Introduction

Business continuity management

Business continuity management is the development, implementation and maintenance of policies, frameworks and programs to assist an entity manage a business disruption, as well as build entity resilience.³ It is the capability that assists in preventing, preparing for, responding to, managing and recovering from the impacts of a disruptive event.

Business continuity management treats the negative consequences of an event, and can create opportunities for benefit and gain. Entities that respond positively to a disruptive event can position themselves to recover quickly and improve their long term business performance.

Business continuity management prepares the steps the entity will take to recover and return to normality. It involves designing business processes and information architecture to limit single points of failure, and developing support area and business unit contingency plans and business resumption plans. It also includes defining escalation procedures, and obtaining contact details for key personnel and for other entities where an important interdependency exists. The business continuity management process includes establishing the maximum periods (known as the maximum tolerable period of disruption) for which critical processes can be disrupted or lost altogether, before it threatens the achievement of entity objectives.

Business continuity is initiated when a risk occurs that has a significant business disruption consequence.⁴ These disruptive events may be low frequency, but they have severe consequences for the entity. Business disruption events need to be distinguished from other business interruptions such as those arising from systems downtime or failures that may occur as a part of normal operations, such as a brief loss of a communications link. A business disruption is an event where normal operational management is suspended.

Benefits and costs
Business continuity management acts to mitigate the negative consequences of a disruptive event, and may also deliver business improvements. The benefits to an entity of an effective business continuity management program may include:

• the continued delivery of Australian Government services to clients (citizens and interdependent entities) in the event of a business disruption;
• the ability to proactively identify the consequences of a business disruption;
• having in place an effective response to a business disruption which minimises damage to the entity;
• reduced costs of operating during a business disruption, and more cost effective recovery;
• management of uninsurable risks, and compliance with insurance policies;
• compliance with regulatory requirements (where applicable);
• enhancing its reputation by demonstrating to stakeholders a credible response;
• increased interdisciplinary and inter-agency teamwork;
• improved efficiency and effectiveness of business-as-usual operations;
• the ability to use negative events as opportunities to improve business processes;
• identifying key interdependencies that may not have otherwise been apparent; and
• building resilience that facilitates managing and recovering from a business disruption event.

When determining the entity’s business continuity strategy, it is important to consider the costs as well as the benefits of the potential continuity treatments. A cost benefit analysis compares the benefits and costs incurred.

Typically, the lower the maximum tolerable period of disruption, the more costly and complex the recovery treatment is likely to be (see Figure 3). This is particularly true when the recovery of technology is involved. It is important to establish a realistic representation of the recovery requirements of the entity.

³ _{Resilience comes from tackling the likelihood as well as the consequences of disruptive events. Therefore it is important to have both effective risk management and business continuity management frameworks in place.}

⁴ _{Entities may wish to activate their business continuity plan in anticipation of an event. An entity’s business continuity plan may be activated concurrently with other plans, such as the emergency response plan, or the incident management plan. Entities with multiple levels of response planning need to consider and provide guidance to staff on formally activating the business continuity plan, and when to move from an emergency response to a business continuity response.}