Ready to adopt business continuity

Not only is Business Continuity Management a part of best practice recommendations in various countries, but has become integral in numerous regulations that are binding on companies. Examples of Business Continuity-aware regulations include the King III Report in the South Africa and the global banking sector’s Basel II.
In Africa, however, Business Continuity Management is still in its infancy, and is even completely absent in a few countries. This lack of Business Continuity Management is not a story about Africa lagging behind the rest of the world, but one of how some central banks on the continent are starting to take matters into their own hands and create their own Business Continuity guidelines for their banking community in country.
South Africa is the leading light in African Business Continuity Management with a long history of professional services and adherence to global standards. While it would be incorrect to say the country is the perfect example of Business Continuity compliance, it measures up to many European and American standards. The banking industry in this country, for example, is well versed with Basel II and its associated responsibilities.

DIY Business Continuity
“While there is a distinct lack of Business Continuity Management in government and financial circles in Africa in general, this does not mean the concept is unknown on the continent,” says Willem Olivier (MBCI), managing director of international business at ContinuitySA. “We are already seeing some central banks putting their money where their mouths are and setting Business Continuity standards for themselves and their financial community.”
Unfortunately, the biggest problem facing the implementation of Business Continuity Management standards across the board, from Namibia and Botswana to East and West Africa, is the severe lack of skills available on the continent.
“A serious hindrance to these central banks is the lack of skills on the continent. South Africa is home to many respected and highly skilled Business Continuity practitioners, many certified Fellows or Members of the International Business Continuity Institute (BCI),” adds Olivier. “The reality, however, is that there are not enough skilled people to meet the country’s needs, let alone to meet the needs of the rest of the continent.”
Nonetheless, some central banks, such as the Kenyan central financial authority, have started their own Business Continuity Management programmes and are trying to persuade their associated financial institutions to join them in implementing them across the board. Moreover, a few central banks in Africa, including those in Kenya, Nigeria and Tanzania have developed a set of standards that can be applied in the African context.
Of course, devising, promoting and adopting a standard is easier said than done. Apart from the skills issue, there are additional challenges Africa needs to overcome before Business Continuity Management can become a standard feature in public and private sector organisations. The main challenges faced include awareness, understanding, long-term management and maintenance, and costs.

Awareness: The first challenge these Business Continuity Management drivers need to overcome is to ensure that all players in their respective countries and the region as a whole are aware of what Business Continuity is and how important it is to implement effective, standardised services in their organisations.
As there are only two sizable, accredited professional Business Continuity Management companies on the continent, it is difficult for businesses to drive the acceptance and adoption of the agreed-upon standards – standards that are preferably in line with the BCI’s globally recognised best practices.

Understanding: With awareness comes the need for understanding what Business Continuity Management really is and why it is a non-negotiable part of doing business. All too often, those with an understanding and skills in Business Continuity automatically assume that every businessperson shares the same comprehension of the value of continuity plans and testing scenarios.
More often than not, organisations believe that their continuity planning is complete if they have backups of their corporate data stored offsite – traditionally at a manager’s home. The reason for this misconception is that IT personnel are aware of the need to have technical continuity as they believe data is the core of the organisation’s business processes. While this is true, data is only a component of Business Continuity.
“ICT companies often claim to offer a full Business Continuity and Disaster Recovery solution, but they are always focused on technology and data,” notes Olivier. “The effectiveness of these recovery operations can be limited, however, (should the word as be in here?) while corporate data may be safe, the infrastructure necessary to make sense of or use of the data could be totally destroyed. Hence the need to ensure business and government leaders understand what real Business Continuity is and how it should be applied to business.”

Long-term management and maintenance: Even when awareness and understanding is improved through the educational efforts of professional Business Continuity Management companies and associations, the lack of skills limits the effective implementation and maintenance of plans.
“Consultants are often engaged by organisations to develop and roll out Business Continuity Management plans, designing an efficient system that should stand their clients in good stead for years,” adds Olivier. “The problem occurs once the consultants leave. Business Continuity is a continual process that needs to be tested, tweaked and updated regularly, requiring people with the appropriate skills to manage the process over years.”
Training people in Business Continuity skills, even basic skills is therefore crucial to effectively maintaining the continuity plan.

Costs: In these recessionary times, every company is concerned about costs and Business Continuity can be an expensive affair, especially if solutions are created in-house. Olivier says it is expensive to fund the design, preparation, implementation and maintenance of Business Continuity Management solutions – assuming they are done correctly, including properly equipped offsite recovery centres, if done in-house, as there is no cost sharing ability and expensive mistakes are often made.
In many instances, Business Continuity is put on the backburner simply because of the costs involved in setting up a programme. This is the wrong approach to take. If executives consider the expenses involved in creating their Business Continuity plan and then compare it to the amount of money it would take to recover from a serious disaster without such a plan, they would realise that the initial costs are quite reasonable.
Of course, this assumes the business survives. Evidence shows that organisations that do not invest enough time and resources into Business Continuity preparations often have to close down after a disaster. The Information Warfare Site states that fires permanently close 44 per cent of businesses affected, while after the 1993 World Trade Centre bombing, 150 businesses out of 350 affected (that did not prepare BCM plans) failed to survive the event (http://www.iwar.org.uk/infocon/business-continuity-planning.htm). Conversely, the firms affected by the 11 September 2001 terrorist attacks with well-developed and tested Business Continuity plans were back in business within days.
“There is another cost problem many growing financial organisations in Africa face,” notes Olivier. “Once in-sourced or internal recovery centres have been created, they are often quickly absorbed into operational use as they are empty, fully equipped and already paid for. Often after a few years they fall into disarray due to the lack of capital expenditure, cut backs, planning and the lack of proper change control.”
At the end of the day, almost all the challenges Africa faces in terms of Business Continuity Management centre on the lack of skills. If governments and central banks want to establish Business Continuity Management in the region, local skills need to be created to manage the process from conception to implementation.
“In this regard, it is also important for business to play its part and join the public sector in the drive to increase the availability of Business Continuity skills,” adds Olivier. “Business Continuity service providers operating in the region must therefore spread the word and communicate the need for and benefits of Business Continuity and Disaster Recovery, partnering to create and improve skills with the central banks and governments, like those in Kenya that are also pushing compliance to Business Continuity standards.