It is widely accepted that managing risk is an essential part of good business practice. It is also generally understood that a structured and disciplined approach to risk management needs to be adopted to ensure that optimum outcomes are achieved.   Read more ..Generative Risk Assessment

As defined by Standards Australia, Business Continuity Management, HB221:2004, Business Continuity is “the uninterrupted availability of all key resources supporting essential business functions.”

The Standard goes on to say that Business Continuity Management (BCM) provides for the availability of processes and resources in order to ensure the continued achievement of critical objectives.

Business Continuity Institute (BCI) & BS 25999 defines BCM as a process that identifies potential impacts that can threaten an organisation. It provides a framework for building resilience and the capability for an effective response which safeguards the interests of its key stake holders, reputation, brand and value creating activities.

So what does this mean, simply put BCM is “Plan B”.

A by-product of BCM is that it provides a comprehensive understanding of what the business actually does, how it does it and what it needs to do it to continue doing it.

BCM has mainly seen as being in the domain of financial institutions, insurance companies, Telco’s and utilities.  But it’s not only these businesses that are impacted by outages or natural disasters.

How would you or your business react during an incident would you be able to maintain your critical business services or would business just stop?

We only need to see what the impacts of the recent natural disasters, i.e.  Floods, cyclones and bush fires are having on business and the communities they service.

This is where BCM gives business an advantage as it prepares the business and its management team to quickly respond to unanticipated incidents.

BCM should be conducted as one of the required outcomes of the risk management program (ISO31000, 5.5 Treat Risks).

It must be pointed out that BCM differs from Disaster Recover (DR), as DR’s focus is on IT.  IT systems are resources of the business just like staff and equipment and play an important role in the BCM process, but should not be mistaken as the BCM process.

Poor business continuity management practices destroy credibility and leave the organisation exposed.

It is important that a robust BCM Framework within an organisation and covers:

• Business Continuity, ( what will we do and how do we do it)
• Disaster Recovery, (getting IT back up and running)
• Crisis Management  (Roles & Responsibilities in managing the incident) &
• Communications Policy, (what do we say to stakeholders, customers and the media)

BCM’s main output is the Business Continuity Plan (BCP), which will bring together:

• All Contingency Plans (what we do);
• Disaster Recovery Plan (IT recovery) and
• Business Resumption Plan (getting back to business as usual)

All Businesses plan and part of the planning process should include a robust BCM process, as we insure against fire and theft, we should also insure in the continuity of customer service. After all, that’s what we are in business for.

The Centro Ruling was a landmark case last year in which the Federal Court  found that executives and directors of troubled property group Centro breached the Corporations Act by signing off on financial reports that failed to disclose billions of dollars of short-term debt.

In making declarations of contravention, Justice Middleton identified a number of key facts which supported his findings.

A few of these comments included that directors:

• knew or ought to have known that the current liabilities were larger than disclosed, and that the guarantees had been granted;
• failed to properly read, understand and give sufficient attention to the content of the financial reports as they related to current liabilities and the guarantees;
• failed to make enquiry or adequate enquiry of management, the Audit Committee and other members of the Board concerning the apparent deficiencies in the reports;

The case is seen as having major implications for the way company directors do their job.

The head of ASIC, Mr Medcraft, says the ruling clarifies the duties of company directors.

“They can’t just simply delegate to management or rubber-stamp management, they are held to a high standard,” he said.

“I think today’s decision empowers directors, because what it says is, ‘I’m responsible, therefore I want to know what is going on’.”

This points to the importance of 2 things:

• Directors need to ensure that the organisation’s risk management framework and governance framework are very transparent and support them in their oversight roles
• Directors need to have in place processes to personally ensure that the reports they are being provided are accurate

Centro penalties decision