Business Continuity Management (BCM) is part of a broader ERM programme. On the one hand, the risk assessment required under the risk management process and the BIA required under the Business Continuity Management are closely related and can effectively be combined. BCM aims to identify actions that should be taken after the risk has materialized to minimize impacts, limit damages, and contain costs and losses. A successful BCM programme allows a port to respond to disruptions and realize its strategy and safeguard the interests of its key stakeholders, reputation, and value-creating activities.
The BCM lifecycle comprises the following stages:
- Analysis and design: Establish a port business continuity policy, objectives, targets, controls and procedures relevant to managing risk and improving business continuity.
- Implementation: Implement and operate the elements set out in the business continuity policy, controls, processes, and procedures. In general, bringing the BCM lifecycle to life involves identifying critical activities as part of the BIA, performing a BIA and a risk assessment, and designing and implementing a business continuity plan (BCP). Some of these steps, such as the BIA and identification of critical activities, can be carried out in tandem.
- Validation: Monitor and review performance and effectiveness against business continuity policy, objectives, and practical experience, and report the results to management for review. Determine and authorize actions for remediation and improvement.
- Continue to adjust and maintain: Maintain and adjust the BCM by taking corrective and preventive actions based on the results of the management review and reappraise the scope of the BCM and business continuity policy and objectives.
An effective BCM should be inclusive and involve port personnel from departments, e.g. finance, operations, communications, legal, IT and other key functional units. Input from key third parties relating to the port's operations should also be considered. An experienced team member with a good understanding of port organizational functions and ERM should lead the BCM and be given the operational responsibility and accountability.
The team responsible for the BCM should carry out, among other functions:
- BCM planning, development, testing and revision.
- Map and assign a cross-functional team (CFT) to each identified potential risk and threat. In doing so, clear roles, responsibilities and deliverables can be set to ensure the rapid return of operations.
- Bringing back operations to the "normal" state, as defined in the BCP. An action could, for example, be the replacement of an insolvent crane maintenance company. The team brings together subject matter experts (commonly functionally assigned) to address issues related to their expertise.
For example, in a pandemic situation, multiple teams might be identified and asked to address the following:
- Human resources and administration: (i) address the health concerns at the location of operations; (ii) monitor the situation internally (personnel) and externally (the families of the workforce); (iii) apply government/regulatory body directives; and (iv) administer basic safety protocols in response to the incident.
- Logistics/supply chain management: Monitor the situation with suppliers, contractors/service providers, hinterland and logistic providers, through frequent communications and risk management.
- Operations: Ensure enforcement of "new" regulations, protocols, and adaptations to the working environment and situation. Assess the port operational impact of the situation based on available information.
- Customer management: Clear and frequent situational awareness communications to the customer. Set up appropriate engagement forums to enable information flow.
- Legal Counsel: Contract clauses and mitigations to be understood and applied as required.
- Communications: Serve as the primary communication channel with internal and external stakeholders, e.g. government authorities, on issues relating to the port's response to the incident.
- Third parties as required, such as arrangements for vessels crew.
The following high-level BCM related aspects must, as a minimum, appear in any written documentation:
- Scope and purpose of the BCM system;
- Governance and programme leadership;
- How often are key documents, e.g. BIAs and BCPs, updated in the context of BCM;
- Trials and testing approaches; and
- Business continuity training considerations.
Once the supporting BCM documentation has been drafted, it should be presented to its senior management team for review and approval.
HINT29
- An effective BCM programme can help ports learn more about their operations. For example, the port may discover that many "hidden", or not very visible business areas and processes, also need documentation, additional capacity, or improvement.
- Broader list of stakeholders outside the port ecosystem and beyond geographical neighbours who may be key to the success of the port's BCM should be considered.