Good Practice Guidelines 7.0: Preparing business continuity strategies and solutions
This month, we are releasing a series of articles highlighting some of the updates to the upcoming BCI Good Practice Guidelines (GPG) 7.0 edition, ahead of its launch on 1st November 2023.
The GPG 7.0 marks the start of a new journey where the document will be reviewed every year. This means that the GPG can better reflect the changing practices of the business continuity and resilience industry as they happen.
The new GPG consists of six professional practices (PP), split into two management practices and four technical practices. These provide a structure to be used in the development of a Business Continuity Management System (BCMS). In this article, we will focus on the revisions to Professional Practice 4 — Solutions Design.
PP4: Solutions Design
Picking up from the business continuity requirements established for the organization in PP3 (Analysis), Solutions Design is the professional practice that specifies how the organization can meet these requirements and resume operations at a pre-defined level.
Practitioners familiar with the GPG 2018 Edition will notice that the name of PP4 has been revised to Solutions Design from Design Solutions. While it is a simple change, it has been introduced as part of a principle that runs throughout the new GPG.
Indeed, during the conversations undertaken for this article series, several group leaders noted the importance of using more inclusive language and ensuring that the various PPs within the GPG Edition 7.0 provide a greater depth of guidance. As such, the group leader for PP4 outlined that the decision to change the name of the section was made to increase clarity and help those new to the industry understand the focus of the practice since feedback showed this PP as an area that could be revised to facilitate an improved understanding.
Strategies and solutions
While the title was the first change designed to improve understanding, the group decided to make more fundamental changes to the content of the section following feedback from practitioners. Therefore, the revised PP4 was specifically mapped out to carry the continuity requirements and risks approved at PP3 (Analysis) to meet all the inputs for PP5 (Enabling Solutions). The revisions to enhance this process include removing the five types of ‘design solution’ (i.e. diversification, replication, stand-by, post-incident acquisition, and doing nothing) which were part of the GPG 2018 Edition. According to the group leader, this revision was made as part of a change in vision for the professional practice which now focuses on business continuity solutions that meet the urgency of the recovery as defined by the organization, rather than selecting solutions from a defined list of options related to resource availability. Business continuity programme managers are now guided to consider solutions over time, with the solutions also contextualised for each type of resource required. This is in recognition that, for example, people strategies are conceptually very different from strategies for suppliers and outsourcing partners.
“We wanted to provide examples that could apply to any organization, as the practitioner might question how to apply the solutions in a certain timeframe. Therefore, examples have been chosen to showcase what good practice looks like and to stimulate the practitioner to adapt this to their own circumstances.”
As described above, the revised PP4 now features a number of tables that provide examples of strategies and solutions distinguished by resource type and further segmented by recovery time objective (RTO) category. The tables also include pre-requisites for the solution which need to be in place before the disruption occurs.
Mitigating risk
The group also felt that more guidance was required for mitigating unacceptable risks and single points of failure in PP4. Therefore, the PP now guides the user of the GPG through a series of nine steps that emphasise greater engagement with the organization and its top management. This recognises that business continuity professionals may not necessarily be risk mitigation experts but need to be the facilitators of these discussions.
Next article
The next article in this series will explore some of the revisions to PP5.
Download the Good Practice Guidelines Edition 7.0
More on
About the author
Kieran Matthews
Content Creator, The BCI
