1 PURPOSE

  1. To identify the BCM Institute’s critical business functions and activities, relationships, revenues, and management controls must be protected from unacceptable disruption, regardless of the cause. It should always relate back to the policy.

2 SCOPE

  1. This procedure is applied to all BCM Institute business units.

3 RESPONSIBILITY

  1. It is the Organization BCM Coordinator responsibility to know each and every policy clearly and well defined so that he/she knows what will be indicated in the BC planning.
    Bcm framework.jpg
  2. BCM Policy Development
    • The BCP Team shall be responsible for the maintenance of the BCM policy.
    • The BCP Team shall be responsible for the functioning and handling of all relevant processes about the BCM policy.
    • The BCM policy shall be reviewed every two years and be approved by the BCM Steering Committee.

4 PROCEDURE

  1. The organisation’s critical activities, relationships, investments and internal controls must be protected from unacceptable disruption, regardless of the cause.

4.0 BCM Policy

  1. “BCM Institute is committed to the continual improvement of the effectiveness of our business continuity management system and to providing products and services that meet and satisfy customer requirements following a disaster.”

4.1 Policy 1: Written BC Plan

  1. In the event of a disaster, BCM Institute shall promptly continue the critical business functions with effective recovery strategies.
  2. BCM Institute shall establish effective and comprehensive plans covering all critical business functions.
  3. The BC plans should be consistent, or integrated, with all other existing or plans; like the integrated communications plan, occupational safety and health policy procedures, emergency and evacuation procedures.
  4. Preparation of BC Plan (Detailed) Policy

4.2 Policy 2: Roles and Responsibilities

  1. BCM Institute shall establish a proper organisational structure for BCM.
  2. The structure shall define all necessary roles and responsibilities, be staffed with the appropriate personnel and be reviewed annually, or sooner, for example, whenever there are significant organizational-wide changes.

4.3 Policy 3: BCM Planning Methodology

  1. BCM Institute BCM Team is responsible for issuing and maintaining the BCM Framework and Policy.
  2. BCM Institute shall sufficiently cover all possible disasters that would disrupt critical functions for a period of 3 or more calendar days (preventing access to the office building, and causing significant damages and losses), in the Risk Analysis & Review, which should be consistent with the principles outlined in the BCM framework and guidelines, and Business Impact Analysis Phases.
  3. BCM Institute shall focus on ensuring the safety of staff and the continuity of operations, protecting key assets and sustaining public confidence in the company’s reputation.
  4. BCM Institute shall identify critical business functions using pre-defined and standardised criteria throughout.
  5. BCM Institute shall evaluate the recovery strategies. It covers pre-incident preparedness, response and recovery. BCM Institute may choose to adopt a composite of strategy mix based on its critical business functions’ interdependencies and their recovery time requirements in conjunction with the probable disasters.

4.4 Policy 4: Audit BCM Readiness

  1. The appointed auditor will report to the President of BCM Institute on compliance with the BCM policy and BCM planning methodology.
  2. The appointed auditor shall evaluate and review the BC plans.

4.5 Policy 5: Testing and Exercising

  1. BCM Institute shall organise the tests and exercises for the BC plans covering the whole organisation annually, or as soon as it is appropriate.
  2. The BCP Project Team shall monitor and review the testing and exercising of the organizational-wide and business unit BC plans annually.
  3. BU Heads shall be accountable to the President of BCM Institute and BCM Steering Committee for the readiness of its BC plans.

4.6 Policy 6: Awareness Program

  1. BCM shall become a part of Risk Management Program.
  2. BCM Institute shall incorporate BC awareness and training programs into the organizational-wide corporate culture.
  3. Awareness Program (Detailed) Policy

4.7 Policy 7: BCM Program Management

  1. The BCM Team shall review and report the status of the BCM Program and BCP projects to the BCM Steering Committee.
  2. The BCM Team shall continue to enhance the BCM policies and related process to ensure that the BCM program within the organisation is sustained.
  3. Review of BCM Program (Detailed) Policy

4.8 Policy 8: BC Plan Activation

  1. The BC Plan shall be activated by the Crisis Management Team (CMT) for major incidents or disasters affecting the whole Corporation or several key divisions. The BCM Steering Committee will assume the CMT role during a major crisis.
  2. For incidents that affect only one or a few divisions, the CMT may delegate the authority to activate the BU BC plan (or recovery process) to the BU Heads affected by the incident. If so, the Heads of BUs will report the status and progress of recovery activities to the CMT, based on the reporting frequency defined by the CMT.

4.9 Policy 9: Risk Appetite

  1. Executive management needs to be able to establish the maximum level of risk (the financial risk associated with losses and non-financial impact) the organisation desires to take.
  2. Executive management needs to be able to assess whether the organisation is accepting risk as desired.

4.10 Policy 10: Satisfy Applicable Requirement and Continual Improvement

Executive Management shall establish a commitment to:

  1. satisfy applicable requirements; and
  2. continual improvement of the BCMS.

5 DEFINITIONS

  1. Organization BCM Coordinator
  2. Business Continuity (BC)
  3. Crisis Management Team (CMT)
  4. Awareness
  5. Activation
  6. Program Management
  7. Audit
  8. BCM Planning Methodology

6 RELATED DOCUMENT

  1. BCM Testing Policy
  2. BCM Maintenance Policy

7 RECORDS

  1. Nil

8 APPENDICES

  1. Nil

http://www.gmhasia.com/bcm-manual/bcminstitute/wiki/BCM_Procedure:Company_BCM_Policy