Business Continuity Management
All work is compliant with the BCI Good Practice Guide and ISO22301.
Case Study – ScottishPower
PlanB is able to provide services that address the complete Business Continuity lifecycle. This example of a programme set out for ScottishPower shows the parameters of what can be achieved.
Charlie Maclean-Bristol was employed by ScottishPower as Business Continuity Manager for 3 years, responsible for developing Business Continuity for their retail division.
A major programme was carried out to improve the existing 29 business units’ Business Continuity Plans. This involved first carrying out Business Impact Analysis (BIA) across all business units, scrutinising three end-to-end processes and identifying the twenty-two critical processes that underpinned them. This also included identifying key internal and external suppliers/stakeholders and working with business units to develop strategies to mitigate their risks.
One of the mitigation strategies involved appointing a Disaster rRcovery printer to cover loss of the outsourced print centre based in the organisation’s largest office. Business units were helped to develop their strategies and writing of the plans were supervised. An evaluation criteria was developed based on PAS 56 (predecessor to BS 25999), to ensure the quality of the plans.
Plans were tested during a major 4-day exercise to ensure that if a major emergency were to occur all the businesses’ key functions could be recovered within an appropriate time, and that the recovery centre could actually be set up at short notice with over 120 staff working out of the centre. Informing and liaison with key stakeholders formed a key element of this exercise. This exercise was repeated at two other major company offices.
The MD was trained and his first line reports were asked how to respond to a Business Continuity incident and how to operate within the division’s Business Continuity framework. The team was tested in two exercises one involving the CEO and the second involving a full range of media and role player inputs. The exercises culminated in the development of an action plan to be presented to an Executive Director.
Throughout the project there was regular reporting, either in person or through prepared slides and papers for the Risk Committee, Divisional Board and main ScottishPower Board on the state of business continuity presently in place.
An important part of the project was the training and development of thirty-five Plan Leaders ensuring they had the skills and knowledge to develop plans for their own business unit. This was carried out through regular meetings, workshops and a 2-day conference with internal and external speakers to help develop their business continuity understanding and to coordinate dependencies between plans.
Part of the project also involved a 6-month disaster recovery project to test all the underpinning IT systems to ensure that the critical process could continue to operate even with the loss of the main data centre.