Friday, 7 February 2014

ISO 22301:2012 Raising the Standard 2: The Informal Gap Analysis…

As mentioned in a previous post, my organisation decided that in anticipation of the Stage 1 Audit (document check), it would be a really good idea to have an informal gap analysis from an external auditor on all things business continuity…

Now for those of you who haven’t experienced this yet it’s basically where you have the equivalent of the Garage Manager/ Senior Mechanic pre-check your car for faults that if identified you can realistically fix before its annual inspection/MOT. This gives you less chance of finding major non-conformities during the audit and ultimately failing.

A Self Validating BC Experience

From a personal point of view this was a really exciting career development opportunity (much to the hilarity of my colleagues who think I’m quite bonkers for enjoying the process!). I had already been tasked over the last few months to independently build a BCMS framework from scratch and make it comply with a standard which was completely new to my organisation. But now a genuine ISO expert was going to come in to our office and spend the entire day marking my homework!

I was delighted to have the chance to validate what I believe to be the right approach. Looking back it has given me a greater understanding of the gap between my knowledge gained in recent years and the required standard.

The Day of Gap Analysis

For those of you choosing to invite auditors in at any stage prior to certification you will almost certainly require a sort of chaperone. This individual will act as a point of reference and contact for the duration of the audit. For instance, if the auditor request further evidence or to get something printed or even finding the canteen for lunch!

My advice to my fellow junior professionals is to jump at the chance to fulfil this role! Prior to working on this contract I had previously undertaken a similar activity for an ISO 22301:2012 Stage 1 Audit and it taught me more than any book, lecture or experience. There were many light bulb moments as I began to understand the auditor’s process, what they were looking for and most importantly how they expected it to be packaged.

The auditor arrived bright and early and received a brief on the business and how it works to paint the picture before looking at any documents. We had received an agenda for the day containing what they would be looking at and when. They left it to us to decide on how we presented our evidence but they were quite flexible and appeared to be happy to work from hard copy, soft copy or from a smart screen projector.

By about mid-morning the set-up, small talk and overview was done…the Auditor then moved in to a higher gear and ploughed through every document at an impressive pace but remaining incredibly meticulous. It is during this stage that I decided I would note down some of my thoughts which are summarised below:

Audit Intensity

For those of you who haven’t gone through this experience yet, I personally found it quite intense and tiring. For the Gap Analysis you are talking about 8 hours of providing evidence to someone who knew exactly what they were looking for. No matter how ready you think you are…there will be gaps.

Positive Marking Experience

Perhaps through a lack of exposure I simply assumed that the auditors were coming in to find gaps to ultimately fail us. This is certainly not the case. Our Gap Analysis professional was friendly, supportive and wanted to help us identify improvements in advance so we can be in the best position possible prior to audit. It might not seem like it but they are on our side.

The Audit Come-Down

After the long hours, stress and hard work in anticipation of the auditor’s arrival, followed by the intensity of the 8-hour gap analysis, I felt it was quite challenging to jump straight back on the horse and begin to fix things (especially with only 4 weeks to go before our Stage 1 Audit). The motivation was certainly there but I had spent so long working towards what I believed was the closest adherence to the standard as possible.

Ultimately it was never going to be the complete and the perfectly finished article and a degree or re-engineering was always going to be required and it doesn’t happen instantaneously. So expect it but remain positive! I will let you know how I get on with the re-work!

Final Thoughts…

I suppose the last thing I can take from our first Gap Analysis for ISO 22301: 2012 is you definitely need a good night’s sleep the night before!

The auditor was impressive. They could ask questions, read and write a report at the same time all the while running through the checks. At the end of the day they provided us with a really useful road map of gaps to address which were divided up across the team to complete in due course.

We are now in the midst of a 4-week window prior to the arrival of our Stage 1 Auditors. We must fill all identified gaps to give us the best chance possible of passing first time around. I look forward to telling you all about what happens at Stage 1 but for now…what a great experience.

1 comment:

  1. It’s nice to know that you conducted an anticipated inspection before the auditors arrived. At least, you would know beforehand if there are some loopholes in your business structure. It would give you more time to find solution before the actual auditors come into your office. Good job!

    Barton Wilson @ International Standards Authority, Inc.