{"id":5089,"date":"2020-04-24T09:45:46","date_gmt":"2020-04-24T07:45:46","guid":{"rendered":"https:\/\/phronesys.eu\/?p=5089"},"modified":"2024-04-05T12:51:12","modified_gmt":"2024-04-05T10:51:12","slug":"business-continuity-management-according-to-iso-22301-as-a-weapon-against-contingencies","status":"publish","type":"post","link":"https:\/\/wp.phronesys.prod.aws.phronesys.eu\/en\/business-continuity-management-according-to-iso-22301-as-a-weapon-against-contingencies\/","title":{"rendered":"Business Continuity Management (according to ISO 22301), as a weapon against unforeseen circumstances"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The coronavirus has gripped Belgium and just about the entire world. This unexpected and initially unprecedented disruptor has drastically shaken the daily lives of people and companies. These uncertain and turbulent times of crisis bring with them a host of concerns and challenges. We realize now more than ever that we need to be better provisioned and armed against unforeseen circumstances to ensure continuity in our business operations. Indeed, such unexpected situations and disruptions in the market can have serious consequences for an organization's results and reputation. Like Covid-19, there are many other threats that can disrupt our business, such as failure of IT infrastructure due to cyber attack, prolonged power outages, terrorism, prolonged strikes, floods, and so on.<\/p>

Business Continuity Management involves a proactive approach that enables an organization to prepare for and respond to potential incidents and interruptions to its business activities. The goal is to minimize the impact of business disruption and provide continuity to meet the demands of customers and other stakeholders at an acceptable level at all times.<\/p>

For the structured establishment and organization of Business Continuity Management, an International standard has been established by ISO, viz. ISO 22301:2019<\/b>. This standard includes concrete requirements and is therefore certifiable. Several thousand certificates of this are already in circulation worldwide. After this, an additional guideline was written (ISO 22313:2020) with some clarifications. ISO 22301 is based on the High Level Structure, and thus has the same format and look and feel as we know from ISO 9001 and ISO 14001. In other words, a Plan-Do-Check-Act approach and identical format (context, leadership, planning, support, implementation, evaluation and improvement). The specific and essential elements are included in the implementation chapter (chapter 8 of the standard).<\/span><\/p>

These can be summarized in a 5-step plan:<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Step 1 <\/font> - Business impact analysis<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tAn analysis should be made of the potential qualitative and quantitative impact that an organization may incur as a result of a particular event or incident. This includes impact on financial results and other business objectives, impact on its reputation, impact on operations and lead times as well as compliance with legal and contractual requirements. Based on this analysis, it is possible to estimate which products, services, processes and functions are critical and prioritized, as well as the most important dependencies (e.g., complete dependence on one supplier for a critical commodity). This analysis phase also determines what the timeframes are or should be. Examples include determining the maximum tolerated period of disruption (after this period the impact becomes unacceptable) and the necessary recovery period to be back up and running.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Step 2 <\/font> - Risk assessment<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The purpose of the risk assessment is to enable the organization to identify, analyze and evaluate its risks related to the potential disruption of its priority activities (as determined in the impact analysis).<\/p>

Risk assessment is a structured process that attempts to answer some basic questions, such as:<\/p>