Thursday, 6 March 2014

Raising the Standard 3 - Marking Your Homework - The ISO 22301:2012 Stage 1 Audit

The day of has arrived…

Do you guys remember, back at college/university in those last few days (or even hours) before an assignment deadline? Even the most organised of us were starting to doubt their work and frantically make last minute changes while many of us fell into the “I work better under pressure” category. Well in my experience you get a kind of similar feeling when prepping for an audit. The difference from college though is that your “assignment” is marked right in front of you and they ask all sorts of tough questions along the way. Depending on the kind of person you are it can be a pretty stressful experience.

So as the big day got closer, I comforted myself by printing a small rainforest of detail and nervously await the arrival of our guest. For the time being I can do no more. So in the remaining days and hours I decided to jot down a few thoughts and feelings about my experiences so far along with some hopefully helpful tips.

Try not to take it so personally…

In my experience, auditors often have this specialist demeanour once they put on their audit-hat and they can sometimes unnerve or even upset the best of us. This is where they basically raise concerned notes of caution about possible gaps that they might have found in your work. For want of a better example it’s very much like a car mechanic that pulls bemused faces while condemning your vehicle before they’ve really even taken a proper look at it. It almost feels like they are actively trying to unsettle you as you sit eagerly awaiting a pass or fail. Nevertheless I’m 100% certain that it’s not personal when they do this but it’s more of an occupational habit. I can envisage some individuals becoming quite defensive almost immediately. I know I did initially (at one point standing out of my chair to make a point – all very dramatic) but that was because I’d worked so hard on the product. So as I say – try not to take it personally.

Auditor Subjectivity

Something that has really taken me by surprise lately is the level of subjectivity between different auditors. I naively assumed that the standard is black and white and if followed you will be fine but it really isn’t as simple as that. Auditors come from different backgrounds with different skills and they will come at your work from different angles. I personally think it’s a good thing because it keeps you on your toes and another pair of experienced eyes is always a good thing! But try to accept in advance that just because one auditor spots gaps, their list is not exhaustive. They are only human after all and they will miss things!

BC Paper Mountain Vs BC Software

At this point my desk is totally covered in a variety of different BC-related documentation…

I suppose now I think about it I could have possibly merged a few documents into one just to make the maintenance a bit more manageable. I had already done this in one of the areas by merging our BCMS Competency Model, Training Needs Analysis and Exercise Criteria all in to one easy to use (and understand) single product. Could I have also done this elsewhere in the BCMS so that our controlled documents totalled less than 10, rather than the 20+ that were printed out before me?

Some of my peers and colleagues out in the BC World support the idea and use of BC-related software. The recently BCI awarded eBRP solution fire out reason after reason on Social Media about why the use of software simply makes sense. As I look down at my small paper mountain there are certainly parts of me that agree. Although the doom-watcher that I am would still argue that you always need hardcopy documentation of all the important stuff!

Separate the Wood from the Trees – The Need for Quality Assurance

I have spent the last few months building this BCMS from scratch, with much of my time either talking or typing about the products. It’s only when I laid everything out that I could see some of my more obvious mistakes. I’m sure many BC professionals with the best intentions will try to ask/convince colleagues to double check their work but people are busy and you are precious (whether you like to admit it or not) about their products.

My boss says that I shouldn’t waste time on the formatting of the product when imminently facing an audit but I disagree for a number of reasons:

1.If you can make silly mistakes simply on product aesthetics before an auditor even gets into the content it will feed their appetite to find more gaps

2.Section 7.5.2 Part B of the standard actually states that the BCMS format must be suitable and adequate. Nice and vague but it’s still a requirement that we need to address

3.During our pre-certification audit we were advised that all documents should be more consistent looking so my approach is based on a recommendation

Just beware of course that you can lose half a day or more messing with fonts and formatting and it’s not advisable to do this 48 hours before an audit when you could be plugging up holes in the BCMS.

Stage 2 Short Sightedness

It began to dawn on me at this point that I had created, maintained and developed virtually 90% of the BCMS documentation which is great BUT following a successful Stage 1 (ever the optimist) we would have to move forward and ensure that the culture was embedded. This would mean that key employees could demonstrate that they know about business continuity, why it exists and how does it work. The challenge we face in this instance is that we could only afford a 4 week window between the two stages (which I gather is fairly unprecedented). Thankfully, in developing the product we have engaged enough people to have a general awareness of BC along with some basic training provided along the way. Nevertheless we would only have a few weeks to make sure everyone was clear. I would suggest to anyone going through a similar journey to ensure that you actively build the culture alongside your BCMS development. It might sound simple enough but I’m sure we aren’t the only ones to do this.


Something I referred to in a previous post was how surprised I was to find out just how tiring the experience of audit-readiness really was. Having given this further thought I would have to say that my fatigue was a build-up of long hours preparing documents so by the time of our pre-certification audit I was quite literally shattered. A simple case of time management, rest and prioritising is what I’ve found works like a charm. I guess I got caught up in the moment of creation. Also, looking back I definitely needed a good night’s sleep the night before and made sure that everything was arranged and ready at least a day before!

This time I was ready…

We all want certification for different things

Generally speaking any organisation that seeks to achieve certification for ISO 22301:2012 will have a genuine appetite for engaging in the process. More often than not because there is a business need or client requirement for them to achieve it. But this doesn’t mean that the BC Professional taking the lead or the Head of Department they report in to, or even the executive sponsor and the wider management team share any common value over the need for BC. We all seem to want it for different reasons. Naturally the BC manager will have a highly invested interest because of the associated skill set and credibility but senior managers may view it as tick box requirement and most executives generally just know what to say anyway so who knows what they see it as right? The challenge that our team certainly faced is bringing everyone on to the same page at the right time. Possibly more so a requirement for Stage 2 but something worth considering…

Final thoughts before Stage 1 Audit…

If I was going to be all philosophical about the process right now, my final advice to anyone going through the same journey as me is simple. In the remaining hours and days before stage 1 (or any audit in any business for that matter) just try your best to relax, look at what you can realistically achieve in the short time left and make sure you are organised and plan ahead so you aren’t running around like a head-less chicken during the final countdown! It’s generic advice I know but I do hope the above tips help as well.

1 comment:

  1. I’d say that the level of anxiety is comparable to a college student beating the deadline for a thesis, or a term project, he has to present. As for the subjectivity, I’m not sure I get what you mean, I don’t think it really matters what kind of personality the specialist will be assigned to you. Once their auditor-hat is on, they have to look at the actualities laid in front of them empirically. Anyway, I hope everything went well on that big day for you and your business. Have a good one!

    Barton Wilson @ ISA Registrar