Starting Your BC Journey: Building the Foundations of a BCMS

In the architectural design of a Business Continuity Management System (BCMS), sequence is everything. Professional Practice 1 (PP1) of the BCI Good Practice Guidelines (GPG 7.0) outlines how a BCMS should be designed and implemented as a programme. It is entirely about establishing the framework, leadership alignment, and boundaries before attempting technical, operational work.

A common industry misconception persists that a high-level policy should always be the very first document drafted. While GPG 7.0 notes that scope and policy are formally independent, starting with policy before defining a baseline scope is practically putting the cart before the horse. To build a sustainable framework, an organisation should establish its initial boundaries alongside its strategic direction.

💡 New to Business Continuity?
If terms like BCMS, MBCO, or PP1 are new to you, you might find our Business Continuity Glossary useful as a quick reference while reading this guide.

1. Drawing the Initial Boundaries (Defining the Scope)

Defining the initial scope establishes the "playing field" for organisational resilience. Without clear boundaries, the subsequent Business Impact Analysis (BIA) in PP3 becomes an unmanageable infinite loop. Practitioners who fail to define scope early often attempt to assess every minor task across the enterprise, leading to "analysis paralysis" and program failure.

Best practice advocates for starting small by focusing initially on prioritised, high-value operational areas.

The "Initial vs. Post-BIA" Scope Dynamic

In accordance with international standards like ISO 22301, organisations must document and justify any exclusions from the BCMS (such as non-time-critical corporate functions).

Crucially, the initial scope is not locked in stone forever:

• The Initial Scope: Acts as a working baseline to boundary early analytical work.
• The Refined Scope: Once the BIA (PP3) is complete, you will uncover hidden dependencies and recovery timeframes. The scope is then revisited, updated, and re-approved by leadership to reflect true operational reality.

2. Conducting the Initial Gap Analysis & Interim Planning

Where does a Gap Analysis fit into this early phase? Right here at the start of PP1.

Before drafting strategy or policy, the BC Professional must evaluate the organisation’s current state against recognised standards like GPG 7.0 or ISO 22301.

• What already exists? (e.g., informal disaster recovery plans, local call trees, crisis response habits).
• What is missing? (e.g., formal policy, governance structure, systematic BIA methodology).

Pragmatic Step: Interim Crisis Plans

GPG 7.0 explicitly highlights that when establishing a BCMS for the first time, an organisation may need to put an interim crisis management plan in place. Supported by internal subject matter experts, this provides immediate operational protection while the full BCMS is being architected.

3. Setting the Compass (Establishing the BC Policy)

The Business Continuity Policy is the formal expression of top management’s intent and direction. It provides the strategic mandate for all subsequent continuity activities, focusing strictly on what the organisation intends to achieve, rather than operational hows.

The Real-World Authorship Reality

GPG 7.0 notes that the policy is issued by top management with support from BC professionals. In real-world practice, the BC Professional will draft the policy (along with core BC documentation) and bring it to executive leadership for debate, refinement, and formal sign-off. Executive sign-off transforms your draft into an authoritative organisational mandate.

Key Components of the Policy:

• Statement of Purpose and Value: Why resilience matters to the organisation.
• Commitment to Continual Improvement: Acknowledging that resilience evolves over time.
• Compliance Expectations: Setting clear standards for how workers interact with the BCMS.
• Objective-Setting Framework: Principles for setting metrics like Minimum Business Continuity Objectives (MBCOs).

Publishing and Communication

A policy locked in a folder is useless. Once signed off, the BC Policy must be published on the company intranet or central portal and made accessible to workers, auditors, and key stakeholders.

4. Aligning Leadership (Establishing Governance)

Governance provides the BCMS with structural support, ensuring long-term accountability and avoiding single points of failure.

Core Roles in PP1 (GPG 7.0 Table 2):

• Top Management / Executive Sponsor: Accountable for the BCMS, providing resources, signing off on scope/policy, and leading by example.
• Steering Group / Committee: A multi-disciplinary team of subject matter experts (IT, HR, Facilities, Risk, Legal) overseeing development, removing roadblocks, and advising leadership.
• BC Professional: The coordinator and facilitator who drives methodology, drafts documentation templates, and maintains objective oversight.
• Departmental Representatives & Plan Owners: Operational leads who collect information, complete assessments, and maintain departmental procedures.

Summary: The PP1 Foundation & What Comes Next

By following Professional Practice 1—Gap Analysis → Initial Scope → Strategic Policy → Governance Framework—you ensure that your BCMS is grounded in practical reality and backed by executive authority.

However, mandating compliance through policy and governance alone does not guarantee a fit-for-purpose BCMS. Documenting a framework is only half the battle; people must actually believe in it.

Now that the structural foundation is built, the very next step in your BC journey is PP2: Embracing Business Continuity. This is where you move from a top-down mandate ("head") to driving a true cultural shift ("heart")—ensuring that personnel across every level understand the value of resilience and actively embed continuity into day-to-day operations.