IT Governance Blog on IT governance, risk management, compliance and information security.

It is quite usual for shareholders and customers to consider an organisation to be well managed and quite often this is true. There are however, some occasions when that expectation may not ring true; Take business continuity for example:

If a shareholder, customer or any other stakeholder where to ask senior managers within your organisation if you have adequate business resiliance plans in place; or how long it would take you to recover from any given scenario, how confident would your senior managers be in their response?

Would they be able to explain your business continuity plans in such a way that satisfies the stakeholder and more importantly, would the business continuity plan stand up in such an event?

If you are a director of an organisation and you know-of a business plan, you should satisfy yourself that it is adequate. It is no longer acceptable to consider business continuity planning ‘someone else’s problem’.

Business continuity and disaster recovery planning is a key governance responsibility. The UK Companies Act 2006 gives statutory force to what has long been the worldwide common law duty of directors, which is to exercise due care in relation to their companies. Specifically, directors must “exercise reasonable care, skill and diligence” (s.174).

The board of directors is accountable for ensuring that the organisation has developed and tested business continuity and disaster recovery plans that deal with all the likely risks that face the organisation.

What is the best approach?

In the UK, the NHS has determined that BS25999 certification is a key way for NHS entities to demonstrate that they are adequately resilient, and UK local authorities have recognised the BS25999 certification is the best method possible for demonstrating they are meeting their obligations under the Civil Contingencies Act. Internationally, organisations in both the public and private sector are pursuing BS25999 certification in order to demonstrate to stakeholders and customers that they have adequate business resilience arrangements in place.

If you’re new to business continuity management you will find the BS25999 Introductory Kit invaluable.
	The books and guides in this kit can be used as an ideal introduction to the topic of BS25999 and includes many of the books and guides that are needed during an BS25999 implementation.

The BS25999 BCMS Implementation Toolkit is more comprehensive and is the perfect solution for those organisations who want to implement a business continuity management system in line with BS25999. There is a Demo Version available should you wish to try before you buy.