Overview
The perceived importance within government of business continuity planning and management is rapidly increasing and the Cabinet Office is seeking assurance that Government Departmental arrangements for Business Continuity are compliant with BS25999, the relevant Code of Practice for Business Continuity Management (BCM).
Although the Department for International Development (DfID) had an established Business Continuity regime in place, they engaged Evolve Business Consultancy Ltd. (Evolve) to provide an independent review of their BCM systems, documentation and command and control arrangements in order to benchmark them with the Code of Practice, to draw appropriate conclusions and make recommendations. Although the review was short, lasting some five days in total, important isues were identified and advice given on how these may be addressed.
Scope
DfID has approximately 1000 people based in central London with another 700 people based in Scotland. Additionally, there are approximately 65 offices overseas, some 40 of which are co-located with the Foreign and Commonwealth Office (FCO). In the case of the shared offices, it is the FCO that has responsibility for the business continuity arrangements. However some overseas offices are independent and most are staffed by both British nationals and local personnel and the Department has a duty of care to these British nationals, their families and, to a certain extent, to the local employees as well.
Although DfID usually deliver their overseas service with FCO and, in a few cases, MoD partners, this analysis was limited to DfID only.
Aims
By identifying the gaps between the existing BCM arrangements and those specified by BS 25999, DfID would be in a position to modify and augment the arrangements in order to:
- Ensure that all BCM activities are constructed and implemented in an agreed and controlled manner;
- Achieve a business continuity capability that meets changing business needs and is appropriate to the size, complexity and nature of the organisation;
- Put in place a clearly defined framework for generating ongoing BCM capability.
Review Methodology
Evolve examined and commented upon three key areas of BCM capability development:
- Systems (what needs to be considered). The six-stage BCM system described within BS25999 identifies a process for undertaking initial analysis, implementing a BCM programme and developing organisational resilience.
- Documentation (what the plans look like). A sample of DfID’s BCM documents was reviewed.
- Command and Control (how the plan might be executed) Comments were made.
Conclusions
Although DfID had business continuity plans in place, it was possible to make a number of recommendations to better align these plans with BS25999. The plans had been developed by different people over a long period of time and the application of BS25999 presented an excellent opportunity to create plan uniformity.
Evolve advised on the way in which existing plans could be brought into line with BS25999 and the additional work needed to completely satisfy the requirements of the standard across the whole of the organisation.
