Abstract
Business continuity Management involves protecting the most critical parts of a business.
Some parts like the IT department which contains almost all information in an organization falls
in that category. Any incident large or small resulting from deliberate actions, natural causes or
through accidents causes major disruptions to organizations. Planning on how to recover after
such occurrences is vital to organizations existence and requires planning rather than waiting for
disaster to happen. Therefore, Business Continuation Management department is a critical
department in any organization including banks as it deals with business disruptions and enables
timely recovery in the face of disasters. This thesis aims at finding out the importance of a BCM
department in the banking sector, its role, the steps towards developing and implementing the
plan as well as the disadvantages such organizations encounter.
Surname 2
Introduction
In the book ‘The Definitive Handbook of Business Continuity Management’ (4) business,
continuity management is defined as the process by which an organization identifies its most
crucial departments and prepares to protect them from future incidents that may compromise the
mission of the organization. These preparations also ensure continuity of business even when
faced with a crisis. It aims to recover not just the IT system but also protect the people in this
case the human resource, processes and the premises. This crisis ranges from fires, earthquakes
and other catastrophes. Business continuity management (BCM) is a way of risk management
and acts as a response to certain disaster. Aligning it to core business departments ensures its
success, these departments include emergency response department and IT department.
The aspect of BCP emerged in the 1950s and 1960s where organizations started storing
crucial data in copies in certain cities electronically. With the increase in disasters affecting the
operations of the business, organizations started thinking of ways to safeguard their business in
terms of BCM argues Drewitt (9). It involves consistent maintenance and service of systems in
order to maintain recoverability in times of disaster.
A BCM comprises four types of documents they are;
1. Crisis management plan (CMP) This plan encompasses implementation time, the
implementation team, their names, contact details, roles and responsibilities, third parties
including authorities and their relationship. It also contains the person authorized to be a
spokesperson incase of a crisis and the message to be delivered to employees, their
families, media and public.
Surname 3
2. Emergency Response Plan (EMP), which contains details on the response in case of a
disaster and the evacuation from the building.
3. Business Continuity Plan (BMP) contains the details of the relevant steps to be taken in
order for the bank to continue with its operations. At a specified site.
4. Disaster Recovery Plan (DRP) is a plan containing recovery, restoration and resumption
of the ICT system functions of the bank.
A BCM does not cover risks occurring, as a result, of the financial risk exposure. It
includes the discontinuation of business; as a result, of a bad decision by management
involving a business move, for example, disregarding a joint venture (Kasim, 40). This
reduces the scope of the BCM.
Business/Enterprise risk management (ERP) is different from Business continuity
management since it identifies measures to risks that may affect the organization (Kasim,
38). It looks at causes and the effects of these risks to the business. On the other hand,
Business Continuation Management concentrates on the solution to the impacts of a disaster
or risk and fails to consider the cause of the risk
The success of BCM depends on management support through allocating resources
towards business continuity planning and instills commitment to it within the organization
through raising awareness and implementing viable approaches. Risk assessment must also be
done in order to identify the potential threats to a firm, their impacts on the firm and the
probability of encountering these risks. Risk assessment should be done at division level so that
they are all identified, and necessary management strategy is put in place. An analysis on the
impact on the business also helps to identify the units that are integral in maintaining the
Surname 4
business in the face of crisis and determines the period it would take to recover to full function
following a disaster.
Business continuity management also involves identifying steps to follow when
implementing the recovery strategy and the necessary resources required for a successful
recovery. Training and development of the BCM staff is critical for the success of the program
and its implementation. Regular drills by the employees should be performed in order to
familiarize themselves with the program and to broaden their understanding of the procedure.
Major disruptions in the financial industry cause huge losses not just to the institutions
but also the country's economy. Drewitt, (34) states that the increase in dependence on banking
such that it has become critical for every financial institution to develop a BCM program to
avoid disruptions which are inevitable in the business world.
Statement and purpose of the problem
Financial institution plays a major role as part of the economy of any country. This is
because most commercial activities within a country are dependent on banks, and this has lead to
rise of financial institutions in various countries. In order to survive the competition and keep up
with the demands of customers, banks developed complex technology like ATMs, Telebanking
and internet banking. The dependence on the banks to provide all these services poses a risk in
case where a disaster happens and renders banks inoperative. A disaster like floods may render
financial services non-functional. This is critical especially in the face of crisis since individuals
and organizations including the government may find it hard to take measures to overcome the
disaster. Therefore, developing a Business Continuity Plan in banks even in the face of a disaster
Surname 5
is critical. The study, therefore seeks to identify the significance of developing a business
continuity plan for the success of banks in the face of crisis.
