Find out more

www.thebci.org

The business
Ethics and
continuity
values
enviroment

The
Leadership organisational
environment

Working Thinking
with others and innovating

Competency
Framework

Analysis Design

Embedding Implementation

Policy and Validation

programme
management

Find out more www.thebci.org

1
 Find out more
www.thebci.org

The BCI competency

framework
The BCI competency framework defines the professional standards needed to be What is competency?
an effective business continuity practitioner at every career stage. It is a tool to help
individuals advance as professionals, to help employers develop resilience capability Competency is the ability to apply
through workforce planning and development, and to give society confidence in the knowledge and skills to achieve intended
resilience profession. results1. It is what individuals and teams
The competency framework has been created in consultation with BCI stakeholders to need to be able to carry out their work
reflect the needs of individual business continuity professionals and their employers. effectively.

It can be used by: The language of competency and

competency frameworks can be confusing.
Business continuity practitioners – to help you advance as professionals through self-
assessment, education and training, personal development, reflection, and continuing Some organisations use the term
professional development activities. ‘competence’ rather than ‘competency’,
and some use both to refer to different kinds
Employers – to assess the organisation’s skills, plan and develop the workforce, identify
of competency. The reasons for this are
training and education needs, and support individuals in their careers.
historical. The BCI term is ‘competency’,
The BCI – to make informed decisions about individuals’ membership levels, develop which is used to cover abilities of all kinds.
professional qualifications, and provide member services that support practitioners at all
career stages. Overall competency is made up of individual
competencies, each describing a particular
attribute a person needs to be effective in
their work.

1.Common ISO definition of ‘competence’. Included in ISO 30400:2016 Human resource management – Vocabulary.
Also one of the core definitions in ISO management systems standards.
2
 Find out more
www.thebci.org

The BCI competencies

The BCI competency framework contains 12 competencies relevant to business continuity
management and a ratings scale with three levels of individual proficiency that can be applied
to the competencies.

The competencies are in two broad groups:

Leadership and management competencies describe the personal behaviours and strengths that
make people effective in the workplace. They include skills such as leadership, problem solving and
understanding organisational culture. Everyone needs to have or develop these competencies.

Professional Practice competencies describe the skills needed for the six Professional Practices
in the business continuity management lifecycle. The need for these competencies depends on your
role, the level you work at, and your career path and aspirations.

The two kinds of competency work together. All are underpinned by Ethics and values.

Leadership and management competencies Professional Practice competencies

Policy and
Thinking programme
and management
Analysis
innovating
Validation
Leadership
The The business
organisational continuity Implementation
environment enviroment Embedding
Working
Design
with
others

ETHICS AND VALUES

3
 Find out more
www.thebci.org

The business

Leadership & management continuity

enviroment

competencies Understanding and shaping the evolving role,

scope and practice of business continuity
management in a changing world
Specific aspects of the competency. External factors
Working with other resilience
professionals
Thinking
and Championing
innovating Shaping the future

Actively using a range of thinking

Leadership types to evaluate infromation, make
decisions and find solutions to problems
Inspiring, supporting and
empowering yourself and others Thinking types
Self awareness Problem-solving
The
Sensitivity to others Innovating organisational
Leadership styles Thinking tools environment
Working
Influencing with Creating and maintaining an
others organisational environment that supports
Negotiating
effective business continuity management and
Motivating Working effectively with other people builds organisational capabilities
to achieve productive outcomes
Courage and personal resilience Internal factors
Managing relationships
Reflective practice Organisational culture
Colllaborating
Opportunities for
Communicating organisation-wide
Facilitating improvement
Managing change

ETHICS AND VALUES

Standards of personal and workplace behaviour and the morals, principles and ideals that underpin ethics and behaviours

4
 Find out more
www.thebci.org
Professional Practice
competencies
Specific aspects of the competency.
Policy
and programme
management
Establishing the organisation’s policy
relating to business continuity and defining
how the policy should be implemented through
the business continuity programme.
Project management
Establishing a business continuity policy
Defining the scope of the
business continuity programme
Establishing governance
Assigning roles and responsibilities
The Business Continuity
Programme
Standards of personal and workplace behaviour and the morals, principles and ideals that underpin ethics and behaviours
5
Analysis
Reviewing and assessing
an organisation to identify its
objectives, how it functions and the
constraints of its operating environment. Design
Identifying, selecting and
Selecting an appropriate approach
agreeing solutions that enable an
Designing the business impact analysis organisation to mitigate risks and achieve
Undertaking the business impact analysis continuity in the event of an incident.
Risk and threat assessment Reviewing existing continuity capability
Methods and tools Business continuity solutions
and mitigation measures
Consolidating and reporting
Evaluating solutions
Embedding and mitigation measures
Integrating business continuity Consolidating
awareness and practice into Presenting solutions and
business as usual activities and into the mitigation methods
organisation’s culture.
Raising awareness and
building commitment
Ensuring required
competencies are in place
Implementation
Validation Putting into practice the solutions
and mitigation measures agreed
Confirming that the business
in the Design stage.
continuity programme meets the
objectives set out in the policy and Establishing and maintaining a
that the plans and procedures in place response structure
are effective and continually improved.
Developing and managing
Exercising business continuity plans
Maintenance
Review
ETHICS AND VALUES
 Find out more
www.thebci.org

Ratings scale
The ratings scale describes the different levels of individual proficiency that can be applied to each
competency and to the elements in each competency. The levels are advanced, comprehensive
and foundational. The ratings scale is written to be used as a self-assessment tool.

