficiently.

In addition, other types of training may be considered appropriate. For example: media training for senior managers or trauma counselling training for Human Resources staff.

Testing

Establish a regular programme to ensure that the critical components of the strategy are tested at least annually, or as directed by senior management or audit.

It is important that any changes to the IT infrastructure are included in the strategy, implemented in an appropriate fashion and tested to ensure that they function correctly.

Continual testing of the effectiveness of the recovery teams is also essential so that staff remain aware of their responsibilities. It is also important to ensure that new members of the recovery team are familiar with their individual roles.

Assurance

The final activity in operational management involves obtaining assurance that the quality of the business continuity management deliverables is acceptable to senior business management, and that the operational management processes are working satisfactorily. This should be undertaken as part of the internal and external audit process and can be used to demonstrate the effectiveness of the business continuity management environment.

© Crown Copyright. URN 05/625; 01/05
1 2 3 4 5 6 7 8 9 10 11 12 13 14

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>