CBCI (Business Continuity Certifications): The programme nobody owns

Diagnosis first. The symptoms - 40% attendance, an absent sponsor, three unconnected resilience efforts - point to one root cause: continuity has been placed where it cannot exercise authority. Reporting to Facilities frames BC as a property function, so the coordinator can request cooperation from IT, operations and procurement but cannot require it. A quarterly meeting nobody attends is a symptom of a group with no decisions to make, not a scheduling problem.

Recommendations, each with its reason:

• Move the coordinator's reporting line to the COO or a named executive. Accountability for continuity must sit with someone who can commit budget and accept risk. Below that level, every trade-off gets escalated and stalls.
• Replace the steering committee with a management review that has written terms of reference, a quorum, and explicit decision rights: approve impact tolerances, approve strategy, accept residual risk, release resources. Attendance improves when the agenda contains decisions rather than updates.
• Reset the sponsor's role. A sponsor who has attended one meeting is a name, not a sponsor. Either the CFO is briefed monthly with a one-page decision paper, or the role moves to the executive who will actually engage.
• Bring IT DR, depot drills and supplier assurance under one programme plan. Three parallel efforts produce three sets of unconnected assumptions about dependencies.
• Treat the cyber programme as an ally, not a rival. Dependency mapping, incident management and alternate communications are shared work; convergence protects the reduced budget.

The judgement is not whether to agree, but what agreeing would mean. Certification audits sample evidence of management review, internal audit, exercising and corrective action. Meridian has none of these. Attempting full scope in 12 months produces documentation written to satisfy an auditor rather than capability - and the audit will still find the gaps, because they are behavioural, not documentary.

The reasoning to put to the board:

1. Certification is the output of a working management system, not a project deliverable. The BIA and risk assessment are inputs to strategy selection; without them, there is nothing to certify except a filing cabinet.
2. Sequence the work with gates: BIA and risk assessment (months 1–3), strategy selection and approval (4–6), plan development and implementation (7–9), exercising and corrective action (10–12), then a pre-certification gap assessment.
3. Offer a phased scope rather than a phased ambition: certify head office plus the two highest-consequence depots in the first cycle, with a stated expansion plan. This is honest and auditable.
4. Restate the deadline in writing as a target with gate reviews, and state explicitly which gates are outside your control (executive sign-off, budget release).

What to avoid: accepting the date silently and hoping. The failure mode is a missed deadline plus a documented trail showing you knew the date was unachievable.

Do not spread 70% evenly across a 100% plan. Equal cuts make every activity half-broken. Triage by consequence: which activities, if stopped, would halt revenue, breach a regulator or harm a vulnerable customer group? Even without a formal BIA, the last two years of incident logs, customer complaints and audit findings will rank the top handful.

Protect, in this order:

• Exercising. It is the cheapest element of the programme and the only one that generates real assurance. Cutting it saves little and destroys credibility.
• Dependency knowledge. Knowing that everything hangs on one ERP instance is free to obtain and changes every other decision.
• The top-tier activities' plans and alternates. Detailed plans for three activities are worth more than outlines for sixty.

Exploit rather than duplicate. The cyber programme will produce dependency mapping, incident response procedures, alternate communications and supplier assurance - all of which the continuity programme needs. Negotiate shared ownership of those deliverables instead of rebuilding them.

Use existing roles. Depot managers as champions, continuity tasks written into job descriptions, tabletop exercises run inside existing team meetings. No new headcount.

Then document what you cannot mitigate. Residual risk goes onto the corporate risk register with a named owner and a board-level acceptance. Moving an unaffordable risk to the people who own the risk appetite is the correct professional action; absorbing it silently and hoping is not.