COMPETENCY LEVEL DESCRIPTION

I can reformulate or develop original thinking in this subject. I can critically evaluate complex information
and ideas. I can create ways forward in situations where there are many interacting factors.
I understand current developments in this subject and appreciate the way it fits into the wider world.
Advanced AND/OR
I am able to apply my advanced or specialist understanding to solve complex problems in
situations where there are many interacting factors. I can undertake research, development
or strategic activities to change the way this subject is applied in practice.

I have a comprehensive understanding of this subject. I can analyse

and evaluate relevant information that might be complex.
Comprehensive AND/OR
I am able to apply this in my day to day work to solve complex problems.
I can use research and development results to inform my actions.

I have a foundational understanding of this subject and am aware

of different approaches and schools of thought.
Foundational AND/OR
I am able to apply this in my day to day work to carry out well defined
tasks that are sometimes non-routine and complex.

Competency levels are not applied to Ethics and values. Although Ethics and values is an essential
part of being a business continuity management professional, it is not graded or assessed in the
same way as other competencies. Instead, all BCI members sign up to the Code of Conduct for BCI
Members and ethics underpin everything practitioners do.

6
 Find out more
www.thebci.org

Using the BCI competency

framework
The BCI competency framework and membership levels

The competency levels in the ratings scale are aligned with the BCI membership levels. This does
not mean you need to be at the competency level associated with your membership grade for every
single competency: BCI recognises and includes professionals from different backgrounds, in
different roles and with different career paths.

When you apply for BCI membership at the Associate, Member or Fellow level, the BCI will use the
ratings scale to assess your knowledge and skills.

MEMBERSHIP LEVEL COMPETENCY LEVEL

FBCI Advanced
Fellow

MBCI Comprehensive
Member

AMBCI Foundational
Associate

Open to all with an interest in business

Affiliate continuity management. No evidence
of competencies required.

7
 Find out more
www.thebci.org

The BCI competency framework

and qualifications
There is no direct link between competency levels and qualifications. Having no qualifications
is not a barrier to competency or to BCI membership. The award of a qualification does not Business continuity management is a fairly
automatically lead to competency or to membership at any level. new discipline, developed by pioneers
in the days before there were any formal
There are, however, indicative qualification levels associated with the competency and BCI
qualifications. The early practitioners
membership levels. These are being used by the BCI and its training and education partners to
develop BCI qualifications and courses. relied on learning by doing and continuing
professional development (CPD) activities
The BCI also provides and recommends continuing professional development (CPD) such as writing articles, speaking at events,
opportunities: essential for keeping up to date and developing new understanding and skills.
developing and exchanging ideas with
Indicative qualification levels have been built into the BCI competency framework by others, and research.
approximate alignment of competency levels with qualification levels in England and in the
European Qualifications Framework (EQF). There are many highly competent business
continuity practitioners without formal
There are eight qualification levels in the EQF: Level 1 is the most basic and Level 8 (typically
qualifications. It is also possible to have a
a Doctorate) is the highest. The EQF is used widely in Europe and other regions, where
qualifications are mapped onto the EQF levels. formal qualification in business continuity
management without having yet developed
The words in the BCI competency framework ratings scale draw on the qualification level leadership and management competencies
descriptors developed by Ofqual (The Office of Qualifications and Examinations Regulation)2.
or the ability to apply technical
Each Ofqual level descriptor summarises the knowledge and skills associated with people who
hold qualifications at that level. understanding and skills in the workplace.

2. T
 he qualification level descriptors are published in the Ofqual Handbook: General Conditions of Recognition https://www.
gov.uk/guidance/ofqual-handbook (accessed September 2019).
8
 Find out more
www.thebci.org

The BCI competency framework

and career levels
There is no direct relationship between your competency levels, your career level and the nature
of the work you do. Your work role depends as much on the organisation you work for as on your
competency levels. In one organisation you might be a senior director; in another you might be a
middle manager.

The following table is for guidance only and applies to an organisation that is big enough to have
different levels of management.

COMPETENCY LEVEL INDICATIVE CAREER LEVEL LIKELY NATURE OF WORK

Likely to provide specialist advice and to manage,

Strategic and/or coach and/or mentor others.
Advanced
technical specialist Likely to influence the direction of the organization
regarding business continuity management

Likely to work without direct supervision. Likely to supervise and

Comprehensive Managerial
support others in developing their knowledge and skills.

