Top 10 Tips Towards Bs25999 Certification by Dominic Cockram

Early in 2009, Steelhenge was certified to BS 25999-2:2007, the British Standard in Business Continuity Management. The process involved a great deal of work at all levels of the organisation, with the final achievement not only endorsing Steelhenge’s own business continuity management system, but also giving the consultancy invaluable experience that we are keen to share with other companies working towards certification.

A word of advice before applying for BS25999-2 certification

Before applying for certification you will need to have enough ‘historical’ evidence to be able to demonstrate that an effective business continuity system is in place. This means being able to provide sufficient audit trails showing the evolution and development of the system over time. Taking the time to gather this evidence before the process begins will get your organisation off to a flying start.

1. Establish programme management from the outset

As with any other programme or project, development of your Business Continuity Management System (BCMS) needs to be established and managed correctly from the outset. It is advisable to appoint a project team to drive the programme forward ensuring senior management level buy-in, without which BS25999-2 certification will not be achieved.

2. Scale your business continuity management system according to your needs

Although BS25999-2 is a rigorous process designed to enable organisations to demonstrate the veracity of their business continuity arrangements, it is scalable so it can be applied to organisations of all sizes. Therefore, when embarking on certification, it is important that you develop a system that is appropriate and achievable for your organisation. To do this, it is important that you clearly define and document the scope of your BCMS and there is evidence of senior management approval.

3. Documented evidence is critically important

Make sure you provide documented evidence where requested by the Standard. Although you may be able to demonstrate confidently knowledge of your business continuity management system, it must be supported by documented proof with senior management approval. Furthermore ensure documentation contains the necessary document control measures to manage updates and changes and their distribution.

4. Ensure you can demonstrate staff competence

If staff are allocated roles and responsibilities as part of the Business Continuity Management (BCM) programme, it is important that you can demonstrate that they have the necessary competence to fulfil these roles. This can be achieved by conducting a self-assessment and training needs analysis for these staff. Experience does not have to relate specifically to training received whilst in the organisation, previous experience can also contribute towards demonstrating competence.

5. Internal audits must be conducted by an impartial member of staff

Make sure you differentiate between self-assessments and internal audits. It is likely that the BCMS Project Manager or equivalent will conduct a self-assessment on the system with which they are familiar. By contrast, the internal audit needs to be conducted by a staff member detached from the BCMS who will therefore be impartial. Again the competency of staff members undertaking these audits has to be demonstrated and, for some organisations, it may be easier to outsource the internal audit part of the process.

6. Pay attention to your business continuity exercising

It is important that you implement a regular business continuity exercising programme comprising a range of exercises or tests in order to meet the requirements of the Standard. Exercises should vary in complexity from simple staff call-outs and evacuations to the complete relocation of the organisation to a recovery site, ensuring the ability to meet recovery time objectives is examined.

7. Embed business continuity within your organisation

The second part of the certification process will involve interviewing a sample of staff from across the organisation on their knowledge of your BCMS. In order to effectively embed business continuity within the organisation you need to hold regular training sessions, keeping the content relevant to the audience and the level of BCM understanding they require for their role. If you hold regular departmental or company meetings, include business continuity as a regular agenda item. This is an excellent way to keep people up to date on BCM developments within the organisation and a low impact mechanism to refresh their awareness on a regular basis.

8. Demonstrating an effective management system is an essential requirement

The management system requirement is the greatest challenge for many organisations embarking on BS25999-2 certification. It describes the operational processes to ensure business continuity management in your organisation is developed, maintained and continually improved in a structured and auditable way. Demonstration of an effective working system is essential to achieving certification. No short cuts here.

9. Give careful thought to your system resilience

Make sure that there is a level of redundancy within your system; undoubtedly those staff allocated roles will be unavailable when you need them most and therefore it is important to nominate deputies to ensure critical roles are fulfilled. This can be more difficult in smaller organisations where staff may have to fulfil a number of roles in order to meet the requirements of the standard but cross-training and knowledge sharing can help with this.

10. Develop tools and templates

Where possible, tools and templates should be developed not only to provide business continuity throughout the system, but also to help with its ongoing management. Specifically, generic meeting agendas and post exercise and incident report templates can be extremely useful. A benchmarking tool indicating the level of progress against the requirements of BS25999-2 can also provide a useful way of monitoring milestones and ongoing priorities.

Gaining BS25999-2 certification requires commitment from all levels of your organisation, time and resources. However, your organisation will benefit from the outcome in many ways, not the least of which is a thoroughly examined, robust business continuity management system that will evolve with your business.

About The Author

Dominic Cockram is the founder and Managing Director of Steelhenge Consulting Ltd , specialists in business continuity and crisis management. He started the company in 2004 after 16 years consulting in crisis and risk management for a variety of clients in the public and private sectors. His specialism is the design and implementation of crisis and continuity exercises at the strategic, tactical and operational levels. As a recognised industry expert he has delivered crisis and continuity management exercises of all scales ranging from unique national level government exercises through to bespoke strategic executive events.

Dominic is a Member of the BCI (MBCI), EPS, IRM and a Fellow of the RSA and CMI.

The author invites you to visit:
http://www.steelhenge.co.uk