An investigation into business continuity management systems of Maltese companies

Abstract

Purpose: The objective of this study is to explore the level to which Maltese companies adopt the notion of BCP, and evaluate their BCP components. The study discovers the level of maturity of Business Continuity Management framework between financial and non-financial companies. Additionally, it evaluates the importance of audit function towards the evaluation of BCM framework. Finally, this study analyses the benefits and challenges in the implementation of BCP within the Maltese companies. Design: To achieve the objectives of the study, telephone survey using questionnaires outlining key components of business continuity planning were performed with financial and non-financial institutions. Twenty-one organisations participated in the study, comprised of eight companies from the financial sector and thirteen companies from the non-financial sector. Findings: The outcome of the study indicates that the financial companies surpass the non-financial companies when it comes to awareness on the notion of BCP. All financial companies and some non-financial companies have an official documented BCP. The remaining non-financial companies are still in the process of implementing a formal BCP. In general, Maltese companies have a pro-active approach towards the concept of business continuity. Financial and non-financial companies have the support of the senior management to implement a BCP. All financial companies and some non-financial companies test their critical activities on a regular basis. The identified three most relevant benefits in implementing a BCP are recovery of critical activities, protect the company’s reputation and increase in customer confidence. The three most challenges are non-profit making procedure, time consuming and lack of manpower. In addition, most of the Maltese companies follow the ISO 22301 standard to devise their BCP but not certified against the standard. Finally, all financial companies and some non-financial companies perform an independent audit review on their BCP. A self-review is conducted by the remaining non-financial participants. Conclusion: Most of the non-financial companies, still have a long way to go to increase the level of maturity of their BCPs. This is because there is lack of awareness, an official BCP still in process, not test their critical activities and not perform an independent review. Value: This study provides recommendations which are useful for every company of any nature and size on how to improve the embeddedness and maturity level of their BC procedures. This study is also important to increase awareness about the importance of BCP amongst those companies which do not have an official BCP.