International BCM standard boost for risk management

In a step change from previous BCM standards it emphasises the role risk management must play in business continuity management, bringing the two functions together around the theme of corporate resilience, continued Mr Waterer. The standard also stresses the importance of top management buy-in to help achieve a successful business continuity programme and thus gives risk managers a further tool with which to prove their value to leadership teams and gain air time at the top table, he added. The ISO 22301: Societal Security—Business Continuity Management Systems—Requirements seeks to provide organisations with guidelines for adequate and fit-for-purpose implementation of business continuity management systems.hideThe introduction of the standard aims to provide organisations—and their partners and stakeholders—a common language as well as processes and objectives to meet the business resiliency challenges of the twenty-first century. An evolution of the British standard for BCM, BS 25999, which was previously used by many organisations around the world as a best practice benchmark, ISO 22301 will have international legitimacy and a more global appeal. It formally specifies a set of requirements for implementing, operating and improving a BCM system that can lead to certification. Its requirements are generic and intended to be applicable to all organisations, regardless of type, size and nature of operations. The ISO 22301 emphasises the importance of: understanding an organisation’s needs and the necessity for establishing business continuity management policy and objectives; implementing and operating controls and measures for managing an organisation’s overall capability to manage disruptive incidents; monitoring and reviewing the performance and effectiveness of BCM systems; and continual improvement based on objective measurement. Business continuity management has become a key issue for risk managers and their companies alike in recent times as events around the world have brought into sharp focus the consequences of business disruption. Particular concern now exists over disruptions caused by weaknesses in supply chains, with the Japanese earthquake and tsunami and Thai floods in 2011 highlighting the huge financial impact of improper business continuity plans. The new standard will not specifically help organisations perform the tricky job of locating second and third tier suppliers. But it will enable them to ensure that better business continuity plans are in place once critical links in supply chains have been indentified. “If you are comfortable with what your supply chain risk looks like and where your critical points of failure might be, the ISO 22301 will enable you to approach those businesses and look for evidence of good business continuity management, which is supported by adherence to, or even certification to, this new standard. It will provide assurance and will be the kite mark for good management. Having an international standard really helps in that respect. It will provide a benchmark with which to evaluate other businesses that you might work with or that might be critical in your supply chain or customer chain,” said Mr Waterer. “And the standard is about much more than pure business continuity. It considers the risk mitigation and risk management elements of what is a much larger and more complex set of issues for companies,” he added. Using the standard to manage business interruption within organisations and at key suppliers and customers may give risk managers greater confidence to seek alternatives to insurance, continued the broker. “Insurance will always be required but it might place your dependency on it a little less,” he said. Insurance cover for business interruption risk is of course a big issue for risk managers with supply c hain insurance, and contingent business interruption cover a particular concern. The insurers are under fire for currently offering cover that is too expensive and lacking sufficient limits. Insurers are demanding more and more data on supply chain exposures in order to transfer risk. But if buyers can show that they have good controls in place to mitigate those exposures, by adhering to ISO 22301, it can only help to secure cover at better prices and in the correct amounts, pointed out Mr Waterer. As well as providing international legitimacy to best practice BCM, the ISO 22301 differs from its predecessor, the BS 2599, by placing more emphasis on the role organisational leadership and risk management must play to achieve top standards. “It provides global consistency, credibility and assurance around a common framework. So I think it is bound to be good for the global business community. The standard also seems to focus a lot more on the tone from the top at board level towards business continuity management and the importance of leadership in any programme being a success,” said the Marsh expert. “Previous standards have been very focussed on the business continuity side of things, but I think this new ISO standard provides much stronger linkage to risk management, around the theme of corporate resiliency. ” he added. “That is important because it will help organisations to understand how the two very different management programmes can work together to manage business continuity risk,” said Mr Waterer. Bringing risk management into the fold should help bridge the gap between business continuity managers and the board, allowing for a more strategic overview, he continued. “Risk management often plays out at a higher level within organisations than business continuity management in the traditional sense so this step will only help. Business continuity management can often be seen as something that just protects an asset or an operation rather than thinking more broadly,” added the broker. Mr Waterer also pointed out that there is ‘good cross over’ between the ISO 22301 and the ISO 31000 risk management standard that will allow risk managers and their organisations to obtain a more ‘complete picture’ of business interruptions threats and mitigation techniques. “This synergy will help provide a management solution to identifying, assessing, managing and monitoring business interruption risks and consequences. It is certainly a step forward.” The new standard also will provide risk managers with a powerful tool for proving their value and gaining influence. “If risk managers can make their organisation a bit more marketable by providing assurance to key customers that their business is well run, they have thought about key exposures and have contingency plans in place to respond to those, then it can only be a powerful demonstration of your businesses overall governance. So I do think it is a useful tool for risk managers and business continuity managers to benchmark their level of effort and investment,” said Mr Waterer. The new ISO standard is designed for organisations of all size and activity. Like many international standards it is both flexible and pragmatic in approach. Organisations need to interpret its guidance to ensure it fits with their operations. “Certification (to the standard) is something that many businesses will strive for, it will be another quality stamp. But our advice to clients is to interpret the standard in a way that is meaningful for you rather than necessarily seeking certification if it is not right for your organisation. So take the bits that apply to you,” said Mr Waterer. He also argued that business continuity will become a business differentiator. Simply driving cost efficiency in your supply chain will not be enough going forward, he said. Providing assurance around continuity of supply and access to resources will become key. “Being able to refer to a standard of this sort will be extremely powerful for businesses, risk managers and business continuity managers alike,” he concluded.

International BCM standard boost for risk management

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

Related Articles