Introduction

Generic characteristics of business continuity management in public sector entities

Better practice entities understand the key characteristics of business continuity management and building entity resilience. They implement a program that is relevant, appropriate and cost effective, in light of the entity’s circumstances and operating context. For example, entities that are small, non-complex and perform less time-critical functions have different business continuity requirements and will apply business continuity management differently to entities that are large, complex, and perform time-critical functions.

The ANAO’s analysis of public sector business continuity implementation has identified some generic characteristics associated with better practice business continuity management programs.¹⁴ These are depicted in Table 1. This is not a prescriptive ‘black and white checklist’ for a business continuity management program – as noted throughout this better practice guide, the development and implementation of a business continuity program needs to be relevant to the entity’s operating context.

Table 1 - Characteristics of better practice business continuity management in public sector entities

_{Notes: Basic level characteristics are generally found in small, non-complex or less time-critical entities. In addition to the basic level characteristics, mature level characteristics are found in mature, large, complex, geographically dispersed or critical entities. Throughout this better practice guide, there is a series of checkpoints, where entities can check their progress against the characteristics.}

¹⁴ _{There are several models in the marketplace (for example the Capability Maturity Model Integration and the Control Objectives for Information and Related Technology) which also provide assessment criteria for business continuity implementation, and the impact on business objectives of IT weaknesses.}