Do you remember the movie The Year of Living Dangerously with Mel Gibson? Topically unrelated maybe, but The Chartered Management Institute has just published The Decade of Living Dangerously, their Business Continuity Management Report, showing the current state of Business Continuity Management in the UK, and the development since 1999, hence the ‘catchy’ title. The report is an interesting read, because not all is well in the UK, despite the Civil Contingencies Act of 2004 that requires frontline responders to maintain internal BCM arrangements, but things are slowly improving.
The survey
The Institute’s first survey on Business Continuity Management was conducted in 1999. It was repeated in 2001 and has been published annually since then, meaning that the 2009 survey is the tenth report in the series. In 2009, a total sample of 15,000 individual Institute members was surveyed and 1,012 responses were received.
The report not only shows how many managers are aware of a specific Business Continuity Plan (BCP) covering critical business activities in their organization, but also tracks which of the risks identified are of particular concern to managers, and how this has changed since 1999; what disruptions that happened in 2008 and what risks that are considered to pose a significant threat to the company. Here, loss of personell ( and loss of key skills are worth noting as high ranking threats that are likely to have a significant impact on costs and revenue.
Download
Download the full report or read the executive summary below.
Executive summary
- More widespread adoption of business continuity management: the number of organisations with specific business continuity plans covering their operations has increased slightly to 52 per cent, compared to 47 per cent in 2008. This is the highest score ever recorded by the survey.
- Organisations remain complacent about continuity: despite the more widespread adoption of BCM, the percentage of managers reporting that continuity is regarded as important in their organisation has fallen over the past year from 76 per cent to 64 per cent.
- Identifying risk: electronic attack and human disease – such as pandemic influenza – are the two greatest concerns facing organisations, identified by 58 and 57 percent respectively.
- Influenza pandemic planning: despite recognising the threat posed by diseases such as influenza, 53 per cent of organisations still have no plans to help them cope during a pandemic.
- Most common disruptions: over the past year, 40 per cent of organisations suffered disruption due to a loss of IT. Other key sources of disruption were extreme weather, loss of people, loss of telecommunications, and utility outages.
- Reliability of plans: over two thirds of organisations rehearse their business continuity plans, suggesting a growing acceptance of the evidence that rehearsals are crucial to ensure the effectiveness of planning. Seventy five per cent of those who had exercised their plans said that the exercises had revealed shortcomings.
- Remote working: around half of respondents (53 per cent) report that they could continue to work to a great extent by working remotely in the event of a disruption.
- Key drivers: corporate governance (47 per cent) remains the most prominent driver for organisations implementing or changing their business continuity management. Central government (33 per cent) is another key driver. There continues to be evidence that business continuity planning is being driven through the supply chain through public sector procurement contracts (23 per cent) and by the demands of existing customers (32 per cent) and potential customers (19 per cent).
- BS 25999: 39 per cent of respondents who have business continuity plans are aware of BS 25999, the British Standard for Business Continuity, which provides a basis for understanding, developing and implementing business continuity within an organisation. Of these, 74 per cent intend to use the standard in some form.
- Guidance: some 28 per cent of respondents overall were aware of the guidance on business continuity management provided by their local authority or Local Resilience Forum. The most commonly requested information relates to developing a business continuity plan, the provision of case studies, and guidance on reviewing and exercising business continuity arrangements.
