Business continuity: strategic guidance for NHS health boards

Section 2: Purpose, Principles & Process of Business Continuity Management (BCM)

2.1 BCM is a key discipline that supports the building and improving the resilience of organisations. BCM identifies an organisation’s priorities and prepares measures to address disruptive events. BCM is concerned with ensuring organisations can continue operating to an appropriate level in the event of a major disruption. Organisations should minimise the likelihood/impact of such an event, BCM assists with recovery and restart if one occurs.^[11]

2.2 BCM, including processes for recovery and restoration, should be considered by an organisation as part of an overall approach to managing risks and threats. An effective business continuity programme supports the strategic objectives of the organisation and should be part of everyday business processes and be embedded into the culture and wider strategy of the organisation.

2.3 The skills to develop BCM processes can be seen as complementary to those involved in emergency management. The role may in some cases be undertaken by separate officers, as determined by local structures and resources. Effective co-ordination is necessary as a major incident may occur at the same time as a business continuity issue or be triggered by it.

Principles

2.4 The key principles for maintaining BCM are:

• Review critical services and identify resources which need to be available to maintain these for the first hour, 24 hours, 3 days and for 7+ days.
• Assess progress on BCM processes against an agreed checklist.
• Establish contracting processes with providers and suppliers that require BCM processes to be explicitly described and covered by contracts.

Processes

2.5 The key processes for maintaining BCM are:

• If there are any changes to your organisation, including restructurings, changed methods of the delivery of your critical activities;
• if there is a change to the external environment in which the organisation operates;
• following lessons learned from an incident or exercise; and
• changes to staff