BS 25999 – The Standard for Business Continuity Planning and Risk Assessment


Hide Menu

The British Standards Institution (BSI), which is a non-profit organization that produces standards in the U.K., had brought forth the BS 25999 in 2003 to replace the Publicly Available Specification (PAS) 56. Though both standards are used in Business Continuity Management, the main purpose of creating them is risk assessment.

The Purpose of BS 25999

Basically, the BS 25999 was developed to help organizations counter the following problems which reduce its efficiency:

  • Service disruptions
  • Delays in tending to clients’ requests and queries
  • Processing transaction in an untimely manner
  • Inability to jump back and resume work after a risk or disaster that had affected the organization’s processes

With the help of the BS 25999, even natural disasters and terrorist attacks won’t be able to affect the business operations of the organization implementing this best practice.

The Contents of the BS 25999

The BS 25999 is divided into two parts, each of which has its own contents. The first part is the BS 25999 – 1. This is a Code of Practice for Business Continuity Management. Within it, the following sections have been specified:

Section 1: Scope and Applicability – This part describes the general framework of the standard. Organizations will need to tailor this based on their needs.

Section 2: Terms and Definitions – This section defines the terms used throughout the standard.

Section 3: Overview of Business Continuity Management – This section describes the processes of the standard and how it is related to risk management.

Section 4: The Business Continuity Management Policy – This part focuses on highlighting the need of having and implementing a clear policy.

Section 5: BCM Program Management – This part defines the approach to be used while handling the BCM process.

Section 6: Understanding the Organization – This section emphasizes on the need to understand the organization’s processes, resources, threats and risks to apply the right business continuity strategy.

Section 7: Determining BCM Strategies – This sector follows understanding the organization, and defines the right business continuity strategies.

Section 8: Developing and implementing a BCM response – This section defines the tactics needed to deliver business continuity, such as incident management structures.

Section 9: Exercising, maintenance, audit, and self-assessment of the BCM culture – This section defines a way to test the effectiveness of BCM, and ensure that it continues to meet a company’s aims.

Section 10: Embedding BCM into the organization culture – This sector explains how BCM should be implemented in every aspect of the company’s management.

As for BS 25999-2, this is a Specification for a Management Scheme. Launched in 2007, the following sections are included in this practice:

Section 1: Scope – This part defines the scope of BS 25999, and the requirements of a business continuity management system (BCMS).

Section 2: Terms and definitions – This part defines the terms used in the standard.

Section 3: Planning the business continuity management system – From this point onwards, the standard Plan-Do-Check-Act model is followed. This section plans the BCMS, how to initiate it, and how to add it to the organization.

Section 4: Implementing and operating the BCMS – This section continues by providing ways of implementing the contents of the previous section.

Section 5: Monitoring and reviewing the BCMS – This sector highlights the need to monitor the BCMS and perform audits and management reviews.

Section 6: Maintaining and improving the BCMS – This part shines the light on the need to make sure that the BCMS is maintained and improved regularly.

Risk Assessment


Risk assessment is a process that evaluates the negative impact of associated risk. There is risk involved in every form of business, whether it is health related or financial business. Therefore, managers must implement certain best practices to assist them in controlling negative consequences of risks.

Definition of Risk Assessment

It is defined as an important process in business management, aimed at protecting the business and people related to it. Risk assessment is an important aspect of risk management.

Business managers and investors use risk assessment to measure the profit that will result from a particular investment. This helps in controlling financial losses to the business. In order to succeed with this, managers have to ensure compliance best practices with laws governing the business.

Importance of Risk Assessment

Risk assessment helps with implementing controls to ensure risk management. Once managers assess risk, they can foresee the negative impact of risk on assets and people related to the business. This allows them to implement necessary strategies (best practices) to mitigate and control risk.

Examples of Risk Assessment

When a lender receives a request from a creditor, there are certain protocols (best practices) that must be followed. The lender must make sure that the money lent returns on time. This means that the credit history of the person in question has to be assessed. This will tell the lender whether the applicant will return the money or not. Based on the assessment, the lender will then decide on how much interest to charge to ensure risk management. If the lender doesn’t think the creditor will pay off on time, he/she might as well decide not to give the loan at all.

Another example is risk assessment in a health care facility. Medical practitioners have to assess the risk associated with diseases. There are some diseases that are contagious and transmittable via aerosols. This means that people around the sufferer are at risk. To control this risk doctors must have a setup where people are safe and the spread of disease is controlled. This means medical practitioners have implement measures (best practices) to protect their employees and customers. This is compliance with risk management.

In simple terms, risk assessment means evaluating the extent of damage or threat imposed by failure to impose controls. Hazards must be identified to be able to decide on what measures will be appropriate.

How to Assess Risk?

Regardless of what form of business institution it is, there are five standard strategies that managers must use. These are:

  1. Identify hazards/risks
  2. Conclude where the impact of the hazard will be (e.g. employees, customers, assets)
  3. Evaluate the impact of the risk and precautions or backups needed
  4. Document the conclusion and implement control measures
  5. Review the assessment based on the outcome and document updates if necessary

There are best practices to think about when risk assessment is being conducted. First of all, define the threat or hazard. This can be ANYTHING that harms the business, employees and customers. Secondly, understand that risk can never be eliminated, but mitigated and controlled.

In this section we will discuss:


Contact Links
Copyright 2009 Best-Practice.com. All Rights Reserved.