BS25999 Part 2 is a Spe­cific­a­tion, not a Code of Prac­tice like Part 1. So what is the dif­fer­ence? Part 2 is a Spe­cific­a­tion and deals with ‘Shall’ rather than ‘Should’ as the Part 1 Code of Prac­tice does.

Titled BS 25999–2:2007 Spe­cific­a­tion for busi­ness con­tinu­ity man­age­ment and includes…

* Doc­u­ment­a­tion Require­ments
* Man­age­ment respons­ib­il­ity
* Internal BCMS Audit
* Man­age­ment review of BCMS
* BCMS Improvement

The stand­ard was pub­lished on Novem­ber 20^th 2007

How does an organ­isa­tion seek com­pli­ance with the standard?

As with most man­age­ment stand­ards the process will be rel­at­ively stand­ard­ised using the guidelines in ISO 17021

STEP 1 — Application

Apply to a cer­ti­fic­a­tion body, cer­ti­fic­a­tion bodies are organ­isa­tions that are accred­ited to certify organ­isa­tions, for example BSI or LRQA (although these two examples are not the only ones). An under­stand­ing of the scope of the BCMS will need to be made. The cer­ti­fic­a­tion body will then create a pro­posal detail­ing the number of assess­ment days required and costs etc. If the organ­isa­tion chooses to proceed the assess­ment should take place.

STEP 2 — Pre Assessment

A pre assess­ment may be used to provide a snap shot of read­i­ness for the full assess­ment. Sampling and other tech­niques may be used in this pre assess­ment. Any areas of omis­sion will be raised and an assess­ment of remedial work, should any be needed, would be made. The formal assess­ment may be delayed if it is thought that it would be unlikely that the organ­isa­tion would pass.

STEP 3 — Assessment

The formal assess­ment is then made during which all areas of the Part 2 Spe­cific­a­tion will be covered. In line with ISO17021 and in a similar way to other man­age­ment stand­ards the formal assess­ment is done in two parts.

Stage 1: This stage will cover the Busi­ness Con­tinu­ity Man­age­ment System and will examine BCMS doc­u­ment­a­tion, the man­age­ment review/audit system and eval­u­ation of read­i­ness for stage 2. Plan­ning for Stage 2 will also take place.

Stage 2: This stage exam­ines the imple­ment­a­tion of the BCMS i.e. object­ive evid­ence. It may involve inspec­tion of records, inter­views of per­son­nel and phys­ical inspections.

Any obser­va­tions or non con­form­it­ies will be form­ally recor­ded and a recom­mend­a­tion for cer­ti­fic­a­tion or not made.

STEP 4 - Recom­mend­a­tion and Award

If client achieves recom­mend­a­tion for cer­ti­fic­a­tion body this recom­mend­a­tion will be for­war­ded to the BS25999 Cer­ti­fic­a­tion Manager for final review and issuing of cer­ti­fic­ates. If the client fails the audit a cor­rect­ive action plan is usually agreed and a second audit arranged.

STEP 5 — Con­tin­ued Assessment

When the cer­ti­fic­ate has been awarded sur­veil­lance audits will be planned, typ­ic­ally at yearly inter­vals. These sur­veil­lance visits will examine the effect­ive­ness of the BCMS, man­age­ment reviews/audit, pro­gress of con­tinual improve­ment actions, change review and pos­sibly the use of the regis­tra­tion marks in pub­li­city mater­i­als etc. A full reas­sess­ment will also be carried out at longer inter­vals, usually 3 years although this will depend on both the organ­isa­tion and the cer­ti­fic­a­tion body.

What are the bene­fits of certification?

As I have men­tioned the stand­ard comes in two parts. Split­ting them is designed to make it easier to under­stand and deploy. Part 2 or the Spe­cific­a­tion sets out the minimum that an organ­isa­tion should do in order that its busi­ness con­tinu­ity systems are effective.

Imple­ment­ing BS25999 Part 1 or the Code Prac­tice will undoubtedly provide many bene­fits to an organ­isa­tion but there is no doubt that achiev­ing cer­ti­fic­a­tion will require sig­ni­fic­ant extra work, so what are the benefits?

In a word, demonstrability.

Having cer­ti­fic­a­tion to a known and accep­ted man­age­ment stand­ard such as BS25999 Part 2 avoid saying to stake­hold­ers ‘Trust Me’