Definition Evaluation of BC strategies
The risk analysis identifies the relevant risks that are to be avoided or reduced by appropriate BC strategies.
The institutional management strategically determines how the planning and implementation of business continuity measures should be carried out for the entire scope of the BCMS. For an objective assessment, it is recommended to define uniform evaluation criteria. In the subtype BC strategy, a strategy can be recorded and evaluated according to the following evaluation criteria:
- Description of the BC strategy
- Compliance with RTO
- Achievable emergency operating level
- Remaining residual risk
- Compliance with internal/external requirements
- Maximum possible emergency operating time
- Financial expenses
- Organizational expenses
- Emerging risks
- Additional benefits arising
The appropriateness and effectiveness of a BC strategy can then be evaluated:
Effectiveness: A BC strategy is effective if it reduces the probability of a failure to an acceptable level or enables time-critical processes to continue within the RTO at the emergency operating level.
Adequacy: A BC strategy is adequate if it is in line with the institution's strategic objectives, meets legal and regulatory requirements, and if the benefits exceed the costs. Once the assessment has been completed, the BCB submits the possible BC strategies to the institutional management for a decision. As the body with overall responsibility for the BCMS, the institutional management weighs up the effectiveness, benefits, costs, and risk appetite of the institution. The status can then be documented to show whether the strategy has been approved. Once approved, the BC strategies serve as the basis for the development of concrete BC solutions.
