Unfortunately, Business Continuity Management is often only effected reactively. This means that, on the basis of incidents and events, there is a reaction. A proactive BCM policy, like a set of short or longterm targets, gives the organisation direction, stability and connection. Too often, the realisation of measures is enthusiastically undertaken, while there is insufficient or no policy-built justification. The consequence may be that, finally, there is no money, time and, thus, no commitment left to maintain these measures. The result is destruction of capital.

Every BCM implementation starts with poliy-making. BCM policy is aimed at the declaration and commitment of the strategic management on the manner in which, how and with which the organisation’s continuity is to be safeguarded. The position of the process is determined here, in accordance with the organisational culture, vision and mission and the kind of the ‘industry’. Among others, the following aspects are addressed:

• Roles and responsibilities
  Within the management, a portfolio holder of the process is appointed. An organisational form is defined to implement the policy (for instance by making projects) and resources are allotted to it.
• Scope of the process
  Organisational divisions or business processes, covered by the scope of risk consideration, are assessed. It is determined which types of measures are covered within the BCM scope and which ones are excluded.
• Organisation of the process
  Specific advicable aspects of the BCM implementation are given priority to. Initiatives, already existing within the organisation, are considered whether or not they will be covered by the BCM scope of responsibilities. For the financing of the functioning of the process and the Set of Standards, it is decided which budget and financing cycles are applicable.
• Preconditions
  There are set conditions which have to be met in order to make the implementation of the process possible and to obtain the desired process results. Thus, legislation and regulation may be declared applicable and it can be decided to what extent it would be advicable to outsource certain measures. But in particular, the aspects awareness and communication are the most important preconditions, which will have to be endorsed at a strategic level.

While other steps of the proces can be shortened, decreased or limited, this applies in no way to policy-making. Without an explicit policy at a strategic level, there is no basis for a correct functioning of the process.