- Other links
Operational management (Stage 4 of the business continuity management process) is the responsibility of the business continuity manager. Activities should include:
As organisations can change rapidly, it is necessary to invest in an ongoing review programme.
A regular review of all deliverables in the business continuity management process should be undertaken to ensure that they remain current. This will include:
The business continuity management strategy should be reviewed, generally on an annual basis, to take into account any changes in business direction, business strategy or IT strategy and to consider any updates to the impact analysis and risk assessment.
Business recovery plans will need to be reviewed and updated regularly throughout the year to take account of personnel changes. Update the IT recovery plan whenever there is a major change to IT infrastructure, assets or dependencies such as new systems or networks, or a change in service providers.
Incorporating business continuity management into the change management process will ensure that contingency facilities are established before new systems and applications are implemented.
It will also ensure that any changes in the infrastructure are reflected in the contingency arrangements provided by IT or third parties.
A member of the business continuity team should attend change management meetings on recovery or resilience requirements.
Plans should also be updated following tests and reviews, and in response to day-to-day changes. Inaccurate plans and inadequate recovery capabilities may cause business continuity management to fail.
Change management complements the review process and will highlight any issues that have been overlooked.
Education and awareness will ensure that all staff are familiar with the implications of business continuity management, and with their roles and responsibilities in a recovery situation.
As a consequence, the ability of the organisation to respond better to an incident will be greatly enhanced. This will range from better evacuation procedures, knowledge of assembly points, familiarity with the desk that a recovery team member should occupy during a recovery, etc.
It is vital that all personnel involved in the implementation and maintenance of business continuity management are fully trained and can undertake their responsibilities effectively.
IT staff need to be trained in the necessary procedures to ensure that they can recover systems and applications quickly and efficiently.
In addition, other types of training may be considered appropriate. For example: media training for senior managers or trauma counselling training for Human Resources staff.
Establish a regular programme to ensure that the critical components of the strategy are tested at least annually, or as directed by senior management or audit.
It is important that any changes to the IT infrastructure are included in the strategy, implemented in an appropriate fashion and tested to ensure that they function correctly.
Continual testing of the effectiveness of the recovery teams is also essential so that staff remain aware of their responsibilities. It is also important to ensure that new members of the recovery team are familiar with their individual roles.
The final activity in operational management involves obtaining assurance that the quality of the business continuity management deliverables is acceptable to senior business management, and that the operational management processes are working satisfactorily.This should be undertaken as part of the internal and external audit process and can be used to demonstrate the effectiveness of the business continuity management environment.