Study Questions
1. What is the importance of business continuity management in a bank?
2. What are the steps in implementing Business continuity plan?
3. What are the requirements for implementing a BCP?
4. How does BCP contribute to the success in the banking sector?
Hypothesis
Null Hypothesis: There is no relationship between business continuity plan and the success of a
financial institution
Alternate Hypothesis: The success of a financial institution depends on its business continuity
management program.
Significance of the study
A business continuity plan is critical in all sectors of the economy including banks. The
continuity of a bank goes beyond insurance or filing the plan in the company archives. Banks
play a major role in promoting the national and global economy through providing services like
borrowing, making payments, and lending thus facilitating investments and risk insurance, any
disruption in a bank affects these services. It is even harder considering that interdependence on
banks by individuals and organizations to provide the above services among others is on the
increase. Banks adopt complex operations in order to accommodate the customers' needs, which
increase the risks resulting from the complexity. Any disruption of the banking services,
Surname 6
therefore affects even other organizations. The spread of overreliance on banks for numerous
services has brought the need to maintain corporate image and retain customer confidence and
loyalty. To achieve the above, it is necessary for banks to implement a BCP as threats on the
banks increases ranging from terrorism, natural catastrophes and the complex technology in use.
Definition of terms
BCP- Business Continuity Plan
BCM- Business Continuity Management
Study Limitations
This study is based on the assumption that with a business continuity management in
place, overcoming any calamity by the bank becomes easier. This ignores the fact that most of
the banking activities involve automation, which relies on power supply by other sectors.
Therefore, the plan may fail to work if there is no power supply to the financial sector (Jonna,
30). On the other hand, use of generator incase of power failure is also unreliable for successful
implementation of this program. Generators are normally found in basements of building such
that when floods occur, they are become useless.
Another limitation for this study is that many institutions find it hard to share corporate
information they feel may compromise their competitive advantage in the market. This includes
the IT programs. This may limit the information they are willing to share as a way of protecting
their strengths.
Surname 7
Literature review
The financial industry participants and the authority shares interests in avoiding any
financial disruptions of normal activities after crisis. They participate in –promoting national and
global economic activities through providing loans, insuring individuals and other businesses
against risks, facilitating payments and business transactions through banks all, which promote
investments (Drewitt, 34). Any disruption in the banking sector has adverse effects on the
transactions as well the market environment.
Some organizations depend on the banking sector as a security in their operations
especially, as settlement incase of risk ventures, provision of credit facilities as well as cover the
liquidity risks on investment. These show the dependence on this sector globally by other
organizations such that any disruptions in the banking sector influences the global economy and
serious implications are felt in other sectors of the economy.
Successful Business continuity management
Business continuity management is a critical part of risk management, which comprises
of policies, procedures, and standards. They ensure timely maintenance and recovery of the
system in the face of disruption in the functions of a business (Jonna, 28). They are significant in
reducing the consequences of a disruption, which includes the corporate image, litigation,
financial and operational implications.
Effective BCM considers the impact rather than the source of the disruption, which
makes it easier for any sector including the banking sector to cope with any disruption. This
includes an institution assessing the risks associated with their location for example areas prone
Surname 8
flooding which leads to development of a BCP to cater for the effects of floods. To achieve
effective business continuity management it is necessary to include the following:
Business impact analysis, which identifies the critical operations and services as well as
the dependence levels within the bank, and the potential risks that may arise incase of
disruptions. A recovery containing the objectives and objectives is included in the program,
which is based on the impact analysis. It identifies the various options for an institution in the
face of crisis, and the best option is picked as the strategy. Plans for business continuity are set in
place whose role is to give implementation guidance (Snedaker, 40). This includes allocating
duties and responsibilities for management of operations in the event of disruptions and clearly
provides guidelines on those responsible for the decision making such cases. Safety of the
employees is also a key component of the business continuity plan.
Carrel (32) outlined some Important BCM features
1. Major attention is paid to priority areas that are critical for business processes and
BCM activities. Therefore, focus on critical functions like moving personnel an
alternative facility, use other office equipments and resources as an alternative, repair
or replacement of systems to enable resume of activities within a short time.
