Construction & Property Developer

The Challenge

The client’s objective was not solely to achieve certification to ISO 22301, but to bring BCM alive in the organisation, making it an automatic consideration within the company’s overall approach to managing risks. 

To meet ISO criteria, an effective BCMS including governance needed to be evident and proven. Senior management were on board from the outset and were keen that BCM was promoted and understood as an important tool providing a holistic view of risk exposure.

The ISO assessment is divided into two stages undertaken by an external standards authority. At Stage 1, it became clear that work still needed to be done to meet the ISO requirements. Further activities were mandatory prior to undertaking the Stage 2 assessment, including: an internal audit: tabletop exercises; reporting to management and obtaining their feedback; having a plan of action to maintain the BCMS.

The scope was clearly defined to concentrate on the specific business areas involved with the delivery of healthcare construction programmes, with the emphasis on operational and functional support activities.

The challenge for the client was not only to bring the existing BCMS up to date within the scope, but also to fulfil the additional ISO requirements. This meant bringing together many people including the chief executive, senior management and operational staff to take them through the entire BCM lifecycle within a relatively short space of time.

The Solution

Organisational changes since Teed’s first project had reduced the emphasis on BC, so after discussion with the project team, the consultant took the approach of reviewing existing information, building upon it and identifying where new information needed to be obtained. Activities included:

• Initial review of sites, projects and resources in scope, their key dependencies, the current level of preparedness and any areas of concern.
• Desktop review of existing risk/threat/hazard/impact analysis information, business continuity plans, response procedures, exercise/incident outcome reports, contractual/commercial information and any other relevant business continuity, contingency or recovery information
• Facilitation of business impact analysis (BIA) interviews with business area representatives, including a BC risk assessment
• Facilitation of BC strategy development workshops which explored the risks, requirements, and solution options for production, procurement & supply chain, and IT & cyber aspects
• Development of the BC plan & BC actions list (prioritised improvement actions)
• Design and facilitation of BC exercises, leading to the production of exercise outcome report and ongoing test/exercise roadmap
• Production and delivery of BCM framework, policy, dashboards, and status reports to satisfy governance requirements
• Preparation and support for internal audit and ISO 22301 Stage 1 and 2 assessments
• Supporting the creation of BC awareness material, intranet capability, and induction video

Tabletop exercises were held to encompass different aspects of the client’s project to validate the BC plan and meet the ISO criteria. Scenarios were focused on considering the threats related to programme dependencies; supply chain vulnerabilities; cyber security events and project site disruptions. The exercises were well attended by senior management, department heads and support representatives demonstrating the organisation’s overall commitment to BC and satisfying the project objectives.

Actions were identified during the BC project that were recognised as not having been thoroughly considered through other risk mechanisms, including enhancing the supply chain management process to reduce the dependency on key suppliers.

Feedback from exercise participants was positive as shown in these comments:

"Useful cross-department discussion highlighting what we do well and what needs to be improved, ensuring we do not work in silos."

"Realistic scenarios – as experienced by the team. Good participation and collective / comprehensive / complementary response from the site team."

The Result

From the outset, the client did not want to just achieve certification to ISO 22301 but also wanted a system that worked in the real world and to which the whole organisation could buy into. With Teed’s guidance throughout, the client has achieved both. Recognising the benefits, the client now has the confidence and ability to roll out BCM to other parts of the business, projects and programmes.

BC has not necessarily received the same prominence in the construction industry as that given by our client. Demonstrating that the additional attention to detail afforded by BC in examining the consequences of resource loss incidents to help ensure organisational resilience, should give our client a competitive advantage when bidding for new contracts.

It was clear from feedback provided by the auditors that the exercises were particularly beneficial for showing the client’s effective response to incidents and commitment to BCM. They were impressed with the level of detail captured by Teed’s consultant and documented in the exercise manual and outcome report, with the methods being far more effective and comprehensive than those observed during previous audits for other organisations.

The exercises helped our client’s BC owner to determine what other exercises would be helpful during the coming year to challenge capabilities and assumptions made, including emergency response drills and functional exercises to prove effectiveness of business contingencies/workarounds; tests to validate IT response/recovery capabilities; and tabletop exercising.

The client has the tools, methods and direction to take forward future BCM activity using internal resource, although Teed remain actively involved in supporting exercise activities and providing ad hoc guidance as our independent specialist input is valued.

Teed’s consultant provided the necessary momentum, experience and proven methods to bring this project to a successful conclusion with the client gaining certification to ISO 22301 and embedding BCM to improve resilience and preparedness.