Good Practice Guidelines 7.0: Validating the BCMS
This month, we are releasing a series of articles highlighting some of the updates to the BCI Good Practice Guidelines (GPG) Edition 7.0, which was launched on 1st November.
The GPG Edition 7.0 marks the start of a new journey where the document will be reviewed every year. This means that the GPG can better reflect the changing practices of the business continuity (BC) and resilience industry as they happen.
The new GPG consists of six professional practices (PP), split into two management practices and four technical practices. These provide a structure to be used in the development of a Business Continuity Management System (BCMS). In this article, we will be focusing on the revisions to Professional Practice 6 — Validation.
PP6: Validation
Validation is the PP that confirms if the BCMS, already established through the previous PPs, meets the objectives set out in the organization’s policy. It also assists the organization in embracing business continuity through effective and efficient awareness, exercising, maintenance, and review programmes.
The group leader for the PP explains that the Validation PP brings together all the PPs to test the components of the BCMS. “One can do the best BCMS planning, analysis, design, and implementation of solutions, but validation is the true test of an established BCMS,” says the leader.
The objectives of the revised PP6:
- Validating organization-wide awareness of business continuity objectives
- Validating and improving responsibilities, capabilities and competencies of response and recovery team
- Providing insights to validate the efficacy of resources deployed to deal with incidents.
The outcomes of using PP6:
- Developing methodologies to measure the quality and effectiveness of the BCMS and business continuity capability.
- Developing methodologies to measure individual and team cohesiveness.
- Building a culture of learning in order to improve competencies and behaviour to embrace business continuity.
- Helping to evaluate the continued suitability, adequacy, and effectiveness of the established BCMS.
- Identifying strengths and areas of improvement within the BCMS with a constructive and positive mindset.
Revisions to PP6
The leader also details some specific changes to PP6 in GPG Edition 7.0, which now includes an improved introductory section that lists the advantages of validation activities.
PP6 highlights the importance of exercises for the workforce which are used to improve an organization’s business continuity culture and enable it to embrace business continuity. To further enhance this, the revised considerations for exercises now also include supplier continuity arrangements (especially key suppliers on whom the organization is dependent) and the option of a "virtual exercise" has been added to the methodology, where exercising can be carried out remotely if some/all parties cannot be present. This can increase participation where geographic limitations, participant availability, as well as physical and safety limitations are a concern.
A post-incident review has also been added as part of the PP’s methods and techniques for the reviewing process. This demonstrates the importance of response and recovery efforts following an incident, as well as the need to evaluate these efforts to determine the extent to which the plans, capabilities, and competencies met the business continuity requirements.
Finally, the group leader noted that these revisions to PP6 were based on feedback from business continuity practitioners worldwide, the evolving nature of the business continuity discipline, and international best practices and standards. The changes were also made to reflect the changes in other PPs and to bring them all together with up-to-date and practical guidance, along with process flow diagrams and examples to demonstrate the concepts.
“[When developing PP6] the focus was on the post-pandemic world and other disruptions observed worldwide. It also considered new ways of managing business continuity with a dispersed workforce, as well as conducting validation activities given these challenges,” says the leader.
Download the Good Practice Guidelines Edition 7.0
More on