2. BCM covers prevention of disruption of business operations and reduces risks and
impacts of a disaster
3. BCM is a continuous process that occurs throughout the lifetime of business.
Surname 9
Business risks
These include the natural disasters that occur in the world like floods and man-made
disasters like terrorism. All these pose a big risk and threaten the existence of businesses, some
of them are completely wiped out, and other struggles for years to go back to business. In most
of the cases, such impacts are avoidable. The following are common disasters that threaten
various businesses according to Bessis (36)
Fire
Fire may occur in a single office in a building or an entire premise. It causes loss of life,
injuries and destruction of property. The estimation of destruction of property, as a result, of fires
is approximately $10billion per annum in American excluding financial loss.
Disease outbreak
Outbreak of diseases occurs in the event when there is an outbreak of the virus, and there
is no immunity for the human population. It means that a particular disease is spread across the
population. In such cases, lack of staff to run operations in a bank is a major issue and operations
stop. The pandemics may prolong meaning that normal activities like travelling to work are
disrupted. A BCP that ensures continuity of operations in a bank and other financial institutions,
therefore, comes in handy.
Terrorism
Terrorism is the use of violence against persons or property through violation of the
criminal laws of the country with the aim of intimidating or coercion. Terrorism instills fear to
the public and destabilizes the country’s’ government. Acts of terrorism comprise of bombings,
Surname 10
hijackings, kidnapping and use nuclear weapons. Such acts are common in various major parts of
the world and greatly affect operations of banks thus the need to develop a BCP that tackles
terrorism issues.
Biological attacks
Such attacks involve the deliberate release of biological substances, for example, germs
that make people sick. Such germs affect the population either through inhaling, infection from a
cut or ingestion by eating contaminated food. For example, spread of smallpox occurs through
touching and coughing and BCP may include evacuation of employee's strategies incase of such
tragedies.
Tornados
These violent storms occur without warning. They comprise of clouds of dust and debris
picked up by the moving clouds. Although they are confined to specific areas in the world, they
occur any time of the year causing destruction. Preparation is, therefore, necessary to those banks
located in these areas and having a BCP is critical.
Hurricane and Typhoons
These are severe tropical storms that form subtropical waters around the globe. It is
possible for scientists to predict their occurrence such that banks found in areas prone to
hurricanes adapts BCP that helps in recovery incase of a calamity.
Flooding
Surname 11
This is a common natural disaster and occurs either due prolonged rainfall or due to
heavy snow. Areas with low-lying areas and near water bodies are prone to flooding. This
disrupts employee’s availability or affects power supply. Affected employees who double as key
personnel are performing crucial functions of running a bank impacts on smooth running of
activities. Therefore, planning for business continuity in the face of such crisis is very necessary.
Although the existence of natural disasters dates way back, they are recurring a lot and
becoming harsher. This is; as a result, of urbanization and disasters like floods mainly occurs due
to global warming. Changes in weather patterns also contribute to these disasters. They are
inevitable in the business world; therefore, establishing strategies to deal with their implications
is a wise idea for banks. Adaptation of a viable BCP to deal with the calamities is crucial in
maintaining their operations with little or no impacts.
Impacts of Natural disasters on Banks
To the human resource, loss of life occurs or absence from work; as a result, of
occurrences. This creates a shortage of personnel thus affecting business operations and
achievement of objectives. Furthermore, people are the most important asset in a business, and
therefore, their safety and work conditions are crucial for success of a business.
Destruction of facilities and equipments occurs in the event of a disaster. It results in
destruction of operating facilities, offices or even buildings, which disrupt operations. This
hinders access to information resources like computers as well as the lack of access to offices
Surname 12
Calamities lead to communication breakdown through destruction of infrastructure. It
cuts down communication between clients, suppliers thus affecting the normal operations of the
business. Inadequate communication in the banking sector causes errors or duplication of duties
leading to losses. Breakdown of information hinders decision making which if not recovered in
time leads to huge implications.
IT systems may breakdown-causing operation to halt. This is because banks use IT for
almost all their operations especially improvement in technology (Snedaker, 34). With the
increase in dependence on banks by individuals and organizations, this breakdown destroys the
public image of the bank and customer loyalty is lost.
Disadvantages of a BCM
The process of developing a BCM is long and consumes much time Implementation of a
BCM is an expensive task since it is a continuous process. Bad implementation leads to financial
losses that are hard to recover especially in a bank, which faces multiple risks of loss of money.
Banks in their early stages of growth face implementation problems due to lack of strong
financial capability. This poses a disadvantage to them incase of a calamity; they have little or no
chance of survival without a BCP.
