A business continuity plan maturity index : a comparative study of Maltese licensed financial services firms

Abstract

The purpose of this dissertation is to assess at what level of maturity Maltese entities have arrived at implementing their Business Continuity Plan (BCP). This study examines whether large and well-established financial firms have a more mature BCP than other relatively smaller growing financial firms. Furthermore, it determines whether banks are more prepared for a disruption than other institutions in the same industry. The latter required comparison of sectors mainly; investment firms, insurance companies and banks. This aimed also to demonstrate the importance of risk management and BC planning within an organisation. Secondary research was carried out with reference to the BCP process, existing international maturity models, regulations and standards. To achieve these objectives, structured interviews with risk management or BC planning officials were conducted, in which the likert scale was used ranging from strongly agree to strongly disagree. This enabled the author to develop a maturity index and arrive at a maturity score for each institution. In total, seventeen financial institutions were interviewed: six banks, six investment firms and five insurance companies. Findings have shown that importance is given to BC planning and financial entities recognise the need for BC planning by showing their commitment. However, more focus is put on the IT side of the plan while the business side is given less priority. As a result, most strategies and testing revolve around the IT infrastructure. On the other hand, organisational size impacts the development and implementation of such a plan in the light of resources required, participation by employees and how issues requiring the implementation of the plan are tackled. The conclusion of this research highlights that most financial institutions have a mature plan but deficiencies were identified implying more work is required. Such financial entities consisted mainly of big and well-established organisations. Given that banks resulted to have either a very high or high BCP maturity it can be concluded that banks were proven to have a more mature plan than the other entities. When comparing sectors, more work is required within insurance companies while banks and investment firms are more advanced. Hopefully, this study will lead to further research in the subject matter primarily with respect to the main recommendations recognized in this study.