PP2: Embracing Business Continuity

CBCI Study Series · Professional Practice 2 of 6

BCI Good Practice Guidelines (GPG 7.0)

Shifting from "Compliance" to "Culture": A Study Guide to BCI PP2 (Embracing Business Continuity)

Introduction: My Journey from 'Head' to 'Heart'

In my previous post, PP1: Establishing a BCMS (which explored scope, policy, and governance), it all made perfect logical sense on paper. But as I dug deeper into my studies for the BCI exam, I hit a fascinating realisation. You can design the most technically perfect, standard-aligned BCMS in the world, but if the people inside the organisation don’t actually care about it, the entire system is just expensive wallpaper. Under real-world pressure, a plan is only as good as the people executing it.

This is the precise bridge where we move from PP1 (Establishing) to PP2 (Embracing Business Continuity). This management practice is all about shifting the discipline from a rational, policy-driven corporate mandate ("the head") to an emotional, culture-driven belief ("the heart"). In my own study journey, realising that business continuity is as much about organisational psychology as it is about technical planning was a massive "aha!" moment. Here are my core, exam-focused study notes to help you master how we analyse, shape, and measure resilience culture to ace your CBCI exam.

In the 2018 edition of the Good Practice Guidelines, PP2 was titled "Embedding Business Continuity." In GPG Edition 7.0, this has officially evolved into "Embracing Business Continuity". The BCI exam heavily tests your understanding of this shift!

• Embedding (The "Head"): Represents the rational, systematic process of integrating BC practices into business-as-usual (BAU). It is about scheduling tasks, allocating roles, and confirming adherence to policies.
• Embracing (The "Heart"): Represents the emotional shift to a strong business continuity culture. It occurs when the workforce has a deep, empathetic understanding of why the organisation needs protection, leading to personal beliefs and behaviours where continuity forms part of the operational fabric.

1. Understanding Organisational Culture (ISO 22316 Alignment)

Before you can influence or improve an organisation’s culture, you must systematically observe and understand it. The GPG aligns closely with ISO 22316 (Organisational Resilience), defining culture as the collective values, attitudes, and behaviours of an organisation. To analyse your organisation’s baseline culture, you must focus on four key steps:

• Identify Interested Parties: Map out risk, audit, and senior business unit leads, along with existing champions.
• Engage with Emotional Intelligence: Determine the most effective way to engage with stakeholders, aligning your communication with their key priorities and styles.
• Identify Core Information Sources: Study annual reports, mission statements, corporate newsletters, and social media channels to understand the official stated values and language.
• Analyse Past Incident Responses: Examine how the organisation reacted to previous real-world disruptions. This provides the most honest baseline of the actual culture under pressure.

2. Why "Embedding" Alone Falls Short

Too often, organisations confuse compliance with capability. GPG Table 3 highlights exactly why quality suffers when business continuity is merely "embedded" (mandatory policy compliance) but not truly "embraced" (emotional commitment):

3. High-Level Indicators of an Embraced BC Culture

For your exam, you need to identify the distinct indicators that prove senior and executive management have successfully embraced the program, moving beyond formal signatures on policies:

• Commitment: Top management actively addresses BC as a clear priority, setting an active, visible tone for the rest of the workforce.
• Communication: Executive leadership establishes an open environment where employees feel safe and comfortable escalating potential resilience or continuity concerns.
• Support: Leadership provides visible support for BC learning and awareness initiatives across the entire workforce, not just technical recovery teams.
• Engagement: The workforce is actively engaged in BC activities because leadership prioritises and values their participation.
• Alignment & Strategic Planning: Business continuity actively underpins corporate objectives and is integrated into key business decisions, such as procurement, supply chain choices, and facility planning.

4. Practical Methods to Build and Shape the Culture

To bridge the gap between compliance and true commitment, the BC Professional must use a blend of approaches tailored to different learning styles and remote work constraints:

• Active Executive Sponsorship: Establish quarterly formal briefings with senior management to report progress, highlight real-world risks, and address program roadblocks.
• Build Relationships & Gain Allies: Show stakeholders how BC directly protects what matters to them (e.g., preventing missed deadlines or protecting their reputation) to convert them into allies.
• Cross-Disciplinary Collaboration: Break down silos. Work closely with risk management, information security, facilities, health and safety, and human resources to present a unified resilience approach.
• Program Marketing: Bring BC to life. Use simple, easily digestible materials—such as a resilience blog, intranet videos, running competitive games, or participating in Business Continuity Awareness Week (BCAW).
• Establishing Targeted Training: Provide bespoke training for different audiences, including dedicated induction awareness for new starters, technical training for response roles (such as CBCI), and short educational overviews before BIA workshops to demystify the process.