Foundational Operational Likely to work under supervision and might supervise support workers.

9
 Find out more
www.thebci.org

The BCI competency

framework and the BCI
Good Practice Guidelines
The competency framework is a companion to the BCI Good Practice Guidelines
(GPG). The GPG describes what business continuity practitioners should do, with
information about why and how to do it. The competency framework focuses on
Good Practice
the knowledge and skills needed to work as a business continuity practitioner at
different levels. Guidelines
2018 Edition
Both the competency framework and the GPG cover the Professional Practices The global guide to good
practice in business continuity.
in the business continuity management lifecycle. The competency framework
describes the knowledge and skills needed for the Professional Practices, but is
not a ‘how to’ guide.

The competency framework and the GPG both emphasise the need for Risk
Management Communications
leadership and management skills as well Professional Practice skills. The
competency framework contains a more comprehensive description of these Emergency
Facilities
Management
ANALYSI
skills than the GPG. Management S

N
TIO
VALIDA
EMBEDDING

DESIG
Health and Information
Safety Security

T
PL

IM

EN
EM
ENT

PO

EM
IC ATION Physical
G

L
Y AN NA Security
Crisis
Management
D PROGRAMME MA
Human
Resources

Business Continuity Management

(BCM) Lifecycle
Building organizational resilience

10
 Find out more
www.thebci.org

Ethics and
values

Policy and
Leadership programme
Working management
with others Embedding

The
Thinking
and innovating
competencies Analysis

The
organisational
environment The business Design
continuity Implementation
enviroment

Validation

11
 Find out more
www.thebci.org

Ethics are standards of personal and workplace behaviour. Values are the morals, principles
and ideals that underpin ethics and behaviours.

Description
All business continuity professionals should behave ethically. Behaving ethically means doing the right thing.
It includes acting in the interests of society, behaving honestly, meeting legal requirements, and maintaining
confidentiality of sensitive information.

Ethical behaviour is covered by the BCI code of professional conduct and its associated processes. Your ethics
and values do not need to be assessed using the competency framework ratings scale.

Behaving ethically builds trust and confidence in you as an individual, in the business continuity management
community, and in the profession as a whole.

Having an ethical framework also supports you as an individual. In situations where you are asked to behave
against the BCI code of professional conduct or your own professional judgement, you are encouraged to seek

Ethics and values

advice and guidance from peers or colleagues.

Elements
The Public Interest
Acting with regard to public health, safety and the environment. Acting with regard to the legitimate rights of third
parties. Complying with applicable laws and regulations. Acting without discrimination against others. Acting
honestly, for example by not making or accepting any offer of bribery or inducement.

Duty to relevant authority

Acting with due care and diligence in accordance with the relevant authority’s requirements. If your professional
judgement is overruled, you should explain the likely risks and consequences and seek advice. Disclosing any
potential conflict of interest between you and the relevant authority. Respecting the privacy and confidentiality of
information to which you have privileged access.

Duty to the profession and the institute

Upholding the reputation and standing of business continuity and the BCI. Promoting public understanding of
business continuity.

12
 Find out more
www.thebci.org
Inspiring, supporting and empowering yourself and others.

Description
Leadership is a way of thinking and behaving that influences and motivates others. It involves creating a compelling
vision of the future that others can relate to. Leadership brings out the best in people, through empowerment
rather than control and collaboration rather than competition. It is about you and your vision and values, regardless
of your position in an organisation, and can be developed through practice and reflection.
There are many leadership theories, including contingency theories that highlight the need for different leadership
behaviours in different situations. This is important in business continuity management because different
leadership styles are effective at different stages of the business continuity lifecycle and during an incident.
Leadership involves embracing change and uncertainty and fighting for what you believe is right. This requires
courage and personal resilience so that you can rise above your doubts and fears.

Elements
Self awareness
Knowing your strengths, weaknesses, limitations and biases. Understanding your emotions and how they affect
your work. Having self-confidence and a sense of your worth.
Sensitivity to others
Being able to recognise and understand others’ points of view and emotions. Being able to empathise and work

Leadership effectively with different people.

Leadership styles
Deliberately choosing from a range of leadership styles so that you are effective with different people and in
different situations. Awareness of different leadership theories is useful in developing this element of leadership.
Influencing
Behaving in ways that give others opportunities and encouragement to change their thoughts, beliefs or actions.
Influence can come from your characteristics and relationships rather than your position in the organisation.
Negotiating
Reaching agreement with others over a matter of mutual interest, concern or conflict. Includes encouraging others
to reach agreement themselves, especially in a situation where there is conflict.
Motivating
Understanding and satisfying the needs of different people so that their enthusiasm and actions contribute to the
business continuity vision and goals. Motivation can be intrinsic (such as the personal satisfaction gained from
doing a task well) or extrinsic (such as promotion or financial rewards).
Courage and personal resilience
Managing yourself so that you are able to cope with challenges and crises without experiencing the negative
symptoms of stress. Regulating your emotions so that feelings such as fear, anxiety and anger don’t prevent you
from thinking clearly and working effectively. Personal resilience can be developed.
Reflective practice
The ongoing process of reflecting on experiences, analysing and making sense of what happened, and deciding
what you will do differently next time you encounter a similar situation. Reflective practice is a key skill for
developing effective leadership behaviours.
13
 Find out more
www.thebci.org

Working effectively with other people to achieve productive outcomes.

