Q3. Define BCM?

Appraise the importance of a business continuity plan (BCP) and describe

the process of developing a BCP. (25 marks)
Q3 Response guidelines:
Candidates are required to define the concept of business continuity.
Candidates are required to describe business continuity management.
Candidates are required to identify sources of risks and crises in organizations.
Candidates should describe the benefits of having a business continuity plan.
Candidates should briefly describe the process of developing a business continuity plan.

Business Continuity Management (BCM) is a process that identifies the potential

threats, risks, or crises, to an organization and its impact to business operations. These
threats, if well identified and understood, could provide a framework for building
organizational resilience and establish an effective response that safeguards the
interests of its key stakeholders, reputation, brand and value-creating activities.

Depending on the company’s business and circumstances, there are many possible
sources of threats, risks and crises in organizations.

● Natural disasters
- Flooding caused by heavy rain or strong wind due to typhoons, could
damage the assets of a company such as office roof, windows, electronic
appliances etc..
● Theft or vandalism
- theft of any asset could slow down and/or stop business operations.
Vandalism in the company’s premises (e.g. office building) may impact a
company's reputation.
● Fire
- could potentially wipe out and destroy the company’s assets.
● Power cut
- loss of power could have serious consequences such as data loss or
damage of equipment.
● IT system failure
- computer viruses, cyber attacks, system failures could affect employees'
productivity and/or efficiency, and could even stop business operations.
● Loss or illness of key staff
- if any of the staff is central to the business operations, it is important to
have a plan if they were to leave or be incapacitated by illness or accident.
● Outbreak of disease or virus
- depending on the type of business, a virus outbreak among the staff, or in
the country where the business is in (e.g., COVID-19), could impact
business operations. The pandemic caused by COVID-19 affected the
supply chain of most of the industries.
● Product Recall
- may impact a company's reputation.
Businesses are prone to different kinds of disasters that vary in degree from minor to
catastrophic. Business continuity planning (or BCP) is typically meant to help a
company continue operating in the event of major disasters such as fires.

A business continuity plan (BCP) is a document that outlines how a business will
continue operating during an unplanned disruption in service. It is more comprehensive
than a disaster recovery plan and contains contingencies for business processes,
assets, human resources, business partners and every aspect of the business that
might be affected.
It is essential to have a detailed plan to protect your organization from the impact of
potential crises such as fire, flood, theft, IT system failure, illness of key staff etc. Failure
to plan could be disastrous and put the organization at risk of losing customers while
getting your business back to normal operation. It could also put the company in a
challenging position to the extent that it hinders recovery.

The following details the typical key steps that are followed in developing a business
continuity plan (BCP).

1. Business Impact Analysis

- Identifies the effects of disruption of business functions and processes. It
also uses the information to make decisions about recovery priorities and
strategies.
2. Recovery
- Identifies the required actions to recover the critical business functions.
3. Organization
- A continuity team must be created. This team is assigned to devise a plan
to be able manage any potential disruption.
4. Training and Testing
- The continuity team must be trained and tested. The members of the team
should complete exercises that will allow them to go over the plan and
strategies.The team should conduct simulations to test the BCP several
times to ensure readiness and applicability to different risk scenarios. This
will help in identifying any weaknesses in the plan which can then be
improved, updated, or corrected.