Business Continuity Management (BCM)

A single continuity plan answers one scenario; a business needs a discipline that keeps answering as the company, its suppliers and its threats change. Business Continuity Management (BCM) is that discipline: a managed cycle of analysis, planning, exercising and improvement that keeps the capability alive. For an executive, BCM solves the problem of decay, because without a managed cycle plans go stale within a year and give false comfort. It also gives the board something auditable rather than a one-off project.

BCM is typically owned by a named manager or a resilience function, sponsored by a senior executive, and framed by a policy the board approves. Its core artefacts are the business impact analysis (BIA), risk assessments, business continuity plans (BCP) and an exercise calendar, with progress reported to the risk or audit committee. A practical rhythm looks like this: refresh the BIA annually, exercise the two most critical processes twice a year, and report gaps with owners and closure dates. A mid-size bank might run four exercises a year and track a dozen corrective actions from each cycle through to closure.

The classic misconception is treating BCM as a compliance project that ends when the documents are signed. The value sits in the cycle, not the paperwork: a company that exercises quarterly with modest plans beats one with a perfect manual it never opens. Leadership should therefore fund the rhythm, not just the writing. In the ERGP programme, a chapter of Module 1 on governance shows how the board directs and oversees the BCM cycle.