|
by Judy Bell, Editorial Advisory Board Chairperson 1996-2007
The business continuity industry is evolving to its next level of maturity through this discussion of ERM and standards. To become a true “profession”, we must provide value to the executive level. Although we have struggled in the past to define our value through ROI, we have finally discovered that our value is better defined through measuring it more globally from an enterprise level. Identifying all risk components within a business and using them collectively as a factor for all executive decisions is where our true value lies.
Combining all of the risk components, and measuring them through a common matrix will provide a far more comprehensive perspective for every company. Those who choose to evaluate risks separately are under-utilizing their own resources that can provide both a competitive and financial advantage. Publicly traded companies will see increased pressure from their Boards and stockholders to disclose their risks going forward, and privately-owned businesses will soon realize that making decisions without including an all-risk approach can be costly.
As for standards, the hard work that has produced NFPA 1600, ASIS Guidelines, and BS25999, as well as other international standards, has created a collective base that will serve as the right foundation for an international standard to emerge. There is no reason to wait, though, for that ultimate standard. We can use the ones that are most applicable to each company and begin now to ensure that our programs include at least the minimum requirements.
Combining the right disciplines and formalizing internal processes that address all elements of an enterprise risk management program is the first step. Using the existing standards to guide the framework of the program just makes good common sense. |