Description
Working with other people – in teams, and across organisational boundaries and hierarchies – is an essential skill
for business continuity professionals. It includes working with internal and external stakeholders, and with people
from different professions, disciplines and organisational functions.

Working with others overlaps significantly with Leadership. Personal leadership characteristics and behaviours
are the foundation for working with other people effectively.

Working effectively with other people includes building and maintaining positive relationships, communicating
effectively, collaborating, facilitating and managing change.

Elements
Managing relationships
Being able to connect with other people, build and maintain positive working relationships and manage conflict.
In business continuity management, this often involves networking with a wide range of people internal and
external to the organisation and maintaining relationships of various strengths. Positive working relationships are
collaborative or co-operative. Competitive and adversarial relationships are rarely productive.

Working with others Collaborating

Working with others to create or achieve a shared vision or goal. Collaboration is characterised by high trust and
commitment to ‘the good of the whole’. Co-operation, which is an effective way of working with others to achieve a
known goal, does not need such high levels of trust or personal commitment.

Communicating
Exchanging information and meaning effectively with individuals and groups. Communicating includes speaking,
listening, questioning, writing, presenting and paying attention to non-verbal cues. Communication can be face-
to-face or virtual and by a range of channels including phone, social and other electronic media. Different channels
have characteristics that support different kinds of communication: a concept known as media richness. It is
important to select a channel of appropriate richness for the message and situation.

Facilitating
Providing support to help groups of people become more effective, make choices and reach outcomes.
Facilitators are impartial: they focus on group processes rather than content. Facilitating includes identifying
desired outcomes, planning group sessions, selecting processes that will help the group reach useful outcomes,
creating an environment that encourages participation and acting as a process guide. Good facilitators adapt their
plans during group sessions to suit the needs of the group.

Managing change
Moving an organisation or group from its current state to a desired future state. There are many approaches to
managing change and a strong argument that the choice of approach depends on the specific situation. Managing
change includes human factors, as many people are uncomfortable with change. Change can be delivered
through projects and programmes. For many organisations, constant change is normal.

14
 Find out more
www.thebci.org

Actively using a range of thinking types to evaluate information, make decisions and find
solutions to problems.

Description
Thinking can be of different types such as analytical, creative, conceptual and critical. Thinking can also be
described using wider categories such as convergent (homing in on the best solution or decision) or divergent
(generating and exploring many possible solutions or decisions).

Using a range of different thinking types leads to new ways of evaluating data and information, generation of
insights and ideas, and development of effective solutions and decisions.

The business continuity lifecycle and processes such as innovation and problem-solving benefit from different
thinking types at different stages.

Most people have a preferred way of thinking, but everyone can learn new thinking styles. Various thinking tools

Thinking and
and techniques can be used to switch between thinking types.

innovating
Elements
Thinking types
Awareness of different types and ways of categorising thinking, and being able to actively choose how to think.
Common categories include convergent, divergent and lateral thinking. Common thinking types include analytical,
critical, conceptual (abstract), concrete and creative. Systems thinking is a way of understanding the ‘big picture’
and the connections between parts in complex situations.

Problem-solving
Selecting and using problem-solving strategies and techniques effectively. Problem-solving strategies consist
of steps or stages, each typically based on a different thinking type. Problem-solving techniques are specific
methods such as brainstorming or root cause analysis that can be used as part of a problem-solving strategy.

Innovating
Creating, selecting, developing and implementing new ideas, products and ways of doing things that meet needs
or produce benefits. Different thinking types are needed at different stages of the innovation process.

Thinking tools
Selecting and using appropriate thinking tools in different situations. As well as problem-solving techniques, there
are thinking tools for most thinking types – including lateral thinking and creative thinking.

15
 Find out more
www.thebci.org

Creating and maintaining an organisational environment that supports effective business

continuity management and builds organisational capabilities.

Description
Many factors internal to the organisation affect the efficiency and effectiveness of business continuity
management. You should be aware of the factors that affect your organisation and, within your sphere of influence,
contribute to creating an environment that supports business continuity management.

Internal factors include the organisation’s purpose and objectives, its structure, and its policies and processes. As
well as having a direct effect on business continuity management, these internal factors shape the organisational
culture. Sometimes described as ‘the way things are done around here’, organisational culture itself affects
business continuity management. The way people behave and interact, and the sector and national culture(s) in
which the organisation operates also affect organisational culture.

The whole-organisation nature of business continuity management has much in common with functions such as
quality management, environmental management and knowledge management. This creates opportunities for
developing a mutually beneficial organisational culture and capabilities such as collaborative working practices.

