BS 11200 and BS 65000 Organizational Resilience Standards

BS 11200 Crisis Management and BS 65000
Organizational Resilience and what is coming

next?
Presented by: Deborah Higgins MBCI
March 17th 2015
1
Relevance to BCM
• Crisis Management is an essential part of any

BCM programme
• Organizational resilience is the goal of any BCM

programme
• New Standards in ISO 22301 family
The 4th Middle East Business & IT Resilience Summit, 2

16-17th March 2015, Dubai, UAE
Status
• BS 25999 withdrawn and incorporated into:
– ISO 22301 BCM Requirement
– ISO 22313 – BCM Guidance
• ISO 22300 - Vocabulary
• ISO 22316 – Organizational Resilience
• ISO 22317 – Business Impact Analysis
• ISO 22318 – Supply Chain Continuity
• Exercising and Testing
• Auditor Competency for ISO 22301
• Human Aspects of BCM
• Recovery Management
The 4th Middle East Business & IT Resilience Summit,
Relevance to BCM
• Any ‘incident’ or ‘disruptive event’ has the

potential to become a ‘crisis’ and could cause a
business to fail.
• The capability of any business to be resilient is

expected by customers, by employees and by all
interested parties regardless of it’s nature,
complexity and size.

BS 11200 – Crisis Management
5
PAS 200
• Plenty of academic textbooks
• A great deal of ‘conventional wisdom’ e.g.
By the time you hear the thunder, it’s too late to build the ark.
It takes a lifetime to build a reputation and only seconds to destroy one.
If it’s going to come out eventually, better have it come out immediately.
You never let a serious crisis go to waste. And what I mean by that it's an
opportunity to do things you think you could not do before.
Lots of folks confuse bad management with destiny.
• All good stuff, but…
• No previous systematic attempt to extract and validate good practice
and present it in a concise and useful form.
• The UK Cabinet Office sponsored PAS200 because they have a deep
interest in the UK’s resilience and success
Events
Ethical collapse Cascading impacts Contractor failure Betrayal of confidence
Predictable surprise Shock and Response Overwhelming scale

Shareholder loss
Oxford Metrica (2012). The impact of reputation crises on shareholder value

BS 11200
• Feedback was good internationally on PAS 200
• Feedback identified areas for improvement
• BS 11200 is a Guidance and Good Practice Standard
• Parallel / overlapping work in the field of Resilience, notably BS
65000: Organizational Resilience
• Ongoing work to establish a European Standard

BS 11200
PAS 200
• No shift in the fundamentals

• Clear definition of crisis • Now defines crisis mgmt!
• Clear positioning of crisis • More concise (40 29 pages)
mgmt relative to incnt mgmt • Sharper focus on practicalities
• Attempted to balance • Enhanced coverage of:
concepts with practicalities – The Crisis Management Team
– Crisis decision making
– Crisis leadership
– Crisis communications
• Still aimed at the strategic level
BS 11200 Contents
• Terms and definitions
• Crisis management: core concepts, principles and developing a
capability
• Building a crisis management capability
• Crisis leadership
• Strategic crisis decision-making
• Crisis communications
• Training, exercising and learning from crises
• Bibliography
• List of figures
• List of tables
BS 11200 Overview
• CM is more than crisis response
• CM demands strategic attention, but involves many
• CM requires an organizational capability
• CM requires clear arrangements, regular training and robust
validation
• Structure and process matters, but people achieve effects and
outcomes
• The outcome is protected value and (enhanced?) reputation

BS 65000 Guidance on
organizational resilience
13
Events
14
Tough, or easy questions to answer?
• As leaders, do we have a clear vision of where we as an organization should go,

and what we should avoid?
• Does resilience form a part of our Board agenda for regular consideration?
• Have we established which strategic and operational responsibilities support
us to become more resilient?
• Are we confident that our approach to resilience will stand up to external
scrutiny?
• Are we satisfied that our approach to resilience is truly coherent?
• Are those responsible for delivering greater organizational resilience
empowered to work across boundaries and able to speak to top management
easily?
asset management fraud control health and safety
horizon scanning supply chain human resource planning
quality management Really? business continuity

But we do all
change management
these already… ICT continuity
information security environmental management

financial control
facilities management emergency management physical security
stakeholder and collaboration management crisis management

risk management reputation management
Contents
Using agreed terminology, BS 65000:
• Clarifies the meaning of resilience

• Highlights the key components of resilience
• Helps an organization to measure its resilience and
make improvements
• Identifies good practice found in other disciplines and
defined in existing standards

About Resilience?
Persistence through disruption, damage or change

FROM Rooted in an physical sciences view of the world
Business continuity “Bouncebackability”

About Resilience?
Persistence through disruption, damage or change

FROM Rooted in an physical sciences view of the world
Business continuity “Bouncebackability”
Successful entities deal with and adapt to change
TO Resilience as continuity and adaptability
“Bounceforward”

ORGANIZATIONAL RESILIENCE: ability of an
organization to anticipate, prepare for,
and respond and adapt to incremental
change and sudden disruptions in order
to survive and prosper

Resilience
• More holistic than just continuity

• Includes also adaptability – being prepared and changing over
time
• A strategic goal that spans related disciplines such as
Emergency Planning, Risk Management and Cyber/Physical
Security
• Requires strong governance and Accountability
• Positioned for the Board level

Contents
• Terms and definitions

• Principles
• Benefits and challenges
• Fundamental attributes of highly resilient organizations
• Actions to build resilience
• Questions to assess the resilience of an organization

Recap

Thank you
24

BS 11200 and BS 65000 Organizational Resilience Standards

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BS 11200 and BS 65000 Organizational Resilience Standards

Uploaded by

Copyright:

Available Formats

BS 11200 Crisis Management and BS 65000

Organizational Resilience and what is coming

• Crisis Management is an essential part of any

• Organizational resilience is the goal of any BCM

• New Standards in ISO 22301 family

The 4th Middle East Business & IT Resilience Summit, 2

• Any ‘incident’ or ‘disruptive event’ has the

• The capability of any business to be resilient is

The 4th Middle East Business & IT Resilience Summit, 4

Ethical collapse Cascading impacts Contractor failure Betrayal of confidence

Predictable surprise Shock and Response Overwhelming scale

The 4th Middle East Business & IT Resilience Summit, 7

Oxford Metrica (2012). The impact of reputation crises on shareholder value

The 4th Middle East Business & IT Resilience Summit, 9

• No shift in the fundamentals

The 4th Middle East Business & IT Resilience Summit, 12

• As leaders, do we have a clear vision of where we as an organization should go,

quality management Really? business continuity

information security environmental management

facilities management emergency management physical security

stakeholder and collaboration management crisis management

Using agreed terminology, BS 65000:

• Clarifies the meaning of resilience

The 4th Middle East Business & IT Resilience Summit,

Persistence through disruption, damage or change

Business continuity “Bouncebackability”

The 4th Middle East Business & IT Resilience Summit,

Persistence through disruption, damage or change

Business continuity “Bouncebackability”

Successful entities deal with and adapt to change

TO Resilience as continuity and adaptability

The 4th Middle East Business & IT Resilience Summit,

The 4th Middle East Business & IT Resilience Summit,

• More holistic than just continuity

The 4th Middle East Business & IT Resilience Summit,

• Terms and definitions

The 4th Middle East Business & IT Resilience Summit,

The 4th Middle East Business & IT Resilience Summit, 23

You might also like