A business continuity management system (BCMS) is a management system combining interconnected techniques, procedures, and regulations to guarantee that essential business operations continue to function in any damage or emergencies and grow and develop over time. Kemal Alfadin, the Managing Director at Center for Enterprise Risk, elaborated the phases and methods of BCMS that businesses could apply to adapt and survive during an unprecedented case such as the Covid-19 pandemic.

There are three crucial issues to be addressed.

1) Can we guarantee that conditions are always ideal for carrying out the company’s business activities?

2) There are many unavoidable things, but how to reduce the impact and remain agile in the case of a disaster that forces business practices to stop?

3) How to prepare aids to build the enterprise resilience from disaster threats?

Kemal then listed the four main phases of the development and operation of BCM. “Those are understanding the organization, development policy and strategy, training and exercise, and evaluation. Within those phases, there are a few steps and different methods of implementation,” said Kemal.

First, to understand the organization, initial assessments/roadmaps, business impact analysis, and threat/risks assessments must be conducted. The purpose of the current state assessment and roadmap stages is to examine the extent of the current BCM practices (Business Continuity Plan/BCP, Emergency Response Plan/ERP, Disaster Recovery Plan/DRP) and the improvements to be made.

The next step is business impact analysis (BIA), which identifies the criticality of business activities and the related resource requirements to guarantee operational resilience and continuity during and after a business disruption. Lastly, the threat/risks assessment process will identify risk areas, analyze those risks, and recommend measures to decrease the risks to an acceptable level. These important steps are carried through various methods, such as interviews, workshops, on-desk reviews, observation, data cleansing, and validations.

The next phase is development policy and strategy. In this phase, the deduction of business continuation strategy and business continuity management policies and guidelines are formulated. In the first step, the necessary organizational resources and the selection of strategies needed to continue critical business/operations are identified through the people, premises, information and technology, supplies, and interested parties.

Next, stakeholders are involved in the most vital business processes along with their responsibilities, and authority is assembled to determine alternative assisting strategies. The general stages of how business continuity is carried out to run the recovery process effectively include the response stage to the incidents, recovery stages, and restoration, or returning to normal conditions. One of the most important schemes in recovery is how companies can activate to back up resources/back up of critical business processes.

Then, training and exercises are done as soon as the development stage has been fulfilled. This stage supports the understanding of the company’s management and employees about the BCM implementation through training concepts and tests. Lastly, the BCM implementation results and the final report are arranged and presented to the Board of Directors.

Written by Student Reporter (Mitsal Athaya, Management 2022)