The organisational The abilities described in the Leadership and Working with others competencies are relevant to influencing
and shaping the organisational environment. Systems thinking (described in Thinking and innovating) is useful in
seeing the big organisational picture.

environment Elements
Internal factors
Understanding and, within your sphere of influence, shaping organisational objectives, structures, policies and
processes to improve the environment for business continuity management.

Organisational culture
Contributing to a culture that supports effective business continuity management. Organisational culture means
the values, attitudes and behaviour of an organisation that contribute to the unique social and psychological
environment in which it operates. Whatever your career level or role, the way you behave towards others makes
a difference to the culture. Contributing to organisational culture includes promoting and championing business
continuity management in your organisation; understanding the influence of the sector and national culture(s) that
affect your organisation; being prepared to challenge behaviours that do not support effective business continuity
management; and, within your sphere of influence, shaping other internal factors.

Opportunities for organisation-wide improvement

Exploiting synergies with other organisation-wide functions to develop mutually beneficial organisational
capabilities. Working with functions such as quality management, environmental management, knowledge
management, and health and safety to develop capabilities such as collaborative working and to create an
organisational culture that supports many organisation-wide functions.

16
 Find out more
www.thebci.org
Understanding and shaping the evolving role, scope and practice of business continuity
management in a changing world.

Description
Many factors external to the organisation affect business continuity. Social, technological, environmental,
economic, political, legal and ethical factors affect organisations’ business continuity needs and the way business
continuity programmes are delivered. Worldwide developments and innovation in business continuity thinking and
practice create new ways of working.

Business continuity is also affected by the wider organisational resilience landscape. Business continuity is one of
many inter-related professions, disciplines and practices that contribute to building and improving the resilience
of organisations. This means there is no single source of resilience knowledge, so everyone benefits from the
professions working together to pool and develop their knowledge. As the organisational resilience landscape
evolves, so does the role, scope and practice of business continuity management.

Business continuity professionals should be aware of external factors, adapt working practices, and where
possible promote and help shape the future role, scope and practice of business continuity and organisational
resilience.

The business Elements

continuity External factors

Developing an awareness and understanding of external factors that affect the role, scope and practice of

environment business continuity management.

Keeping up to date with changes and developments external to the organisation that affect business continuity
management. Adapting working practices to reflect these changes and developments. Where possible and within
your sphere of influence, shaping external factors such as legislation and regulations.

Working with other resilience professionals

Respecting, collaborating with and valuing the different perspectives of other resilience professionals. Examples
include networking, benchmarking activities, and participating in external resilience events.

Organisational resilience is defined in ISO 22316: 2017 Security and resilience – Organisational resilience –
Principles and attributes as the ability of an organisation to absorb and adapt in a changing environment. Other
professions and disciplines that contribute to organisational resilience include emergency management, crisis
management, health and safety, physical security, information security and risk management.

Championing
Championing and promoting business continuity and organisational resilience externally, for example in published
articles and at conferences.

Shaping the future

Shaping the future role, scope and practice of business continuity management and organisational resilience. For
example, through mentoring others, involvement in joint research and development projects, and instigating and
participating in cross-disciplinary activities organised by the BCI and other professional associations.

17
 Find out more
www.thebci.org Establishing the organisation’s policy relating to business continuity and defining how the policy
should be implemented through the business continuity programme.

Description
The business continuity policy sets out the purpose, context, scope, and governance of the business continuity programme.
The policy should support the strategic objectives of the organisation. The business continuity programme is an ongoing
cycle of activities that implements the policy.
Policy and programme management is Professional Practice 1. Establishing the policy and defining the business
continuity programme is one of two management Professional Practices that underpin the business continuity lifecycle. It
requires Leadership and management competencies as well as the elements listed below.
Business continuity policies and programmes vary significantly in scope and in the effort needed to develop them,
depending on the nature of the organisation.

Elements
Project management
Selecting and using appropriate project management tools and techniques to establish the policy and support development
of the business continuity programme. Understanding when to use different project and programme lifecycles such as linear,
iterative and hybrid.

Policy and Project management is defined in ISO/TR 21506: 2018 Project, programme and portfolio management – Vocabulary
as coordinated activities to direct and control the accomplishment of agreed deliverables . If your organisation has an
established project management methodology or framework, you should use it.

programme Establishing a business continuity policy

Agreeing the definition, objectives, scope and standards for the business continuity policy. Working with those responsible
for creating policies and facilitating sign-off by top management. Communicating the policy to all interested parties. Once

management the policy is established, reviewing and updating it.

