The industry has been fairly supportive of the new British Standard for Business Continuity Management, BS-25999. That is as it should be as the standard is a significant step forward in raising the profile of business continuity and best practise. However, there is a belief held by some business continuity managers that one of their goals should be to achieve BS25999 compliance. The following to some may seem like a semantic argument and not applicable to them, but I think it is worth stating none the less.
The role of a standard is to test the existence of the process that you have in place, it is not necessarily to test its efficacy. It was once argued by Henkoff that the ISO9000 series of quality standards were too passive and the implementation of the standard excluded any definition of customer requirements.
With ISO 9000, a manufacturer of concrete life jackets could be registered as long as there were systems in place to assure they were well made – Henkoff 1993
It could be argued that BS25999 follows the same pattern, but from my discussions with some individuals who have been audited against the standard, the auditors are keen not to let this happen.
As I have stated before, the main goal for any business continuity manager is to make their organisation more resilient. It is clear that BS25999 has some clear benefits for organisations, but the standard alone does not make your organisation resilient but merely tests whether you can achieve resilience. BS25999 is a useful stepping stone towards achieving that goal as it helps organisations to measure the efficacy of their own process. In short, be careful not to confuse the means with the end.
Related posts:
Recent Comments