Client challenge
Established in 1996 in the City of London, Needhams 1834 is an industry-leading business continuity and resilience consultancy, specialising in risk and crisis management and training. Our client works with cross-sector clients, located all over the world in theprivate and public sectors, including FTSE 100 companies, government bodies, financial institutions and universities. Needhams’ services enable clients to identify their potential risks, protect against them and put in place strategies, processes and plans that will mitigate the effects of disruptive events, ensuring business continuity.
As an international player in this area, Needhams felt it important to gain ISO certification to the new business continuity management (BCM) standard as soon as it was released. The decision to become an early adopter was an interesting one as ISO 22301 was a new certification, not a transition from BS 25999 (the British Standard on which the ISO is largely based). Our client saw the benefits of having ISO 22301, particularly in the overseas markets, due to the standard’s international recognition.
Implementing the new standard
The nature of the consultancy’s work meant the organisation had the in-house knowledge and expertise to quickly make the changes needed to its existing BCM system to comply with ISO 22301. As a first step, the organisation carried out an internal audit of the system against the requirements of the new standard. They identified a team member who had a detailed knowledge of business continuity, but hadn’t been involved in the existing management system. This allowed the audit to be as ‘independent’ and thorough as possible. The audit also helped serve as a gap analysis, identifying any weaknesses and potential non-conformities.
With little significant difference between the two standards, minimal changes were required. These, in the most part, were procedural. The team developed a plan to capture the work needed. To better improve the accountability of third-party suppliers, the consultancy decided to carry out an independent audit of its critical outsourced suppliers and include these for certification.
Now we are certified, we can approach our clients from a position of first-hand knowledge of the process – it’s a strong position to be in.
Certification through LRQA
To fully prepare for the assessment and alleviate employee concerns, our client held a training session first, ensuring everyone had appropriate knowledge of the company’s business continuity plans. “When the LRQA assessor did arrive, it was clear that he was seeking proof of a depth of knowledge appropriate to the role that the individual played within the organisation,” explains Andrew Macleod, consultant at Needhams1834.
“We chose to work with LRQA as we found them the most helpful in enabling the certification to happen. Our LRQA account manager came to visit to talk us through the process and we liked the approach,” comments Andrew. “And this was borne out by the nature of the assessment itself. We found it a valuable experience and have learned some pointers from the assessment that we will be able to use with our own clients.”
In particular, we helped our client structure plans to support its recovery time objectives (RTO) of critical activities, identified in earlier analysis.