Defining the scope of the business continuity programme
Defining the scope of the business continuity programme taking into consideration the products, services and locations
that are to be included or excluded in the programme.. Ensuring the programme is aligned with the organisation’s objectives,
strategy, culture and policies. Ensuring the programme makes best use of available resources, such as budget. Working with
external and internal stakeholders such as suppliers and a steering group or advisory team. Selecting and using appropriate
methods and techniques.
Establishing governance
Establishing a governance structure and governance activities for the business continuity programme. Defining
accountabilities for top management and ownership of business continuity management. Identifying key performance
indicators for validation of the business continuity programme. Defining reporting and communication policies. Ensuring
governance is aligned with the overall structure of the organisation.
Assigning roles and responsibilities
Assigning roles for implementation and maintenance of the business continuity programme to individuals and teams.
Ensuring that individuals and teams have the required skills and competencies.
The Business Continuity Programme
Using the business continuity lifecycle to develop the business continuity programme activities and projects. Ensuring
coordination between programme activities and projects. Working with people from other areas of the organisation to
ensure alignment between the programme and other policies and practices. Raising awareness and promoting the benefits
of the programme inside and outside the organisation. Managing the programme budget and documentation. Ensuring legal
and regulatory requirements are identified and met. Identifying and using relevant standards and accepted good practice.
Reporting to top management. Establishing mechanisms for monitoring and continual improvement of the business
continuity programme. Establishing a method for review, measurement and sign off of the programme.
18
 Find out more
www.thebci.org

Integrating business continuity awareness and practice into business as usual activities and
into the organisation’s culture.

Description
The goal of embedding business continuity is to ensure it becomes part of business as usual across the
organisation. It involves raising awareness of business continuity and building commitment so that business
continuity becomes part of the organisational culture, and ensuring the required competencies are in place.
Embedding business continuity should be a collaborative process between related management disciplines to
improve overall organisational resilience.

Embedding is Professional Practice 2: one of two management Professional Practices that underpin the business
continuity lifecycle. It requires Leadership and management competencies – particularly The organisational
environment – as well as the elements listed below.

Embedding Elements
Raising awareness and building commitment
Identifying people within the organisation who need to engage with business continuity. Determining how best to
engage with them by understanding their key interests and priorities. Designing and delivering awareness-raising
and commitment-building activities, using existing and new communication channels. Where needed, working
with other organisational functions to raise awareness and build commitment. Selecting and applying appropriate
approaches such as working with business continuity champions, including business continuity in regular
meetings and other activities, and incorporating business continuity plans into standard operating procedures.

Ensuring required competencies are in place

Identifying existing and required business continuity capabilities, identifying gaps, and ensuring these gaps are
filled – for example through education and training, recruitment, or use of external service providers. Where
needed, working with other organisational functions to ensure gaps in competency are filled. Applies to everyone
involved in business continuity including top management, suppliers and other external parties as well as people
with specific business continuity roles and responsibilities.

19
 Find out more
www.thebci.org Reviewing and assessing an organisation to identify its objectives, how it functions and the constraints of
its operating environment.

Description
The main analysis technique for business continuity purposes is the business impact analysis, which is used to determine
the organisation’s business continuity priorities and requirements. A business impact assessment provides a thorough
understanding of what is critical to the organisation and what is needed to ensure continuity of the things that matter the most.
The high-level business impact assessment process involves prioritising the organisation’s products and services, prioritising
the processes and activities that deliver high priority products and services, and consolidating the analyses to determine
business continuity requirements.
There can be up to four types of business impact assessment (BIA), which provide progressively greater levels of
understanding: Initial BIA; Product and Service BIA; Process BIA; and Activity BIA. These can be used independently or
in combination, depending on the size, complexity and type of organisation – and on the scope of the business continuity
programme.
Analysis also includes a risk and threat assessment, often performed after the BIA (or sometimes concurrently) to identify
unacceptable levels of risk and single points of failure. This information is used to develop options for mitigation measures in the
Design stage of the business continuity lifecycle.
Analysis is Professional Practice 3. It can lead to revision of the business continuity programme scope, and might highlight
areas for improvement in the organisation that are not be directly related to business continuity. It requires Leadership and
management competencies as well as the elements listed below.

Elements

Analysis Selecting an appropriate approach

Using knowledge of the nature of the organisation and any existing business impact analyses to determine the optimum type
of business impact analysis that will lead to appropriate understanding of the organisation’s priorities and business continuity
requirements.
Designing the business impact analysis
Deciding how the business impact analysis will be conducted: what data and information will be gathered and how it will be
analysed, consolidated and reported. See Methods and tools below.
Undertaking the business impact analysis
Working across the organisation to gather data and information, analyse it, and consolidate the results to determine the
business continuity priorities and requirements. Reporting the findings to top management for approval.
Risk and threat assessment
Using risk and threat assessments to identify and rank potential threats to the organisation’s activities, determine unacceptable
levels of risk and single points of failure. Identifying potential options for reducing the frequency, scale and impact of the highest
ranked threats.
Methods and tools
Selecting and using methods and tools for gathering data (for example planning and conducting workshops, interviews and
questionnaires).
Selecting and using appropriate methods and tools for analysing data (for example statistical analysis, content analysis,
spreadsheets and software tools).
Determining levels for specialist business continuity concepts such as maximum tolerable period of disruption (MTPD),
recovery time objective (RTO) and minimum business continuity objective (MBCO).
Risk assessment methods such as risk matrices and risk scores.
Consolidating and reporting
Performing a final analysis to combine all the results of the business impact assessment and finalise the business continuity
requirements. Reporting the results and requirements to management: clearly, credibly and comprehensively.
20
 Find out more
www.thebci.org

Identifying, selecting and agreeing solutions that enable an organisation to mitigate risks and
achieve continuity in the event of an incident.