5. How to Measure Culture (The Lead Indicators)

A common misconception is that organisational culture is intangible and cannot be measured. GPG Edition 7.0 outlines clear, objective metrics that act as "lead indicators" for your resilience capability:

• Behavioural Consistency: Assess team behaviour under pressure by facilitating simulation exercises that test consistent decision-making (e.g., always putting people safety first).
• Training Hours & Awareness: Track the cumulative hours of BC training completed across the organisation and analyse completion rates of digital e-learning courses.
• Culture Index & Pledge: Implement a periodic "BC Pledge" where personnel actively sign off on their commitment to continuity goals during reviews or onboarding.
• Unstructured Observations: Attend routine, non-BC departmental planning meetings and observe if continuity risks are naturally considered (e.g., asking what happens if a key supplier fails).
• Document Integrity: Audit a percentage of corporate decision papers to check if they proactively include a standard business continuity component before sign-off.
• BC Idea Count: Measure employee engagement by tracking the volume of resilience suggestions or "near-miss" reports submitted to suggestion boxes or digital portals.

Test Your Knowledge: BCI Exam Prep PP2 Quiz

Question 1

According to the BCI Good Practice Guidelines Edition 7.0, what is the primary distinction between "Embedding" and "Embracing" Business Continuity?

• A) Embedding is a management practice, whereas Embracing is a technical practice.
• B) Embedding focuses on integrating BC into business as usual (BAU) processes, whereas Embracing shifts the focus to cultural mandates driven by personal beliefs.
• C) Embedding is a legal requirement, whereas Embracing is entirely voluntary.
• D) Embedding applies strictly to internal staff, whereas Embracing applies only to third-party suppliers.

Question 2

An organisation has a signed Business Continuity Policy and holds annual BIA workshops. However, during real-world incidents, plans consistently fail because departmental representatives do not recognise operational changes as triggers for plan updates. According to BCI Table 3, this is a symptom of which cultural issue?

• A) Lack of a designated BC Professional
• B) Low budget allocation for ICT Disaster Recovery
• C) Not understanding the true benefit of Business Continuity
• D) Failure to use external project management methodologies

Question 3

Which of the following methods for measuring Business Continuity culture specifically seeks to verify behavioral consistency by evaluating how response teams prioritise actions (such as giving people safety utmost priority) under pressure?

• A) Culture Index
• B) Behavioural Consistency Simulation Exercises
• C) Document Integrity Auditing
• D) BC Idea Count Tracker

Question 4

To ensure an effective and scalable awareness and education strategy, the BC GPG suggests that the BC Professional should collaborate with which departmental function specifically to market the program through established internal channels?

• A) The External Legal Counsel
• B) The Corporate Communications / People and Culture Department
• C) The Procurement and Supplier Management Team
• D) The Finance Committee

Question 5

A Business Continuity Professional conducts a short, five-minute introductory session on the "why" and "how" of the BIA at the start of a departmental workshop. Under GPG PP2, what is the primary purpose of this activity?

• A) To formally audit the department's compliance before the session begins.
• B) To fulfil a mandatory legal requirement for workshop facilitation.
• C) To establish a targeted training and awareness initiative that helps participants understand the value of BC and embrace the BIA process.
• D) To bypass the need for conducting a future annual exercise program.

What's Next? Moving into Technical Analysis

Once you have established your BCMS structure (PP1) and built a supportive, engaged, and empathetic organisational culture (PP2), your program has the robust foundation it needs to thrive. But how do you determine exactly which services need protecting first, and how fast they must be recovered? For that, we enter the technical practices. In my next post, we will tackle the absolute core of the BCI technical syllabus: Professional Practice 3 (PP3): Analysis. We will dissect the three types of Business Impact Analysis (BIA), learn how to define RTOs and MTPDs without pulling your hair out, and map out the risk assessment techniques needed to expose single points of failure. Stay tuned, and keep embracing resilience!

Next in the series: PP3 — Analysis

Disclaimer: These are independent study notes compiled to assist candidates preparing for the Certificate of the Business Continuity Institute (CBCI) examination. This content is not officially endorsed, sponsored, or affiliated with the Business Continuity Institute (BCI). The official body of knowledge is the BCI Good Practice Guidelines (GPG) Edition 7.0, which can be sourced directly from the BCI.