Dichotomy. I looked up the word and found "the splitting of a whole into exactly two non-overlapping parts, jointly exhaustive and mutually exclusive".
BS25999 has two parts; one concerning primarily the Doing of the Business Continuity PDCA cycle, the other more about the Planning, Checking and taking Action. Not at all a dichotomy, I know – but then why do many BC managers treat the concept of the BC Management System (BCMS) in part 2 as if it were superfluous to the delivery of BC programmes?
Most practitioners build effective plans and create the mechanisms to ensure they remain current (change management, reviews, exercises, etc). However, some see this success as the end point and shy away from establishing the controls called for by BCMS.
I suggest it has to do with maturity. Consider a BC programme maturity model defined as:
- Low maturity - without effective plans (an organisation at risk);
- Medium maturity - plans in place to bring about a successful recovery (an organisation considered a competent performer). This can be achieved without being BS25999 certified or aligned (though without the benefit of formal BCMS the level of assurance may be quite low). This represents an alluring false ceiling.
- High maturity – effective BCM is wrapped in a BCMS allowing the organisation to embed the understanding of the discipline in the organisational management, deliver greater assurance to customers / clients and improve the targeting of investment. (an organisation with competitive advantage and optimised investments).
Does a mature BC programme necessarily mean greater expenditure? Absolutely not, and we need to dispel that myth! The BCMS protects the investment we have made in BCM. This allows our business leadership to understand risks and determine where best to place investment and to align recovery capabilities with the business risk appetite. Maturing from medium to high can lead to savings.
The two parts of the BS25999 standard do not represent a dichotomy, but more a sign of growing maturity. They should be treated as complementary. Close alignment with part 2 brings real benefits and certification provides independent assurance that clients recognise.