BCM tends to rely on technological support, which requires expertise for
implementation. Such specialists are hard to find, and this compromises the bank's policies when
it comes to acquiring and retaining these specialists.
Surname 13
Banks just like other organizations face the challenge of retention of specialists who hop
from one organization to another in search of better pay or in their quest to join bigger
organizations. It is critical to retain human capital that is essential to success of BCM.
BCM development process
When developing a BCM a project management approach is taken. It includes selecting a
team to spearhead the process, come up with objectives, scope, a manager, budget and a
committee to oversee it. The size and scope of a BCP depend on the size and complexity of the
business as well as foreseen disruptions on the bank.
The management support in a bank enables establishment of BCP in regards to the
organization needs, which involves having good governance and strong frameworks. These
aspects of the business lead to the successful implementation of the BCP.They include
sponsorship of the process through creating awareness of the program to the employees and
facilitating training to equip them with the necessary knowledge for its implementation.
Management has the mandate to instill a sense of ownership to the committee by giving
them the responsibility of overseeing full implementation of the program and supporting them in
their decisions as well as appreciating their performance.
Maintaining stakeholder’s relationships strengthens the business continuity management.
These stakeholders include security management, emergency response management, customers
and the staff. Failure to integrate these stakeholders brings problems during testing, exercises and
training.
Surname 14
A business continuity plan is subjected to continuous review in order to update it and
ensure its efficiency during implementation. It involves updating contact details regularly.
Planning also involves setting a schedule for testing and exercising the program frequently to
ensure its viability to perform incase of a disaster. This is mainly to the changes in technology
where up to date technology is acquired.
Performance monitoring ensures effective management of the BCM, which involves
developing system that allows regular reporting by the committee on the state of the program.
Incase of banks, frequent reporting is appropriate since banks are high-risk entities. Immediate
follow-up is necessary for incidents that occur during monitoring and changes are made
accordingly. The timeliness of the plan shows efficiency of the plan incase of a disruption.
Evaluation and review takes place periodically to check the plan compliance with the
banking frameworks and processes as well as policies. The plan undergoes external examination
or audit and review (Whelan, 34). Periodic review helps check compatibility with the
government regulations, change in technology, as well as structural change of the premises.
The design of the information architecture of a business should allow remote access. It
involves changing the designs to accommodate new technology that allows remote access
especially in a bank, incase of disruption the cost of recovering is reduced.
Business Continuity Management keeps on evolving for the past few years. Running a
business especially a bank is without BCM measure is impossible (Carrel 23). Taking into
consideration the global competition in the banking industry and the need to maintain a good
corporate image, sustainability is essential through business continuation even in the face of
calamities.
Surname 15
Example of a Banks with a BCP
ABN AMRO bank is a multinational bank based in Netherlands with branches in 26
countries. The business continuity department at this bank reports to the Risk Officer. The BCM
approach focuses on governance, crisis management training and testing, BCM tooling and
internal business relocation.
Deutsche Bank a German bank has a Business Continuity Plan .The BCM main role is to
respond to significant business disruptions. The program commitment is to protect the staff and
as well as the critical business functions. The bank has developed, implemented and continues to
test and maintain global business continuity management program and achieve its objectives.
Works Cited
Bessis, Joel. Risk Management in Banking. Chichester, United Kingdom: John Wiley, 2010.
Surname 16
28/7/2014.
Carrel, Philippe. The Handbook of Risk Management: Implementing a Post-Crisis Corporate
Culture. Chichester: Wiley, 2010. 28/7/2014
Drewitt, Tony. Everything You Want to Know About Business Continuity. Ely: IT Governance
Publishing, 2012. 28/7/2014
Jonna, Järveläinen. "Information Security and Business Continuity Management in
Interorganizational It Relationships." Information Management & Computer Security.
20.5 (2012): 332-349. Print.
Kasim, Randeree, Mahal Ashish, and Narwani Anjli. "A Business Continuity Management
Maturity Model for the Uae Banking Sector." Business Process Management Journal.
18.3 (2012): 472-492. Print
Snedaker, Susan. Business Continuity & Disaster Recovery for It Professionals. Burlington, MA:
Syngress, 2007. Print.
John Wiley & Sons, The Definitive Handbook of Business Continuity Management. 2011. Print.
Whelan, Jonathan, and Graham Meaden. Business Architecture: A Practical Guide. Farnham:
Ashgate Publishing Ltd, 2012. Print.