With several standards being developed and some areas overlapping, compliance requires significant effort and is mandatory. If compliance is costly, then we need to think of the cost of non-compliance, which is more costly.
This article focuses on business continuity compliance but can be applied equally to other areas as well, and is being produced after various struggles faced with compliance, across different industries and geographies.
So what’s the problem? So many clauses from different standards to comply! Really not! The same actions are being written in different terms and different levels in different standards. I have not come across a situation where different standards state conflicting actions.
ISO 22301:2012 Societal Security - Business Continuity Management Systems – Requirements - is the main business continuity standard, but there are other related standards the business continuity section may have to comply with, depending on the organisation.
Let’s leave the national and regulatory standards pertaining to industries for a moment and just look at ISO standards listed below that may have some relevance with business continuity. These include requirements as well as guidelines and those that are under development.
- ISO 27001:2013 Information Technology - Security Techniques - Information Security Management Systems - Requirements
- ISO 31000:2009 Risk Management – Principles And Guidelines
- ISO 27031:2011 Information Technology - Security Techniques - Guidelines For Information And Communications Technology Readiness For Business Continuity
- ISO/TS 22317 Societal Security - Business Continuity Management Systems - Guidelines For Business Impact Analysis (BIA)
- ISO/IEC 20000-1:2011 Information Technology - Service Management - Part 1: Service Management System Requirements
- ISO/PRF TS 22318 Societal Security - Business Continuity Management Systems - Guidelines For Supply Chain Continuity
- ISO/CD 45001 Occupational Health And Safety Management Systems - Requirements
PAS 99:2012 Integrated Management Systems has been produced to assist organizations in achieving benefits from integrating the common requirements of all management system standards and specifications and managing these requirements effectively.
PAS 99 helps to
- audit several management systems at a time to save money and resources
- meet all related management systems standard requirements with one set of policies and procedures.
- improve overall efficiency by eliminating duplication of tasks
- continually improve across all management systems
- define roles and responsibilities to meet common objectives
In line with PAS 99 whether certified or not to a particular standard, organizations should look at mapping and merging the management system tasks as well as compliance assessment to be efficient and effective.
A GRC (governance, risk, and compliance) or compliance applications that are in the market, are good tools to be used for this purpose. But if it is unaffordable, an Excel spreadsheet will partially help to solve the problem, perhaps with a RACI matrix. If a document control system is being used that can be linked to document numbers and will be convenient. Some business continuity software have compliance as a module with ISO 22301 and other national standards prepopulated and can be used as well.
In a previous financial organization I worked for which was certified for ISO 22301 and ISO 27001. By different certifying bodies, the business units were complaining about too many audits. To address this problem and achieve efficiency, I merged the audits with one certification body and changed the certification dates to be aligned. I also arranged the certification audits into one agenda by sharing topics so that there was significant saving of time from the auditor as well as the business units. For example, the areas in human resources, training, facilities, internal audit, and management review are the same for majority of the audit clauses/functions. From an operational point, I had also achieved savings and consolidation in line with PAS 99 including in-risk assessments, asset registers, impact assessments, internal audits, etc., by integrating business continuity with information security. The central bank required an annual report on business continuity assessment, and I mapped the central bank requirements to the ISO 22301 standard (and during previous BS 25999) as well as used the same internal auditor to provide a gap assessment for both standards, saving time and cost.
Table 1 (above) is an example of a few clauses written differently in different standards but mapped to a few actions. This is a very simplified format and the tests, level of compliance, gaps, maturity level, etc. are not included. The focus here is mapping different standards or framework to a manageable requirement or action and eliminating duplication.
Various international and local standards are depicted. Each organization should look at its context and the governing regulations to identify and map them to have an easy way of compliance with less effort. It would probably take one time to read and map them to actions (if not already done), but afterward it will be easy. In essence in Table 1 there are only six actions that are required to be performed and have to be monitored regularly. However, these six actions represent six clauses in five standards, which collectively represent 16 actions (marked with “X”) for compliance. This has a many-to-many relationship where many actions are required for one clause, and one action may be relevant for many clauses. From an operational perspective, the outcome is that only the six actions need to be followed up and the clauses of different standards need seldom reference.
It is suggested that professionals from different organizations of the same industry and geography share this task. Business continuity professionals (or any others such as information security) of a particular country within a particular industry may share this task and map them to the standards depending on which standards they are to comply mandatorily and voluntarily. There will be no sharing of confidential information in this process, as only public information is being mapped and even professionals working for competitors can get together in this task.
Conclusion
Compliance to standards are mandatory, and the cost of non-compliance is more than compliance. Compliance with several standards and regulations may not be a huge burden, as many think. Mapping various standards and interpreting them to easily manageable actions would be helpful and eliminate duplication and ambiguity. Professionals from the same industry and geography could share this mapping exercise for mutual benefit. Suitable tools including GRC and compliance applications, may be used to assign tasks, track progress and map clauses, and compliance.
Samuel Shanthan, B.Sc.Eng. (Hons), MBCI, CISA, CIPM, has more than 15 years of business continuity and information security related experience including in large multinationals, big fours, and Fortune 500s. He has managed business continuity setups in Europe, Asia, Africa, Middle East, and Australia. While being head of BCM in a large banking group, he implemented and certified it as the second bank in the world for ISO 22301. Currently he works as a consultant in the public sector in Melbourne and is running his part-time consulting practice Grace Risk Advisors. He can be reached at Samuel.Shanthan@gmail.com.
