Business continuity management

Development of Continuity Management Framework

Polish and European laws increasingly impose requirements directly related to the resilience of enterprises and place additional obligations on these entities to monitor the continuity of supply chains. This makes it essential to carefully examine the positioning of our organization within the legal and business environment and start by developing the proper organizational context.

Our experience from hundreds of completed BCM projects allows us to adopt a broad perspective and effectively identify stakeholders (including those not immediately obvious), their continuity requirements for your organization, and the legal requirements in this area (also see our Compliance Navigator service).

Based on this, we can precisely define the framework for the Business Continuity Management System and all its required elements, including the Business Continuity Policy.

Conducting a BIA Analysis

Business Impact Analysis (BIA) allows you to estimate the potential effects of a disruption to your company's operations. This estimation typically considers several types of impact, with the most common being financial, legal, and reputational damage.

A proven methodology is required to conduct a BIA effectively and obtain reliable results. Our methodology has been tested in hundreds of BCM projects and has been continuously refined for over twenty years. We also offer an application that significantly facilitates the impact analysis—ImpactApp (link to the ImpactApp description), especially in large organizations.

Conducting risk assessment for business continuity, including supply chain risk assessment

Risk assessment in business continuity management primarily focuses on the risk of unavailability of critical resources, including the unavailability or issues with key suppliers (the "third party risk" element).

The BCM risk analysis can be extended to include other complementary aspects, allowing for a single analysis that covers multiple areas. We can integrate the business continuity risk assessment with cybersecurity risk estimation (check out our ERAMIS methodology), third-party risk assessment, and compliance risk assessment within a defined scope.

Developing Business Continuity Plans (BCP), Incident Management Plans, and Disaster Recovery Plans (DRP)

We have the expertise to develop any type of contingency plan: from single-incident management plans, through post-disaster infrastructure recovery plans (DRP), to comprehensive crisis management plans, business continuity management plans, or critical infrastructure protection plans.

In our 20 years of operation, we have prepared or modified dozens of different contingency plans, and considering the incident management, ICT/OT recovery, or crisis management procedures included, we would count even more. Whether you need to verify existing plans or create one from scratch, you can confidently rely on our extensive experience.

Conducting Tests of Emergency Plans and Procedures

Testing emergency plans requires the application of a standardized approach to bring tangible benefits to the organization. A test is meaningful when we know its scope, objective, scenario, and evaluation criteria. Additionally, each test should involve independent observers, and the participation of an experienced test coordinator is recommended. Another requirement is to document the test in a way that the test process and evaluation of its results are clear to management and auditors who will review them.

There are several types of tests, and the choice of the appropriate one depends on the scope and objective of the test, as well as the maturity level of the business continuity management system in the organization. It is also essential to carefully consider the criteria for involving third parties (suppliers, business partners, customers) in the tests. Our team of experts is here to assist not only in conducting individual tests when necessary but also in preparing an entire emergency plan testing program or establishing a testing schedule.

Preparing Organizations for External Audits

Among our experts are auditors with the highest competencies. In the field of business continuity management, Renata Davidson additionally collaborates continuously with the Polish Accreditation Centre (pca.gov.pl) as a technical expert in the area of ISO 22301 standard.

If you are interested in obtaining reliable information regarding the compliance level of your BCM system, you couldn't have found a better match. Similarly, if you wish to conduct a review of your business continuity plans or other contingency plans regarding their correctness and opportunities for further improvement, leveraging the assistance of an experienced auditor is invaluable support for the organization's management.

Due to our experience from both sides of the table, we can thoroughly audit business continuity management systems and prepare organizations for internal or external audits (e.g., security audits or audits conducted or commissioned by clients or supervisory institutions).

BCM Business Process Outsourcing in any area of business continuity management

We offer full outsourcing of business continuity management functions or selected areas thereof (e.g., BIA analysis, risk assessment, change management, training, testing). Depending on the selected service scope, you gain new members of the continuity management team or even the entire team and direct access to the knowledge and experience of top experts. Billing for BPO services is simple and transparent based on the service specification and fixed monthly fees.

ImpactApp - for conducting impact assessment (including BIA)

Business impact assessment is a crucial element of many processes related to operational risk management in organizations. Generally, impact is assessed in financial and non-financial aspects (e.g., reputation). However, often the available data in organizations does not allow for a more precise estimation of impact than "guessing" the level of impact on a certain scale, e.g., 1-4. The ImpactApp allows for selecting any number of measurable criteria, each with separate assessment scales based on values known in the organization.

For each criterion, thresholds can be independently defined, indicating the exceeding of a certain level of impact in the organization's risk assessment methodology. As a result, we obtain a reliable impact assessment allowing for more effective risk measurement.

The ImpactApp enables the definition of multiple analyses, each with dedicated criteria. The methodology embedded in the ImpactApp has been successfully used in various sectors of the economy, including financial, energy, logistics, and public administration.

BUSINESS

CONTINUITY

MANAGEMENT

Business continuity management

CONTACT