Description
The goal of Design is to decide what will be done to ensure an organisation can respond to an incident and
continue to provide its prioritised activities in case of disruption. It also covers strategies and solutions for
mitigation measures that reduce the likelihood and impact of disruption.

Solutions and mitigation measures should meet the business continuity requirements identified in the Analysis
stage. Designing solutions and mitigation measures involves reviewing the organisation’s existing continuity
capability, creating new or updating existing solutions and mitigation measures, and evaluating their effectiveness
and costs. Selected solutions are then consolidated across the organisation to ensure they are consistent and
achievable, and to take advantage of opportunities for improving organisation-wide collaboration and efficiency.
Top management can then agree to provide the resources to implement the consolidated solutions and mitigation
measures.

Design is Professional Practice 4. It includes working with internal and external stakeholders such as suppliers,
and requires Leadership and management competencies as well as the elements listed below.

Elements
Design Reviewing existing continuity capability
Comparing existing continuity capabilities with the requirements determined in the analysis stage to identify any
shortfalls or over-investment.

Business continuity solutions and mitigation measures

Identifying, creating or updating solutions and mitigation measures to meet business continuity requirements.
Understanding established business continuity solutions and mitigation measures such as diversification,
replication, standby and post-incident acquisition – and how these can be applied to different organisational
resources, including suppliers.

Evaluating solutions and mitigation measures

Analysing solutions and mitigation measures for effectiveness and cost. Use of methods such as cost benefit
analysis to select recommended solutions and mitigation measures.

Consolidating
Applying an organisation-wide perspective to selected solutions. Checking that solutions are consistent and
achievable, and do not conflict with other policies and practices. Removing unnecessary duplication. Exploiting
opportunities for organisation-wide collaboration and efficiency, for example to increase purchasing leverage or
share resources.

Presenting solutions and mitigation methods

Presenting top management with the recommended consolidated solutions and mitigation measures including the
required resources, benefits and risks. Obtaining agreement to implement solutions and mitigation measures.

21
 Find out more
www.thebci.org

Putting into practice the solutions and mitigation measures agreed in the Design stage.

Description
Implementation prepares an organisation to manage an incident by putting into practice the thinking and agreed
actions developed in the Analysis and Design stages of the business continuity lifecycle.

It includes establishing a response structure with clear assignment of roles and responsibilities to competent
individuals and teams, then developing and managing business continuity plans containing procedures that guide
the organisation through the actions required when an incident occurs.

Organisations often have multiple business continuity plans to cover different products, services, locations or
departments. Multiple plans can also be created to address the strategic, tactical and operational requirements of
an organisation. Plans can be developed to address a specific known threat or risk, but in most cases need to be
flexible enough to be used to respond to any incident that occurs – regardless of its cause.

The response structure and business continuity plans should be reviewed and updated regularly to keep them up
to date, effective and (where there are multiple response teams and plans) aligned.

Implementation Implementation is Professional Practice 5. It includes working with internal and external stakeholders, and requires
Leadership and management competencies as well as the elements listed below.

Elements
Establishing and maintaining a response structure
Establishing a response structure that reflects the size, complexity and nature of the organisation – and supports
the agreed business continuity solutions. Assigning roles and responsibilities to individuals and teams with
appropriate authority and skills. Ensuring the individuals and teams in the response structure have the ability to
recognise and assess threats when they occur – and to determine an appropriate response. Once a response
structure is in place, maintaining and updating it. Identifying the business continuity procedures that are needed to
support the teams and individuals in the response structure.

Developing and managing business continuity plans

Defining the number and type(s) of plan needed to support the teams and individuals in the response structure.
Appointing an owner or sponsor for each plan. Defining the objectives, scope, structure, format, components
and contents of the plan(s). Working with stakeholders to produce plan(s) that are direct, adaptable, concise and
relevant. Once a plan has been agreed, maintaining it to an agreed schedule. Ensuring that multiple plans are
aligned with each other.

22
 Find out more
www.thebci.org

Confirming that the business continuity programme meets the objectives set out in the policy
and that the plans and procedures in place are effective and continually improved.

Description
Validation ensures that the response structure reflects the size, complexity and nature of the organisation – and
that the business continuity plan(s) are current, accurate, effective and complete.

It is achieved through three activities: exercising, maintenance and review. Exercising is a process to train for,
test, assess, practise and improve the organisation’s business continuity capability. Maintenance is a process to
ensure all the organisation’s business continuity arrangements are kept relevant, up to date and ready to respond
to an incident. Review is a process for assessing the suitability, adequacy and effectiveness of the organisation’s
business continuity programme and identifying opportunities for improvement.

