Consulting Services
We are available to provide tailored, confidential advice.
Start by building in as many Sections and Criteria as you need
Example
Details underpinning the “Managing Risks” module provided in our Gap Analysis App
Section 1 – Establish Context
Description: The strategic, organizational, and risk management context in which the rest of the process will take place is established.
1.1 – Top-level endorsement achieved
Top-level commitment and signoff endorsing the (risk management) approach is achieved. This commitment should be maintained by providing feedback as appropriate.
1.2 – Structure is mapped.
The structure (functions and processes) of the entity are mapped and understood. In the Business Continuity context, maping should be aligned with an accepted best practice framework such as the Universal Process Classification Framework for the private sector developed by the American Productivity and Quality Centre in conjunction with Arthur Andersen, IBM, DEC and Xerox. This framework provides a sound generic basis for the identification of critical functions for consideration in Business Continuity Planning. Maping should be to an appropriate level of detail depending on your context. It should define the relationship between the organization and its environment – it may identify the organization’s strengths, weaknesses, opportunities, and threats.
1.3 – Critical functions are identified
Critical functions and processes (for business continuity) are identified.
There should be a ranked hierarchy of functions grouped and filtered on the basis of those needed first, if not immediately, through to those which are discretionary.
1.4 – Key stakeholders are identified & differentiated.
Consideration may be given to those with whom close, confidential work needs to be done; those who have needs to be supported and informed; and those who (only) need to be made aware in the planning process.
Groups are defined as “those which have a number of things in common” – they include any shared association relevant to the risk management context. These include the people in the area of impact, employees and their families, suppliers, vendors, and other parties with a stake in the entity and continuity of its operations, providers of social protection (such as planning authorities and emergency service organizations). Differentiation should be conducted in a discrete and respectful way with a view to identifying those with different responsibilities, rights and needs.
1.5 – Risk assessment criteria are established.
To what extent are risk assessment criteria established early in any given process. In a systematic risk management approach, it is important that risk evaluation criteria are established early. To what extent are decisions concerning prioritization made based on a consideration of a range of technical, financial, legal, social, humanitarian or other criteria? Impact considerations may concentrate on one area only or on several possible areas of impact. It is important to focus on criteria important to the entity – this will define the way information is analyzed and decisions are made. Criteria appropriate to the entity’s context may incorporate any of following:
People; Costs both direct and indirect – such as loss of production capability; social issues reflecting high-level of community concern (sensitivity such as imposed risk, dread, equity, and involvement of culturally cherished assets). Legal criteria related to “serious” category under Environment Protection Acts / Disaster Declarations Legislation met; Loss Containment where release (of energy or toxins) off-site may have negative effect; Ecosystems and other proximal sensitive receiving environments. Asset and resource base of the organization, including personnel; Revenue and entitlements; Performance; Timing and schedule of activities; intangibles such as reputation, goodwill; or organizational behavior. To what extent are approaches to establishing likelihood or probability thresholds considered and resolved? The issues of uncertainty associated with complex, rare, extreme events make the establishment of an agreed approach problematic given probability is derived from the mathematics of closed sets. The criteria should be corporately endorsed. To what extent are they developed through an agreed, corporately endorsed process; and then signed off on.
Examples of Gap Analysis Frameworks
Each of the examples below can provide “grist for your mill”
– data to cut and paste into your Gap Analysis app
When using our Gap Analysis app to review your Business Continuity Management Framework you can tailor, edit, then cut and paste from the pdf below which uses a 7 Section Framework with five criteria in each section.
The Universal Process Framework allows organizations to map their processes, identify gaps, and benchmark performance against industry standards using these common criteria, driving focused improvements in process maturity and overall business performance.
When using our Gap Analysis app to review your Business Process Framework you can tailor, edit, then cut and paste from the pdf below which uses an eight Section Framework with five criteria in each section.
John Salter Consulting Services 