Myths are an integral part of our society – and that also includes companies. Yet they can quickly become dangerous, especially if they prove to be false or are misunderstood. In the following, we uncover five major BCM myths and get to the bottom of them.

Myth 1: If you have mastered one crisis, you will survive the next.

If the Business Continuity Management System (BCMS) has already proven itself in an emergency, confidence in the company's own structures and processes grows. There is a reason for this, after all, many things that appear effective in theory turn out to be inefficient or even counterproductive in practice. Nevertheless, every crisis is different. That is why BCM and corporate managers should not lull themselves into a false sense of security. Contingency plans must be constantly updated and adapted as necessary. It is advisable to focus on the emergency scenarios with the highest probability of occurrence and the greatest potential for damage, i.e., with the greatest risk.

Myth 2: Real experts do not need documentation.

Comprehensive and consistent written documentation of all essential structures and processes is one of the fundamental elements of a professional BCMS. After all, if these are not adequately documented, not only is there no evidence for the next audit, but there is also no basis for implementing guidelines and policies. Regardless of the BCM team's experience: written documentation is essential and should include not only the contingency plans, but also the organizational structure and the entire BCM process.

Myth 3: BCM documentation is good enough if it meets audit requirements.

Regular audits should ensure that the BCMS meets the requirements of the legislator, but also those of the company. If a BCMS has proven itself in an audit, audit evidence testifies to compliance and adherence to minimum standards – no more and no less. However, this does not mean that there is no potential for improvements. After all, in order to ensure the effectiveness of the BCMS, processes and structures must be regularly reviewed and any potential for improvement must be exploited. This applies in particular to their documentation.

Myth 4: Resources must be recovered as quickly as possible in the event of a BCM incident.

Resources and critical business processes are the focus of BCM. The aim is to restore them as quickly as possible in the event of an incident. However, priorities must be set here. Attempting to restore all resources is usually doomed to failure. Instead, resources must be evaluated according to their criticality. Dependencies between different processes and the inheritance of criticality must be taken into account accordingly.

Myth 5: If you deal with BCM on a daily basis, you can survive in an emergency.

Nothing is more important in the event of an incident than an experienced expert who knows what to do. And yet: experience and knowledge are no guarantees for successful emergency and crisis management. On the contrary, those who allow themselves to be blinded by their supposed expertise run the risk of making quick assessments and wrong decisions – a serious risk. True expertise is therefore characterized by operational foresight, the recognition of the expert knowledge of others and an open culture of error.

Don't give misleading myths a chance: create clarity and train your employees and managers on current BCM topics. Security-Island offers multimedia and modular e-learning courses for your company.