Validation is Professional Practice 6. It includes working with internal and sometimes external stakeholders, and
requires Leadership and management competencies as well as the elements listed below.

Validation Elements
Exercising
Developing and managing an exercise programme to assess, practise and improve the organisation’s business
continuity capability. Defining the exercise programme goals, specific objectives (such as training needs or the
need to cover current risks and threats) and scope. Designing and planning specific exercises, including the
post-exercise debriefing process. Conducting specific exercises. Following an exercise, debriefing to gather
participants’ experiences and identify improvements to plans, procedures, training and awareness activities.
Producing a post-exercise report and distributing it to participants and all those who need to act on recommended
improvements. Following up to ensure any issues raised by the exercise are addressed.

Maintenance
Deciding when maintenance is needed, for example in response to internal or external changes or as part of a
planned maintenance schedule. Agreeing and making changes to specific elements of the business continuity
programme and plans. Communicating the changes to all those affected. Providing training and awareness raising
activities to support the changes where needed.

Review
Ensuring regular reviews are conducted. Selecting and scheduling the type(s) of review: audit, self-assessment,
quality assurance, performance appraisal, supplier performance or top management review. Developing action
plans to implement recommendations from reviews, address any performance shortfalls and make improvements
to the business continuity programme and plans. Following up to ensure planned actions are taken.

23
 Find out more
www.
Find thebci.org
out more
www.thebci.org

BCI
Membership Affiliate
Student
CBCI AMBCI MBCI FBCI

Grades

24
 Find out
Find outmore
more
www.thebci.org
www.thebci.org Correct at Jan 2020

GRADES* CRITERIA EXPERIENCE BENEFITS SUGGESTED DEVELOPMENT

FBCI FBCI FBCI FBCI

FBCI
Can reformulate or develop
original thinking in this subject
AND/OR apply advanced or
specialist understanding to
solve complex problems.
MBCI
Comprehensive
understanding of the
subject and can evaluate
information that might be
complex AND/OR can apply
this in day-to-day work to
solve complex problems.
AMBCI
Foundational understanding
with an awareness of different
approaches AND/OR apply
this in day-to-day work to
carry out well-defined tasks.
• Must have held MBCI for 10+ years All benefits listed below PLUS: • 20 hours of CPD each year
at least 5+ years experience in • prestige – knowing you have achieved • Volunteering
• Must have made significant BC across all the highest possible grade available • Speaking engagements
contribution to BC community and six professional • Research contributions
be able demonstrate this activity practices • Awards submissions
• Content production
MBCI MBCI MBCI MBCI
• 20 hours of CPD each year 3+ years All benefits listed below PLUS: • Professional Practice courses
• Hold one of the following experience in • may act as a Mentor •B usiness Continuity
– CBCI BC across all anagement BCI Diploma
– Business Continuity six professional • Volunteering
Management BCI Diploma practices • Speaking engagements
– AMBCI • Research contributions
• Awards submissions
• Content production
AMBCI AMBCI AMBCI AMBCI
• 20 hours of CPD each year 1+ years All benefits listed below PLUS: • Professional Practice courses
• Hold one of the following experience in • full access to BCI research •B usiness Continuity
– CBCI BC across all • 15% discount on selected BCI products and events Management BCI Diploma
– Business Continuity six professional • free subscription to printed copy of • Volunteering
Management BCI Diploma practices or 2+ Continuity & Resilience magazine • Speaking engagements
years in one or • Awards submissions
two professional • Content production
practices •A ttend events and grow personal network

CBCI CBCI CBCI CBCI CBCI

Demonstrates knowledge
of the BCI Good Practice
Guidelines; level may be
upgraded upon submitting
evidence of professional
experience
• 20 hours of CPD each year Good knowledge All benefits listed below PLUS: • Professional Practice courses
• Pass the CBCI exam of the BCI’s Good • eligible for BCI CPD programme •A ttend events and grow personal network
Practice • 10% discount on selected BCI products and events
Guidelines • internationally recognised credential
• access to Regus facilities and
other value added benefits

Affiliate/Student Affiliate/ Affiliate/Student Affiliate/Student

Affiliate/Student • Affiliate – An individual who has an active
As a non-certified interest in BC or who is considering
member, evidence pursuing a career as a BC professional
of knowledge and • Student – An individual who is
professional experience currently undertaking study on
has yet to be supplied either a full time or part time course
that is related to BC or resilience
Student • join BCI Mentoring programme as a mentee
No knowledge • free GPG download
check or • 5% discount on selected BCI products & events
information about • access BCI membership social media groups
level of experience • claim third party discounts on conferences etc
• free digital Continuity & Resilience magazine
• online access to the Continuity & Resilience Review
• Introduction to Business Continuity course
•G  ood Practice Guidelines Training
Course (Certification Training)
•B  usiness Continuity
Management BCI Diploma
•e  -Learning course - Introduction
to Business Continuity

25